Redirects to spam, a Google blacklist, admin users you did not create, a plugin last touched in 2019. Send the domain and the symptoms. After we review the site and the access we need, you get the cleanup price and timeline in writing. Nothing starts until you approve the number.
If two or three of these sound familiar, this is the right page.
Visitors land on a pharmacy page instead of yours. Google shows a red warning before the site loads. There are admin users nobody created. Search results show pages you never wrote. Your host emailed about scripts sending spam.
The owner of a shop, clinic, or firm whose site is where people check whether the business is real. Usually WordPress, usually with plugins that stopped getting updates years before the break-in.
The warning stays up, the redirects keep handing your visitors to someone else’s shop, and hosts do suspend accounts over this. Money spent on SEO, ads, or a new homepage goes to a site people are being told to avoid.
If your host lets you, put the site in maintenance mode, change your hosting and admin passwords, and do not delete anything. The files are the evidence of how they got in.
A security plugin is useful after a cleanup, so keep it. A yearly plan from a provider such as Sucuri also includes cleanup, and it costs less than we do. Compare what each one includes. What we sell is one engineer who opens your files, closes the way in, rotates every credential, and signs a written record of what was found, what changed, and what could not be proven.
One backdoor or a year of neglect, the order does not change. You get a written record of each step, so you can hand it to your host or your insurer.
Files and database pulled off your server first. Every step after this one can be undone.
We compare WordPress core, your theme, and every plugin against the clean originals, pull the injected code out of the files and the database, and delete the backdoors and the PHP nobody uploaded on purpose.
The outdated plugin, the reused password, the file permission that let the upload happen. When the server logs are already gone and we cannot prove the entry point, we write that down instead of guessing.
WordPress users, database password, hosting and SFTP, the keys and salts in wp-config. Whoever was logged in is logged out, and you get the new credentials.
We request the review with Google Safe Browsing and your host, then open the site on a phone and in a clean browser before calling it done. If a flag needs another pass, that pass is part of the job.
All of it comes in one plain-language document you keep.
If you hated the site before the hack, say so in the first email and we will price the rebuild next to the cleanup.
Send them when we agree on the price, not in the first email. If you would rather not hand over a password, make us our own admin user and delete it the day we finish.
Stay on your hosting. We work inside the account you already pay for, we never need your card, and every credential we rotate goes back to you at handoff. We do not resell hosting, so we have nothing to gain by telling you to move.
The cleanup is the one-time job. Care starts once the site is clean, not instead of it.
from$500
How many sites and installs are involved, how long it has been infected, and whether customer or payment data is in the database. A multisite network, a large store, or a server whose logs have already been rotated away is quoted on its own, and you see that number before we start.
Book within 7 days of your free report and we take $150 off, through December 31.
Care starts once the site is clean. 3-month minimum, and the first month is free when it starts right after a cleanup we did. It is for a WordPress (or similar) install you already run, and it is not the Nova plan (from $12/mo), which is hosting for a site built there.
Care+ is worth the difference when the site takes orders or bookings, or when two hours a month of changes is closer to what you actually send us. Start on Care and move up later, or the other way around. In a month with nothing to change we still run the updates, test the restore, and send the log.
A site we build has no plugins to update. It needs a place to live, a domain that does not lapse, and someone to change a line when you ask.
$49/mo
It is for a website we built. The first 3 months are free when it starts with the build. No minimum, and a year paid up front is $490. A bigger change is quoted at a fixed price before we do it.
A WordPress install needs Care, above. A site made on Nova is already hosted by its Nova plan.
The free report reads the public site: redirects, mixed content, a blacklist flag. It cannot open your files, so it will not find the backdoor. The cleanup is the one-time job. Care starts after it.
Free
Paste the URL and see what is slow, broken, or unsafe, with evidence and severity. No card.
Run the report →From $500
Quoted once we see the site and the access, in writing, before we start. Book within 7 days of your report and we take $150 off.
Get the price →$149/mo
Starts after the repair and keeps the site fast, safe and current. 3-month minimum. First month free when it starts right after a repair we did.
What it covers →If you want off WordPress once the site is clean, that is a custom build or a Nova design, and we will tell you which one fits. We will not sell you monthly SEO on a site that is still infected. Some of the client work on our portfolio is sites we keep running month to month. Names stay private, and we can arrange a reference if you ask.
If yours is not here, ask it in the first email.
It does, and for a small site that needs scanning and a firewall, a plan like theirs or a good plugin can be enough. We will tell you so. Compare what each one includes, not only the price.
What you get from us is one person who reads your files, closes the entry point, rotates every credential, and hands you a written record of what was found, what changed, and what we could not prove, which you can give your host or your insurer. If that is what the job needs, this is the page.
Reinfection almost always means the way in never closed. If it comes back through something we cleaned or something we said we had closed, we go back in and finish the job. If it comes back through something we flagged and nobody changed, an abandoned plugin, a password still shared with a former employee, it is a new job and we say so before we touch anything. The written record from the first cleanup is what settles which one it is.
Make us our own admin user and delete it the day we finish. We only ask for what the job needs, when we agree on the price, and every credential we rotate goes back to you at handoff.
We work on a copy where the work allows it. Removing files and rotating credentials happen on the live site, and for those minutes a maintenance page is safer for your visitors than a running redirect. You get the windows in advance, and we do not pick your busiest hour.
Yes, and most clients do. If your host is part of the problem, no usable backups, a version of PHP from several years ago, shared space you cannot lock down, we tell you and price the move separately. We do not resell hosting, so we gain nothing by telling you to move.
Carlos Zambrana, the same person who answers your email. He has more than ten years on live sites, and your database stays with him: we do not pass it to subcontractors. More about us.
No. Nobody can promise that. What we can do is close what we can prove, rotate everything, and keep the known holes shut with Care. Most sites we see were not broken into by a person choosing them, they were found by a script looking for a plugin version.
Yes. Esta página en español. Emails, calls, and the written report can all be in Spanish or English. Tell us which one you want in the form.
That is enough for a first email. We reply in one business day with whether we can help, what access we need, and the price.