A North Myrtle Beach restaurant had a slow site that only a developer could change, so the menu online was usually out of date.
Spuds-N-Subs
A faster site with a small custom editor. The owner changes the menu, prices, photos and hours from a phone and publishes without calling anyone, and the menu can follow the register on its own.
Spuddy posts for the Instagram and Facebook feeds
- Role
- Everything: design, build, social content
- Type
- Full-service client: website + menu editor + POS menu sync + social media
- Services
- Website
- Social media
The owner is the webmaster now.
Restaurant menus change weekly and developers do not. The editor is built for exactly the things that change — prices, items, photos and hours — and nothing else, so it fits on a phone and cannot break the layout.
The public site is plain, fast pages that load before a hungry customer gives up.
The menu can also update itself from the restaurant’s point-of-sale system. A read-only job on the register reads the live menu and passes it to the site, so a price changed at the counter shows up online without anyone retyping it.
The social side uses the same red, gold and type, with Spuddy, the house mascot, carrying the posts.
The old site got hacked.
Before the rebuild, Spuds-N-Subs ran on an older WordPress site with a big shared host. One day in June it went dark. The host was in the middle of its own incident and could only offer a place in the queue: no answer on whether it was a hack, what was taken, or when the site would be back.
It was a hack. An automated attacker had injected spam redirects into every WordPress install on the account and left a backdoor for getting back in. The malware happened to crash the site, which is the only reason anyone noticed. Otherwise it would have quietly served spam to customers.
Back online and taking orders the same evening, with a written answer on what was touched.
Contain it, keep taking orders.
Within the hour, visitors saw a clean holding page in the restaurant’s own colours, with the online-ordering link still working, so the shop kept taking orders while the cleanup happened behind it. PHP was switched off across the account so the backdoors could not run.
Every infected file and backdoor was found and quarantined, and old backup files that anyone could have downloaded were moved out of public view. A cleaned install re-infected itself after one scan, which settled it: the old site would be rebuilt, not scrubbed.
What was touched, in writing.
The owner got a written report on exactly what the attacker could reach. No card data was ever at risk, because payments ran through PayPal and never touched the site. The site was back up and taking orders the same evening, without waiting on the host.
The new site is the one on this page: plain, fast pages with nothing for that kind of attack to grab onto, and a small editor the owner runs from a phone.