Thank you
We have it, and this one goes to the top of the list.
If you have not heard back within the hour, call and say your site is down. That gets straight through.
What we do
Getting the site clean and back up
In this order, because cleaning a site without finding the way in means doing it again in a fortnight.
- Put a holding page up if the site is serving malware, so visitors and Google stop seeing it
- Copy everything exactly as it stands before touching anything, because that is the evidence
- Find and remove the injected files, the database entries and any admin accounts that are not yours
- Close the way in: an outdated plugin, a reused password, file permissions, an exposed login
- Ask Google to review the site and lift the warning
- Set up backups and monitoring so the next attempt is caught in hours rather than weeks
While you wait
Four things worth doing right now
None of these need us, and the first one matters most.
- Do not delete anything and do not reinstall the site. What is on the server now is how we work out how they got in.
- Change the password on your hosting account, and on the email address that account is registered to.
- If your site takes payments, tell your payment provider today.
- Write down when you first noticed it and anything that changed on the site in the weeks before.
Questions
The ones people ask before they fill this in
How quickly can you start?
Same day. A report through this form goes to the top of the list, and if you have not heard back within the hour, call and say your site is down. That gets straight through to a person.
Google is showing a warning on my site. Can that be removed?
Yes, once the site is clean. We submit it for review and the warning usually clears within a few days. It cannot be rushed and anybody telling you they can remove it in an hour is guessing.
Will I lose my content?
Almost never. We work on a copy and keep the original untouched. The exception is a site with no backups where the attacker deleted things outright, and even then a hosting company usually holds a copy for a few weeks. We check that before we start.
Do I have to move my hosting to you?
No. We clean the site where it is. If the hosting is the reason it keeps happening we will say so, and then it is your decision.
What stops it happening again?
Updates that are applied rather than postponed, logins that are not shared, and someone watching. That is what a maintenance plan buys, and it is worth less than one cleanup a year.