We fix websites that have been hacked.
Cyber attacks and malware can bring your website down or put your users at risk. For these reasons, they should be dealt with quickly. Our dedicated team have the tools and experience to quickly restore and repair your website.
WordPress is the world’s most popular content management system, and its popularity means it is targeted regularly. We have years of experience fixing hacked WordPress sites, which lets us quickly identify and remove hacks, malware and other dangerous plugins or code. We can also look at other PHP-based sites and web applications.
- We find and remove the malware, backdoors and unknown administrator accounts.
- We work out how the attacker got in, so the same hole is closed.
- We update, clean or replace vulnerable plugins, themes and core software.
- We restore from a clean backup where that is the safest option.
- We reset passwords and keys, and lock the site down.
- We help you get a “hacked” warning in Google reviewed.
If your site has been hacked, the sooner it is looked at the better. Contact us and we will tell you what we find.
Questions
Frequently asked questions
Common signs are visitors being redirected to sites you do not recognise, spam pages or odd links showing up in Google results, a “this site may be hacked” warning in search or in the browser, your hosting account being suspended, administrator accounts you did not create, and your emails suddenly landing in spam. Sometimes there is no visible sign at all, and the first you hear is from a customer or your host.
Change your passwords for hosting, the website administrator, the database and email, using a device you trust. Do not pay anyone who contacts you demanding money, and try not to delete things in a panic, because the evidence of how they got in is often in the files. Then contact us. We take a copy of the site before touching anything, so nothing is lost.
We look for the malicious code, hidden backdoors and unknown user accounts, remove them, and work out how the attacker got in. We then update or replace vulnerable plugins, themes and core software, reset passwords and keys, restore from a clean backup where that is the safest option, and tighten the site so the same hole is closed. If Google has flagged the site, we help you ask for the warning to be reviewed.
It depends on the size of the site, what has been changed, and how the attacker got in. We will have a first look and tell you what we find and what it will take before doing the work, so there are no surprises. Prices on our site exclude GST.
Most attacks are automated. Bots scan the internet for out-of-date plugins and themes, weak or reused passwords, and sites running pirated “nulled” themes, and they do not care how big your business is. Popular platforms such as WordPress are scanned the most, simply because there are so many of them.
No one can promise a site will never be attacked, but you can make it much harder. Keeping everything updated, using few well-chosen plugins, strong unique passwords with two-step sign-in, regular tested backups and decent hosting remove most of the risk. We can set those up, and look after them for you. See our web hosting.
We have years of experience cleaning up WordPress, which is where most hacked small-business sites are. We can also look at other PHP-based websites and web applications. Tell us what you are running and we will say whether we can help.