Your site has been hacked. Here is what we do next.
We clean the infected files and database, find the way the attacker got in, close it, and help you get warnings removed from Google and browsers.
Part of Managed servicesWhat we do
Containment
Passwords and keys changed, suspicious accounts disabled and, where needed, a maintenance page shown while the clean-up happens.
File and database cleaning
Injected code, hidden admin users, spam pages and redirect scripts removed from files and the database, compared against known good copies.
Finding the entry point
Server logs, outdated plugins and weak credentials examined to identify how the attacker got in, so the same hole is not used twice.
Closing the gap
The vulnerable plugin, theme or code updated or replaced, file permissions corrected and the server hardened.
Blocklist and warning removal
Review requests sent through Google Search Console and to other blocklists, and help with your email provider if your domain was used for spam.
Follow-up monitoring
File change detection and malware scans after the clean-up to confirm nothing returns.
When clients call us about this
Visitors are redirected to sites you have never heard of
Redirects that appear only on mobile or only from search results are a common sign of injected code.
Google shows a warning or strange pages in search
Spam pages in other languages or a "This site may be hacked" label mean the infection is already visible to customers.
Your host suspended the account
Hosts often suspend sites that send spam or host malicious files. We clean the site so it can be restored.
Questions we are often asked
Can you start right away?
Contact us with the website address and what you are seeing. We confirm the scope and access we need, then begin as soon as access is in place.
Will we lose content or orders?
We work to keep legitimate content and data. Before cleaning, we take a copy of the infected site so nothing is lost if we need to check something later.
What if we do not have a clean backup?
Most clean-ups are done without one. We compare files against original copies of the platform, plugins and themes, and review custom code by hand.
How do we stop it happening again?
The incident report explains the cause. Keeping updates current, removing unused plugins and adding monitoring under a maintenance plan reduce the chance of a repeat.
Tell us what you want to build, fix or grow
We reply within one working day with questions or a short plan.