# Hacked site? We clean it up and lock it down.

> Redirects to spam sites, Google's red warning, a host suspending the account, email going out on its own. We stop the damage, clean the site by rebuilding it from clean sources and move it to an environment where an attack stays contained.

- Service: Clean-up and hardening
- Sites: WordPress, WooCommerce, PHP
- After: Isolated user, Cloudflare, monitoring
- URL: https://cloudfactory.it/en/services/hacked-wordpress-site-cleanup-security/

## Deleting the infected file isn't enough.

Whoever gets into a site almost always leaves more than one door open: an extra admin user, a file hidden among the plugins, an instruction in the database, a scheduled task that reinfects everything a few days later. And on a shared server one compromised site can infect the others. Restoring the backup often doesn't help, because the backup already contains the infection.

## One site per user, one key per site.

We manage dozens of WordPress sites and PHP applications on our servers, and are moving them one by one into environments where every site has its own system user and its own email sending key. If a site is compromised, it stays confined there and its key is useless for anything else. We also close vulnerabilities flagged by scans and penetration tests when an upgrade isn't possible.

## Stop the damage first, then rebuild.

1. **Stop the damage.** We put the site into maintenance or isolate it, take a full copy of files and database for analysis, and immediately change the panel, database, FTP and email passwords.
2. **Find how they got in.** We look for modified files, unknown users, scheduled tasks, code in the database and vulnerable or abandoned plugins. If the door they came through isn't closed, they'll be back.
3. **Rebuild from clean sources.** WordPress, themes and plugins reinstalled from official sources, not cleaned by hand. From the copy we only recover content and images, after checking them.
4. **Lock it down.** The site moves to a server with a dedicated system user, a supported PHP version and Cloudflare in front. Email sending credentials are separate for each site.
5. **Clean again for Google.** We request a review in Search Console to remove the warning, and check over the following weeks that the site stays clean.

## A clean site and an account of what happened.

We leave you a written report: what we found, how they got in, what we changed.

- Copy of the compromised site
- Incident report
- Rebuilt site
- New credentials
- Isolated system user
- Cloudflare in front
- Search Console review
- Update plan

## When something doesn't add up.

- **Sites with a Google warning**: The browser shows the red page, visits collapse, Google Ads suspends the campaigns.
- **Sites sending spam**: The server sends email you didn't write and the domain ends up on blocklists.
- **Suspended hosting**: The provider has blocked the account for malware, often taking the email with it.
- **WooCommerce shops**: Customer data is involved: we assess with you whether the authority must be notified, within 72 hours.

## If it just happened.

### Isn't a security plugin enough?

A plugin helps find suspicious files, but can't guarantee everything is gone, and it runs inside a site that can no longer be trusted. That's why we rebuild from official sources.

### Why not restore the latest backup?

Because the infection often got in weeks before anyone noticed, and the backup already contains it. We use it, but only after checking what's inside.

### Do I need to notify anyone?

If the site handled personal data, such as orders or contact requests, it may be a breach to notify to the data protection authority within 72 hours. We help you gather the facts; the decision and the notification stay with you or your privacy adviser.

### What if the site isn't WordPress?

We also work on custom PHP applications, Laravel and CakePHP included. The method is the same: copy, analysis, rebuild from clean code, isolation.

---

Cloudfactory S.r.l., Rome. Contact: hello@cloudfactory.it