Hacked site? We clean it up and lock it down.
Redirects to spam sites, Google's red warning, a host suspending the account, email going out on its own. We stop the damage, clean the site by rebuilding it from clean sources and move it to an environment where an attack stays contained.
Deleting the infected file isn't enough.
Whoever gets into a site almost always leaves more than one door open: an extra admin user, a file hidden among the plugins, an instruction in the database, a scheduled task that reinfects everything a few days later. And on a shared server one compromised site can infect the others. Restoring the backup often doesn't help, because the backup already contains the infection.
Stop the damage first, then rebuild.
- 01
Stop the damage
We put the site into maintenance or isolate it, take a full copy of files and database for analysis, and immediately change the panel, database, FTP and email passwords.
- 02
Find how they got in
We look for modified files, unknown users, scheduled tasks, code in the database and vulnerable or abandoned plugins. If the door they came through isn't closed, they'll be back.
- 03
Rebuild from clean sources
WordPress, themes and plugins reinstalled from official sources, not cleaned by hand. From the copy we only recover content and images, after checking them.
- 04
Lock it down
The site moves to a server with a dedicated system user, a supported PHP version and Cloudflare in front. Email sending credentials are separate for each site.
- 05
Clean again for Google
We request a review in Search Console to remove the warning, and check over the following weeks that the site stays clean.
A clean site and an account of what happened.
We leave you a written report: what we found, how they got in, what we changed.
When something doesn't add up.
Sites with a Google warning
The browser shows the red page, visits collapse, Google Ads suspends the campaigns.
Sites sending spam
The server sends email you didn't write and the domain ends up on blocklists.
Suspended hosting
The provider has blocked the account for malware, often taking the email with it.
WooCommerce shops
Customer data is involved: we assess with you whether the authority must be notified, within 72 hours.
One site per user, one key per site.
We manage dozens of WordPress sites and PHP applications on our servers, and are moving them one by one into environments where every site has its own system user and its own email sending key. If a site is compromised, it stays confined there and its key is useless for anything else. We also close vulnerabilities flagged by scans and penetration tests when an upgrade isn't possible.
Where we've done it before.
A WordPress fleet off an end-of-life server.
WordPress sites and PHP apps moved in waves to new servers, with one system user per site, current PHP and separate email credentials.
Security remediation for a laboratory group.
External rating and penetration test findings closed one by one, then three inherited servers replaced by two, managed directly.
Four vulnerabilities closed on a platform that runs real heating systems.
CVE-2022-37454, CVE-2022-31629, CVE-2017-8923 and CVE-2020-11022 closed on a CakePHP 2.9.5 application: PHP 7.4.33 with the right FPM handler, jQuery 3.7.1 in seven views and a report on why PHP 8 is not possible.
Email that leaves only from those entitled to send it.
Per-site SES policies with allowed IPs, a DMARC path from p=none to p=reject, SendGrid authentication and SPF under 10 lookups. One mistake stopped before going live.
If it just happened.
Isn't a security plugin enough?
A plugin helps find suspicious files, but can't guarantee everything is gone, and it runs inside a site that can no longer be trusted. That's why we rebuild from official sources.
Why not restore the latest backup?
Because the infection often got in weeks before anyone noticed, and the backup already contains it. We use it, but only after checking what's inside.
Do I need to notify anyone?
If the site handled personal data, such as orders or contact requests, it may be a breach to notify to the data protection authority within 72 hours. We help you gather the facts; the decision and the notification stay with you or your privacy adviser.
What if the site isn't WordPress?
We also work on custom PHP applications, Laravel and CakePHP included. The method is the same: copy, analysis, rebuild from clean code, isolation.