Incident response · 24/7
WordPress incident response
When a site is actively compromised, deleting infected files isn't enough. We investigate from the evidence, trace how the attacker got in, contain the breach, clean at the root, patch the hole and hand over a root-cause and incident-timeline report so it doesn't happen again.
What you get
- The entry point identified from logs and file evidence, not guessed
- Backdoors, hidden admins and persistence mechanisms removed
- A root-cause and incident-timeline report you can give stakeholders
- Credentials rotated and the hole patched so attackers can't walk back in
How it works
- 01Contain. Revoke admin sessions, lock unknown accounts and protect checkout before anything else.
- 02Preserve evidence. Snapshot files, database and logs before any cleanup, so the investigation has real evidence.
- 03Find the way in. Trace the entry point from the logs: a plugin, a stolen password or the hosting account.
- 04Remove malware. Backdoors, rogue admins, scheduled tasks and injected scripts — removed at the root.
- 05Clean in place. No old backup restored, so recent WooCommerce orders aren't wiped out.
- 06Patch the hole. Patch or replace the weak component and rotate keys and passwords.
- 07Retest. Re-scan, retest the entry point and place a test order to confirm checkout is clean.
- 08Clear warnings. Request Google's security review and check email blacklists (Google decides the timing, usually 1–3 days).
- 09Report & watch. Written report at handover, then daily checks for 30 days. Same weakness reused? We clean it again at no charge.
Questions
How is this different from malware removal?
Malware removal is the cleanup. Incident response adds the investigation: we reconstruct how the attacker got in and when, so the fix addresses the root cause, not just the symptoms.
Do you need my admin password?
For incident response we need hosting or SFTP access. All access is covered by an NDA and credentials should be rotated afterwards. Never send passwords in a web form — we arrange secure access after the NDA.
Can you work with my developer?
Yes. They keep looking after the site; we handle the incident and send them the report and the fix.
Was customer card data exposed?
We check whether a skimmer was present, when it was added and which checkout pages it ran on, and give you that window so you can notify your payment provider.
Site hacked right now?
Report it and an engineer replies within 30 minutes, day or night.