Home / WordPress hacked
— Emergency help
WordPress hacked? Fast help and malware removal
If your WordPress site has been hacked, the order matters: lock and back up first, then change all access, find the entry point, clean up and close the gap. After that we harden the website and put it back online. We do it for you, or tell you what you can do yourself, in English or German.
— Right now
The first steps
In an acute case, please call us. We are usually reachable in the evenings and at weekends too, but we cannot promise it.
- Lock the siteRestrict access through your hosting, for example with password protection. Tell your host if the website sends spam or has already been suspended.
- Back up data and logsSave files, database and logs, and do not overwrite existing backups.
- Change accessWordPress, hosting, database and email, ideally from a clean device.
- Do not delete too earlyBack up first, then block unknown users. Traces help to find the entry point.
- Check data protectionIf personal data is affected, a report within 72 hours may be required under the GDPR (in Austria, the data protection authority DSB). If in doubt, get legal advice.
How to recognise a hack
- Visitors are redirected to other websites
- Google shows titles that are not yours, often in another language
- Your browser or Google Search Console shows a warning
- WordPress has users or files you do not know
- Your domain sends spam, or your host has suspended the website
— Our process
Eight steps in a fixed order
- Lock the siteRestrict access so the damage does not spread.
- Back up data and logsCopy files, database and logs before anything is changed.
- Change all accessSet new passwords and block unknown users.
- Find the entry pointCheck files, database, users and logs, not only with a scanner.
- Clean up or restoreRemove the malicious code and replace core, themes and plugins from clean sources, or restore a backup that clearly predates the attack.
- Close the gapClose the way in, otherwise the attack can come back.
- HardenPut preventive measures in place and agree a plan for the future.
- Go live againUnlock the site, request a review of browser and Google warnings, and test forms, checkout and email.
Why a backup alone is not enough
Restoring an old backup feels fast, but often leaves the gap open. Sometimes the backup is already affected, because attacks are noticed late. That is why we first find out how long the malicious code has been there and how it got in.
So it does not happen again
Before the site goes live again, we harden it: with fewer, well-maintained plugins, secure logins and monitoring, and with a plan that records what is maintained and checked, and when. On request we take over ongoing WordPress maintenance and add our Managed Service for Cloudflare as an extra layer in front of the server. Nobody can promise complete protection, but the risk can be reduced considerably.
Frequently asked questions
How fast can you help?
In an acute case, please call. We are usually reachable in the evenings and at weekends too, but we cannot promise it. We answer enquiries through the form within one working day. How long the clean-up takes depends on the incident; we tell you as soon as we have looked at it.
How is it billed?
Before we start, we look at the incident and tell you the expected effort. Then you decide.
Why was my small website hacked?
Most attacks run automatically. They look for known vulnerabilities, not for particular companies.
Is a security plugin enough to clean it up?
Scanners find only part of it. Malicious code in the database or hidden access often stays undetected, so we also check by hand.
Do you help if someone else built the website?
Yes. We need access to WordPress and to the hosting, then we look at the incident.
Let's talk about your project.
Tell us briefly what you need, in English or German. You will get an honest assessment, even if it is that you do not need us for it.
- We read your enquiry and reply personally within one working day.
- In a short conversation we go through the goal, scope and timeframe.
- You receive a written, itemised quote.
Your contact: Rico Jacobs, Managing Director. DISOTECH GmbH, founded in 2018, works with companies across Austria by video call, phone and email.
Prefer to talk directly?
Selected clients: Beauty Corner Rubin · Onyx Lashes · Poolroboter.ch · Augenkontakt · Resea Biotec · Wooden Tec
We use your details to handle your enquiry. Details are in our privacy policy (German).