Emergency help for WordPress

WordPress hacked? We clean your site and bring it back online in a controlled way.

We review WordPress files and the database, remove confirmed malicious changes, and test key functions. We agree the scope and cost with you before work starts.

  • Manual review of files and database within the agreed scope
  • Recovery and tests of the agreed functions
  • No passwords or access details in the enquiry form
Describe the incident

We send an initial response within 12 hours. The time needed for investigation and recovery depends on the findings.

Published: ·Updated:

Common signs

How to spot a possible WordPress hack

One symptom alone does not prove that a site was hacked. We investigate before making changes.

Visitors are redirected to unrelated websites.

Google or a browser displays a malware warning.

Unfamiliar links, spam or pages have appeared on the site.

Unknown WordPress administrators appear, or you have lost access.

Your hosting provider has disabled the site or flagged suspicious files.

Report the issue securely

How we work

Understand and secure the site before cleaning it

Before changing anything, we clarify the findings, required access and agreed scope.

  1. 1. Describe the incident

    Tell us the website address, what you have noticed and when the issue started, if you know. We use this to estimate the work and access required.

  2. 2. Preserve the current state

    Before making changes, we create or check a backup where the technical setup and access allow. This keeps the starting point available for review.

  3. 3. Review files and database

    Within the agreed scope, we inspect suspicious files, configuration, content, user accounts and scheduled WordPress tasks.

  4. 4. Remove confirmed changes

    We remove confirmed malicious code and restore verified content. If a clean reinstall is needed, we agree that with you first.

  5. 5. Test key functions

    Before launch, we test the pages and flows agreed for your site, such as key URLs, login, forms or REST endpoints.

  6. 6. Secure access and follow up

    We agree how to rotate affected passwords, keys and sessions. Incident Recovery includes 14 days of checks after launch for availability and the agreed key functions.

Anonymised case study

WordPress redirects cleaned up methodically

In one WordPress case, we found redirects in the database configuration and in 224 posts. We removed 448 malicious HTML and JavaScript blocks from a separate working copy. The original database and content were preserved. After restoring the site, we tested it and monitored it for 14 days.

The available logs did not prove the original access route beyond doubt. The scope and result of this case do not predict those of another incident.

224

posts reviewed

448

malicious blocks removed

Pricing and scope

Three starting points, depending on the incident

Prices below are starting prices. We confirm the specific scope after an initial review and before work begins.

First response

from 290 €*

Initial assessment and stabilisation

  • Assess the incident and immediate risks
  • Agree urgent stabilisation steps
  • Get prioritised next steps

A full cleanup is not automatically included in this initial package.

For recovery

Incident Recovery

from 890 €*

Cleanup and return to operation

  • Agreed review of files and database
  • Targeted cleanup and recovery
  • Function tests and go-live checks within the agreed scope

Includes 14 days of follow-up after launch, checking availability and the agreed key functions.

Forensics & hardening

from 1,490 €*

Extended analysis and security improvements

  • Extended review of available files and logs
  • Recovery and agreed hardening measures
  • Prioritised plan for further protection

The analysis is based on available technical evidence and is not a court-appointed expert report.

* VAT is not charged under the German small business scheme (Kleinunternehmerregelung).

We agree any additional work with you in advance.

Helpful details for an initial review

What to include in your enquiry

  • Your website address and a short description of the symptoms
  • When the issue started and what has already been changed
  • Whether you have a backup or a notice from your hosting provider
  • Which pages or functions are essential for your business

Please do not share secrets: Do not put passwords, hosting, FTP or SSH access details, private keys or database exports in the form. If access is needed, we will agree a secure way to share it.

Frequently asked questions

Before you get started

Will the cleanup delete any content?

Before making changes, we create a backup or check an existing one where the technical setup allows. What can be restored depends on the findings and the quality of the backup. We agree the approach with you before cleanup begins.

Can you identify exactly how the attack happened?

We review the available files, database and logs. The original access route cannot be proven in every case.

How quickly will you respond?

We send an initial response within 12 hours of your enquiry. This is the response time, not a commitment for how long the analysis or recovery will take.

Do I need to send passwords through the form?

No. Please do not send passwords, access details, private keys or database exports through the form. If access is needed, we will agree a secure way to share it first.

Will my website be protected from every future attack?

We implement the agreed security measures and recommend further steps where useful. No one can guarantee absolute protection against future attacks.

What does the 14-day follow-up include?

Incident Recovery includes a 14-day follow-up after launch. We check that the website remains reachable and that the agreed key functions work. This is not a guarantee against new attacks.

Next step

Tell us briefly what happened to your website.

We will respond within 12 hours and agree the next sensible step and expected scope with you.

You do not need to send access details yet. Please do not send passwords through this form.

Describe the incident

We process your details to respond to your enquiry. See our privacy policy for details.