Hacked website recovery

Most hacked sites were never targeted. They were found by a script working through the whole internet looking for one known vulnerable plugin, and yours answered. That is worth knowing, because it changes what a fix has to do.

Cleaning up is the easy half. Malware comes out, injected redirects and spam pages go, rogue administrator accounts are removed, and the site goes back to serving what it is meant to. The half that matters is working out how they got in. A cleanup that skips that buys you a fortnight, and we would rather not sell you a fortnight.

Most of this work lands on WordPress, Joomla and TYPO3, because that is what a great deal of the web runs on and what the automated attacks are written against. It is not a limit. Drupal, Magento, Craft, a static site with a compromised deploy pipeline, or something bespoke that somebody wrote years ago and nobody has touched since are all the same job underneath: establish what was reachable, establish what was run, close it, and make the next attempt fail. The CMS changes the details rather than the method.

What comes after is security automation in miniature: updates that actually get applied, access that expires when people leave, backups you have tested restoring from, and enough monitoring to find out from a machine rather than from a customer. And if the site turns out to be beyond saving, or was not much good before any of this happened, rebuilding it properly is often cheaper than defending it.

Where a breach needs a deeper investigation than a cleanup, our trusted cybersecurity partners take it on. And if the old hosting was part of the problem, our hosting partners can move the site somewhere hardened and looked after.