Start with the problem you can see
You might be dealing with unexpected redirects, an unfamiliar administrator account, spam pages or a suspension message from your host. You may simply have been told that something looks wrong. You do not need to arrive with a diagnosis. Describe what has changed and we will establish what access and investigation are appropriate. A broken update or hosting fault can resemble a security incident, so the cause needs checking.
What a recovery investigation involves
The scope depends on the website and the information available. With your authorisation, a review can cover WordPress files, installed components, database content, accounts and relevant hosting logs. Where possible, an initial copy is preserved before changes are made. We distinguish observed findings from likely explanations; missing logs or older changes can make the original entry point impossible to prove.
Agree the work before cleanup begins
You should know what is being investigated, what recovery work is proposed and what it will cost. A quote should identify any limits, access requirements, third-party costs and work that needs separate approval. A small brochure website and a busy shop have different recovery needs. If orders, bookings or recently uploaded content are involved, tell us before anyone restores an older version.
Recovery that fits the website
The agreed work may involve removing identified malicious content, replacing affected components from trusted sources, repairing configuration or restoring a suitable backup. The chosen approach needs to account for recent legitimate changes and the condition of the available backups. We do not assume that the newest backup is clean or that replacing the visible damaged page resolves the incident.
What happens at handover
The handover should make clear what was changed, what was checked and what still needs attention. Useful follow-up work may include reviewing access, maintaining software and agreeing a backup or monitoring arrangement. Recovery, ongoing maintenance and a full security assessment are different scopes of work. We will explain which one you are being offered.
What we need from you
Send the website address, a description of the symptoms, when you first noticed them and any exact warning message. Say whether you still have WordPress and hosting access and whether the site takes payments or bookings. Please do not email passwords, customer records or complete backup archives. If access is required, we will arrange a suitable way to provide it.
Can everything always be recovered?
No. Recovery depends on the damage, available access and usable backups. We cannot promise that missing data can be reconstructed, that the original attacker can be identified or that the site will never be compromised again. The practical aim is an agreed, checked recovery and a clear explanation of the remaining risks.
A recovery case study
A UK service business experienced unwanted redirects and Japanese product spam in Google. Read how we restored control, addressed the search problems and improved the website.
Read the anonymised WordPress recovery case study →