Service
If your site is redirecting to other people's pages, shows a warning in Google or simply won't open — call us instead of reading on. The rest of this page is for afterwards, or for making sure it never gets that far.
In an incident
The order matters. Cleaning up without closing the hole means you're back in the same place within days.
The site is taken down or put into maintenance mode, so it doesn't infect visitors or keep accumulating penalties from Google.
We make a copy exactly as it is. It's needed to work out how the attacker got in.
We look for modified files, injected code, hidden admin accounts and scheduled tasks left behind as a way back in.
Cleaning, or restoring from a clean backup from before the infection. Which of the two depends on the damage.
Updating everything, changing passwords and keys, removing the entry point. Otherwise everything so far is in vain.
A review request to Google if the site was flagged, and monitoring over the following weeks.
Prevention
Almost every incident we've seen could have been prevented by one of these eight things.
Related services
It's rarely just one thing. Here are the services that go with this one, and why.
Questions
If your question isn't here, call us — we answer by phone too.
+359 882 95 89 89Call +359 882 95 89 89. Don't rush to delete files — they're needed to work out how the attacker got in.
If you have access, change the administrator and hosting passwords. The rest needs a proper look.
By scope, after a review. It depends on how deep the infection has gone and whether there's a clean backup from before it.
If the site is on a maintenance plan with us, the clean-up and recovery are included.
Isolation is immediate. The clean-up is usually a matter of hours to a day or two, depending on the condition.
Removing the warning in Google takes extra time — that's up to them, not us.
In the vast majority of cases, through an un-updated plugin with a publicly known hole, or through a weak password. Targeted attacks on a small website are rare.
That's why updates and passwords are ninety per cent of the protection.
If it's only cleaned, without closing the entry point — almost certainly. That's why closing it is a mandatory part of the work, not an option.
After that, regular updates are what keep the site clean.
Next step
If it's urgent, call. If not, describe what you're seeing — a redirect, a warning, strange files or a slow site.
