CONFIDENTIAL · WEBSITE SECURITY AUDIT
corePHP

Website Security Audit  /  Prepared by ‘corePHP’

Attackers have published hidden gambling pages on your website.

A public inspection of rtllou.org found injected online-gambling “doorway” pages indexed by Google under your domain. Your homepage still renders clean, so the pages sit on hidden URLs you would not notice while search engines index them under your organization’s name.

Prepared for
Right to Life of Louisville
Domain
rtllou.org
Audit date
Aug 4, 2026
Method
Public inspection only
01

Section One

Security Audit

Critical · Site compromised Overall finding

Injected gambling doorway pages are indexed under rtllou.org.

corePHP found injected online-gambling doorway pages indexed by Google under your domain - for example a page promoting “BIGO234 … AGEN SLOT … situs slot gacor” (Indonesian online-slot spam). The public homepage currently renders clean, which means the injected pages sit on hidden doorway URLs the owner would not notice, while search engines index them under the organization’s domain.

Findings at a glance

F-01 Critical

Injected gambling doorway pages indexed under the domain - e.g. /bigo234 “AGEN SLOT … situs slot gacor”.

F-02 High

Homepage renders clean - the injection hides on doorway URLs, so it goes unnoticed while search engines see it.

F-03 High

Brand & reputation - offshore gambling pages ranking under the organization’s name.

F-04 High

WordPress site with an unidentified entry point - cleanup alone will not guarantee it stays gone.

F-05 High

Elevated risk of a Google “This site may be hacked” flag and ranking loss.

Evidence · captured Aug 4, 2026

Indexed under your domain quarantined specimen
rtllou.org › bigo234
BIGO234 : AGEN SLOT ONLINE & SITUS SLOT GACOR …

BIGO234 … AGEN SLOT … situs slot gacor terpercaya … daftar link slot online … [injected doorway text published under rtllou.org]

⚠ Injected page · not created by your organization
Why it went unnoticed
homepage: clean vs. doorway URLs: indexed

The visible site looks normal, so nothing on your dashboard signals a problem. The injected pages live on separate hidden URLs that only search engines and direct links reach - which is exactly why this kind of compromise can sit undetected for months.

last verified · 2026-08-04 · public inspection only

Platform note

Your site runs on WordPress. A durable fix has to identify the injection point so the pages do not simply return after removal. The usual entry points are:

  • a vulnerable or abandoned plugin
  • a compromised administrator account
  • a malicious file upload left behind on the server

Why it matters

Reputation
Supporters and the public can find gambling pages under your organization’s name.
Search
A hacked-site flag and ranking loss cut your visibility in Google.
Escalation
Spam footholds are routinely upgraded to redirects and malware.
Trust
Your donation flows live on the same site as the compromise.

Recommended actions

Immediate

  • 01 Remove the injected pages.
  • 02 Reset credentials and enable two-factor authentication.
  • 03 Update or replace vulnerable plugins.
  • 04 Request a Google Search Console review.
  • 05 Monitor for reinfection.

Strategic

Rebuild on a secure, monitored WordPress + Elementor platform with HTTPS, a web application firewall (WAF), and continuous malware scanning - so the site is not just cleaned once, but kept clean.

See the proposed rebuild →
02

Section Two

Proposed New Website

A complete, approvable homepage in your own logo, blue-and-magenta palette, and typography - clean, fast, and secure. This is not a wireframe; it is the design you can approve as-is.

We build it, you own it.

Today

Hidden gambling doorway pages, indexed under your name.

Unknown entry point. No monitoring. Reputation and search rankings exposed.

Proposed

A clean, monitored, hardened site.

HTTPS, WAF, malware scanning, and continuous monitoring - built on WordPress + Elementor.

Homepage preview · your brand

Open full preview in a new tab
Contact Us Volunteer (502) 000-0000
Serving Louisville & Kentucky

Protecting life across Louisville and Kentucky.

Education, community programs, and advocacy - powered by supporters who believe every life matters.

A mother holding her smiling baby
Every life matters
Louisville & Kentucky
A mother holding her newborn
50+
years serving families
Who We Are

A Louisville voice for life.

Right to Life of Louisville is a community-supported nonprofit providing education, resources, and programs across the Louisville area and the Commonwealth of Kentucky.

Through educational videos, events, and outreach, we connect neighbors with information and with one another.

50+
Years serving
Local
Volunteer-led
KY
Statewide reach
Get Involved

Programs & Events

Volunteers EVENT

Community Outreach

Local gatherings that connect volunteers and neighbors.

A family learning together SERIES

Educational Videos

A growing library of resources you can watch and share.

A family gathering ANNUAL

Banquet & Fundraiser

Our flagship gathering supporting the year’s programs.

From Our Resources

The data behind our mission.

Your existing resource graphics carry straight into the new site - presented cleanly, load quickly, and stay accessible on every device.

Explore the Learn section →
Data resource graphic

News & Updates

A family outdoors
Aug 2026

A note from our leadership

Read the latest from Right to Life of Louisville.

A grandmother and grandchild by the waterfront
Jul 2026

Upcoming events this fall

Mark your calendar for programs across the region.

An expectant mother
Jun 2026

New educational videos added

Fresh resources now live in the Learn section.

Your gift protects life in Kentucky.

Every contribution supports education, events, and community programs.

Donate Now

Rendered in your brand with your real logo and resource graphics. Photography shown is representative and swaps for your own at build.

WAF

A web application firewall blocks attacks before they reach the site.

HTTPS

Encrypted end to end, with certificates kept current automatically.

Scanning

Continuous malware scanning catches problems early.

Monitored

Ongoing monitoring on WordPress + Elementor so it stays clean.

03

Section Three

Proposal & Approval

No payment is collected on this page. Approval authorizes corePHP to begin; invoicing follows separately.

Approve & sign

Authorize the engagement

On approval, a signed PDF is generated for your download and a copy is sent to corePHP.