Is your WordPress site hacked? We clean it up.
Diagnosis, full clean-up, restoration and closing the security hole so it cannot reopen. You have nothing to handle and nothing to reinstall: we take care of everything, through to the removal of the Google warnings.
Tell us about your situation
Tell us what you are seeing
Describe what you are seeing, even roughly. We work out the rest.
This applies to you if…
How to tell whether your site has been hacked
Any one of these signs is enough. That said, do not try to clean up yourself by deleting files at random: that is the surest way to break the site without removing the attacker’s way in, and to make our job harder.
Your site redirects your visitors
To dubious pages: online pharmacies, casinos, foreign sites. Often only from Google, or only on mobile.
Google is showing a warning
“This site may be hacked” or “Deceptive site” under your search result. Your traffic collapses within the day.
Unknown content or accounts
Pages, articles or administrator accounts you never created. Often in another language, published at improbable hours.
Your host has warned you
An email warning, a suspended account, or bulk emails sent from your domain, which then ends up blacklisted.
What we actually do
How we clean up your site
Six steps, in this order. The fourth is the one most quick clean-ups skip.
Immediate backup
Before touching anything, we take a full backup of the current state of the site. It serves as evidence and as a restore point: whatever happens next, we can roll back.
Diagnosis
Analysis of the files, the database, the user accounts, the scheduled tasks and the server logs. The aim is not only to find the infection, but to find how it got in.
Clean-up
Removal of infected files, code injected into the database, fraudulent accounts and backdoors: the small scripts attackers leave behind so they can come back.
Closing the security hole
This is the decisive step. A vulnerable plugin, a theme downloaded from a dubious site, a weak password, an obsolete PHP version: until the cause is dealt with, the site is reinfected within days.
Back online and fully checked
We check that everything works again: pages, forms, emails, shop, payments. A site that is clean but whose contact form no longer sends is not a repaired site.
Google warnings lifted
A review request in Search Console, followed up until the warning actually disappears from the search results.
Price, timescale, guarantee
What it costs: €150$175£129C$245
Flat fee for a brochure site or a shop of average size. Quoted beyond that: very large sites, multisite, or an old infection present in every backup.
Within 24 hours
Time to take the job on after your call. How long the clean-up itself takes depends on the scale of the infection: we tell you once the diagnosis is done, never after the work.
Clean-site guarantee
If traces reappear after our work, we clean the site again at no extra cost, as many times as needed, until it is completely clean.
And afterwards
So that it does not happen again
A site that is cleaned and then left unmonitored is usually reinfected within months: attackers automate their attacks and come back to sites they have already visited.
The one-off hardening we carry out during the clean-up deals with today’s hole, not the ones that will appear next month in a plugin you use. That is exactly what our maintenance plans are for: verified updates, daily intrusion monitoring, off-server backups.
Frequently asked questions
What people ask us when a site is hacked
The five questions that come up on every call.
In most cases your site stays available during the clean-up: we work on a copy and switch over once everything is clean. Downtime is only necessary if the infection is active and serving malicious content to your visitors. In that case, a few hours offline is better than a lasting Google penalty.
No. We disinfect; we do not start from scratch. Your pages, articles, products and orders are kept. In the rare case where a file is too damaged to repair, we restore it from an earlier clean backup.
Almost never through an attack aimed at you. In the vast majority of cases it is bots continuously scanning the web for a plugin known to be vulnerable and that hasn’t been updated. The most common causes: a plugin abandoned by its author, a premium theme downloaded for free, an administrator password that is too simple, or a PHP version that is no longer maintained.
If your customers’ personal data could have been accessed or exfiltrated, the GDPR requires you to notify your supervisory authority within 72 hours. Our diagnosis tells you what was affected, which gives you what you need to decide. We are not lawyers: on a sensitive matter, seek legal advice.
Change the password for your hosting account and your mailbox from another device. Do not delete any files. Do not reinstall WordPress over the top. If you have a backup, whatever you do, do not overwrite it: it may be useful to us.