+48 501 250 220

Website hacked? First aid within 24 hours of access

Google warns visitors about your website, visitors end up on unknown sites, or the hosting provider has suspended the account? We isolate the website, close the vulnerability and clean the website within 24 hours of access, weekends included. Afterwards you receive a written report.

Call now: +48 501 250 220 Request website first aid
  • Support and emergencies around the clock
  • 24 hours from access, weekends included, at a fixed price
  • PHP and WordPress since 2012
An outlined web page frame with a few content blocks; a foreign zigzag line enters through a small opening in its edge, the opening marked with a small orange ring, a dashed line shows the path

How to tell that your website has been hacked

  • Google or the browser warns visitors about your website.
  • Visitors, especially from Google search or on a smartphone, end up on unknown sites.
  • The search results show pages under your domain with someone else's advertising that you never created.
  • The hosting provider has suspended your account because spam or malicious code is coming from it.
  • There are back-end users nobody knows, or your password no longer works.

Websites built with WordPress are affected most often. We help just as much with websites built with Craft CMS and with other applications in PHP or CFML.

A browser window with content bars; one bar is replaced by a zigzag line, an orange dot lights up in the title bar

What to do and what to avoid until we start

  • Do not delete any files or users, even if they look suspicious. They show us how the attacker got in.
  • Do not restore a backup blindly. The vulnerability would stay open, and the backup may already contain the malicious code.
  • Write down what you noticed and since when.
  • Have the access details ready, as far as you have them: hosting account, back end, domain, server and existing backups.
Two sheets: on the left three rows with ticks for what to do, the first tick orange; on the right three rows with crosses for what to leave

What happens in the 24 hours from access

  1. Isolate and preserve

    We take the website offline or shield it, and we preserve files, database and logs before anything is deleted. The 24 hours run from access, weekends included.

  2. Find the way in

    We look for how the attacker got in: through a plugin or theme, stolen credentials, the server or custom code.

  3. Close and clean

    We close the vulnerability or shield it temporarily. We clean the website, from a backup taken before the attack where possible, and remove back doors and unknown users.

  4. Renew access

    We renew passwords, keys and access credentials for the back end, database, hosting and server.

  5. Google and report

    If Google has flagged the website as dangerous, we request a review. You receive a written report on what happened technically and on the next steps.

What we do not promise

  • Whether data has been taken cannot always be established with certainty. What we find is in the report.
  • When Google removes the warning is up to Google.
  • The 24 hours run from access. If credentials are missing, for example for the hosting account, they start as soon as we have them.
  • If the time is not enough, we tell you as soon as we know. Further work starts only with your approval.
A frame holding three boxes for what is part of the work; outside it a dashed box for what is not; the stretch of the frame between them is orange

What follows after the 24 hours

Once the website is clean again, the task is to keep it that way. The report lists the next steps, for example:

  • updates of CMS, plugins and PHP, tested on a staging environment first
  • replacement or removal of abandoned plugins and themes
  • back-end access with two-factor authentication, appropriate file permissions and a WAF on the server
  • backups with a restore test, and monitoring

Who carries this out is your decision. On request we take it on once or on an ongoing basis, as described under Web application and website security and Takeover and maintenance. For websites built with Craft CMS or WordPress, the CMS check is a good next step.

A line starts on the left with a short zigzag for the incident and then runs straight on with six evenly spaced checkpoints; the first one after the zigzag is orange

Our engineers' experience with websites and the servers behind them

PHP
with Smarty, Slim and WordPress since 2012
Craft CMS
in client projects, including this website
Full stack and DevOps
since 2012, from the application to the server
Server
Linux with WAF, Nginx and Apache

The first step: website first aid at a fixed price for the first 24 hours

Website first aid after an attack

For companies whose website has been hacked: Google warns visitors about it, visitors end up on unknown sites, spam appears in the search results, or the hosting provider has suspended the website.

  • Isolate the website and preserve its current state before anything is deleted
  • Find the point of entry: plugin, credentials, server or code
  • Close the vulnerability or shield it temporarily
  • Clean the website, from a backup taken before the attack where possible
  • Renew passwords, keys and access credentials
  • Request a review from Google if the website is flagged as dangerous

The 24 hours run from access, weekends included. Whether data has been taken cannot always be established with certainty; what we find is in the report. When Google removes the warning is up to Google. Further work after the first 24 hours starts only with your approval.

What the result contains

Within 24 hours of access, a contained and cleaned website and a written report on what happened technically, with the next steps to secure the website. The report is yours.

from €1,500 excl. VAT

Request website first aid

A case from our work

  • Three lanes from a field of dots end at an orange wall labelled WAF; one lane from a laptop passes through the gap to a shop front

    A shop flooded by bots that looked like customers

    A WooCommerce shop with 52 products loaded slowly or not at all. The cause was a paid network of bots sending tens of thousands of requests an hour, each from a different home address, and every single bot behaved perfectly. Our engineers stopped the traffic at the edge of the network, and when the bots changed tactics a month later, the second rule took the load off within two minutes.

Questions in the first hours after an attack

Can we not simply restore the latest backup?

On its own, that is rarely enough. The vulnerability the attacker used is in the backup too, and if the attack is older than you think, the backup already contains the malicious code. The website is then compromised again shortly afterwards.

So we first find the point of entry, then restore a backup from before the attack and close the vulnerability before the website goes back online. If there is no clean backup, we clean the website directly.

When will the Google warning disappear?

That is Google's decision. As soon as the website is clean, we request a review through your Google Search Console account and describe what we have fixed. If you do not have an account there yet, we set one up with you.

How long the review takes is up to Google, so we cannot promise you a time frame.

Can you tell whether data has been stolen?

Not in every case. We check logs, database and files for traces of access and record in the report what we found and what can no longer be established, for example because logs are missing.

The sooner the state of the website is preserved, the more can be established. That is why we preserve it first, before anything is deleted.

Do you only help with WordPress websites?

No. Websites built with WordPress are affected most often, for example through an outdated plugin or stolen credentials. We help just as much with websites built with Craft CMS and with other applications in PHP, ColdFusion or Lucee.

We always look at the server underneath as well, even if we have not worked with it before.

What happens if 24 hours are not enough?

The first 24 hours from access have a fixed price. If it turns out that more is needed, for example because several websites on the server are affected, we tell you early, estimate the further effort and start only with your approval.

The next steps to secure the website are in the report. Who carries them out is your decision.

What if we are missing access credentials?

This can usually be solved. We start with what you still have to hand. That is the contract and customer account with the hosting provider, access to the domain and, where available, the repository and backups. Server access can often be reset through the hosting provider if you act as the contracting party. We only gain access to a system with your explicit consent.

Do you cover weekend duty from time to time?

Yes. Support and emergencies are covered around the clock (24/7), weekends included. For other enquiries we are available Monday to Friday, 9:00 to 17:00 Central European Time, and we reply within one working day.

Attack under way? Call us

We handle support and emergencies around the clock, weekends included. On the phone you speak to the engineers who will clean up your website.

Phone +48 501 250 220
Email Email

Contact

What has happened to your website?

Give us the address of the website, the system if you know it, and what you have noticed. If the attack is still under way, it is better to call us.

Fields marked optional can stay empty.

Reply by email

For a call back we only need your phone number: emergencies around the clock, otherwise within one working day.

Which system, which technology, what do you want to achieve? Please do not send passwords or confidential documents.

Reply within one working day · without obligation

We use your details only to answer your enquiry. Prownex IT Services Sp. z o. o. is the controller. Retention and your rights are described in the privacy policy.