FailuresTechnical fixes

My web app kept going down. The cause was a crypto miner on my server.

In short

Attackers got into my server, installed mining software and pushed the processor to 100 percent, so the site timed out. I cleaned it, then rebuilt the server and locked it down.

What I did

In July my web app started failing with timeout and gateway errors. I first suspected a memory leak and then my own scraper. Neither was the cause. The server's scheduled tasks showed mining software that started on every reboot. The attackers had got into the main server account and left their own login key behind.
Where

My own web app, July 2026
What changed

I removed the mining files, their scheduled tasks and the attackers' login key, and the site came back. Then I finished the recovery: I changed every password and key the server could reach, switched the server to key-only login, and rebuilt it from a clean copy.
What you should do

If your site is slow or timing out and you cannot find why, check your server's processor use and its scheduled tasks. Never allow password login for the main server account.
How long it took

One day to find and clean, then a full rebuild

A crypto miner is software that uses your server’s processor to earn digital currency for someone else. Attacker groups install it on any server they can get into.

Why it matters

A server running a miner is too busy to answer visitors, so pages time out. If that happens while Google is crawling, it sees errors instead of pages. These groups break in mainly by trying common passwords on servers again and again, which is why password login should be switched off.

How to check your own site

  • Look at processor use when the site is quiet. A server that is always near 100 percent needs checking.
  • Read the server’s scheduled tasks and login keys for anything you did not add.

At a glance

Effort to copyAbout a day
Type of businessAgency and SaaS
100%processor use from the miner
Every rebootwhen the miner restarted itself
1 dayto find and clean it
Status Done
What this changed in how I work

I lost time chasing my own code first. Now, when a server is slow for no clear reason, I check for strangers before I check my code.

Part of The SEO Lab, an open notebook of real SEO work, published as it happens.Recorded 17 October 2026. Filed under Failures. Everything here comes from work I did myself. If a number looks wrong, ask me how it was measured.

Keep reading in The SEO Lab

More entries on Technical fixes