A site had been hacked. The first anyone knew of it was every page except the homepage returning a 404, with staff locked out of the admin.
Those 404s came from a deleted .htaccess, which was the last thing they did rather than the thing that was wrong. Working back through the logs, the way in was a vulnerability in WordPress core rather than a plugin, and it had been open for three weeks. I removed the shells they had planted, neutralised the accounts they had created, gated the endpoint they came in through, and restored the site from a backup I could prove predated all of it.
Back up the same day, verified clean, and now updating itself. Automatic updates had been switched off in the configuration years before, which is why a hole disclosed three weeks earlier was still open.
The strange part is that the attacker updated WordPress themselves once they were in, closing the hole behind them, which is why nothing looked wrong until they broke the site three weeks later. Establishing it was genuinely clean meant checking core against official checksums and diffing every file in the commercial plugins against a backup taken before the vulnerability was ever published.