01What happened and what we do first
A hacked site is not fixed by installing a security plugin. It is an incident: it has to be contained, we have to understand where it came in, and we have to check what has been touched.
We do not reinstall WordPress blindly or delete logs and files without a backup. First the evidence is preserved and a backup is secured; then what failed is cleaned and hardened.
The promise is concrete: containment, cleanup, hardening, and a report with what was reviewed and what is left pending. We do not promise invulnerability: no connected installation can guarantee it.
If there is an active risk, it is agreed with you whether the site has to go into maintenance or access has to be closed. Nothing is touched without a backup and a rollback plan.
02What it covers and what it does not
Includes
- Incident diagnosis: entry point, files, users, plugins, and theme.
- Backup and rollback plan before changing anything.
- Containment of the active risk and cleanup of the malware located.
- Patching of what allowed the entry, within the agreed scope.
- Review of access, users, and plugin surface.
- Later verification and a report with what was reviewed and what is pending.
Does not include
- New functionality or visual redesign.
- Licenses for premium plugins, themes, or third-party services.
- Hosting, WAF, or server management: they are coordinated, not included.
- Urgencies outside the agreed hours.
- Recovery of already-destroyed data when there is no backup.
- Forensic or legal expert analysis, and a guarantee of invulnerability.
03How we do it
-
01
Containment and backup
The state is preserved, a backup is taken, and it is agreed whether the site or access has to be temporarily closed.
What is needed Admin access, hosting or SFTP, a backup, and someone who can validate.
-
02
Diagnosis
Logs, files, users, plugins, and theme are reviewed to locate the entry point and the scope of the incident.
What is needed Logs, the list of plugins and theme, the latest changes, and access to the hosting.
-
03
Cleanup and patching
What was located is removed, the cause is patched, and permissions and users are reviewed before calling the case closed.
What is needed A work window and confirmation of the scope.
-
04
Hardening
The surface is reduced: updates, access, users, and configuration. Whatever is not applied is written down.
What is needed Deciding what gets applied and what stays outside the engagement.
-
05
Verification and report
We check that the site responds and that what was reviewed is clean; the report with the pending items is delivered.
What is needed Someone to validate the final result: content, forms, and access.
04Price and scope
Diagnosis starts at €50 and is the entry point: you pay to know what happened and what can be recovered. The cleanup and the hardening are quoted afterward, with a closed scope: what is reviewed, what is cleaned, and what is left out.
What determines the costIncident scope: one modified file does not cost the same as a widespread infection. · Files and database: what has been touched and whether a clean backup exists. · Access: if it is missing or has to be recovered, the work starts there. · Hosting: the provider's response and the state of the account. · Backup: if there is no copy, the work is more cautious and takes more verification time. · Urgency: work outside the agreed hours costs differently.
- Incident scope: one modified file does not cost the same as a widespread infection.
- Files and database: what has been touched and whether a clean backup exists.
- Access: if it is missing or has to be recovered, the work starts there.
- Hosting: the provider's response and the state of the account.
- Backup: if there is no copy, the work is more cautious and takes more verification time.
- Urgency: work outside the agreed hours costs differently.
05Timelines and response
The timeline is defined after the diagnosis. No hours are promised before seeing the scope: a localized infection and a compromised account are not treated the same way.
The first response confirms the next step: what we need, whether something has to be contained, and in what order. It is not a blind quote.
If the access or the backup are missing, or the hosting does not respond, the timeline starts once that is resolved. Waiting time is not deducted from the work or hidden.
Urgencies are handled according to availability and scope. There is no implicit SLA behind this page: whatever is committed is written in the proposal.
Response policy: First response within 1 business day, Monday to Friday, Colombia and Spain time.
06Compatibility and access
We work on what you already have: WordPress, PHP, MySQL, hosting, theme, plugins, builders, and WooCommerce. The installed stack is part of the case, not an obstacle.
To start we need: WordPress admin access, hosting or SFTP access, database access if needed, a backup, and someone who can validate the result.
Before changing anything: backup and rollback plan. If something fails, we roll back.
We do not rebuild the site if it is not necessary. Changing the theme, the database, or the hosting is a later decision and is justified in writing.
07What evidence we deliver
We do not publish incident metrics without permission. There are no client figures, average times, or published cases: what is here is the method, not a showcase.
The evidence of each case is this:
- Backup: what was copied, when, and where.
- Diagnosis: where it came in, what was touched, and how it was located.
- Cleanup and hardening: what was removed, what was patched, and what was reviewed.
- Verification: what was checked afterward and with what result.
The report is the deliverable. If there are cases with permission to publish later, they will appear with their source and their date; until then, nothing is invented.
08What you receive
| Deliverable | When |
|---|---|
| Incident report | At the close of the diagnosis, before deciding on the cleanup |
| Backup and rollback plan | Before applying any change |
| Cleaned and verified site | At the close of the intervention |
| Access and surface review | With the final report |
| Summary of pending items and next phase | At the close of the intervention |
09What happens next
Cleaning is not maintaining. A clean site starts accumulating updates, backups, and alerts that have to be watched.
Optional support starts at €50/month and includes updates, backups, security review, and an alert when something fails.
It is not mandatory. If you prefer to manage it yourself, the report includes what needs to be done and when.
See support and maintenance10Frequently asked questions
Can you guarantee it will not happen again?
No. We contain, clean, and reduce the surface, but no connected installation is invulnerable. What has been reviewed and what is still pending is written in the report.
Will I lose content?
Nothing is touched without a backup. Before any change there is a backup and a rollback plan. If the data was already damaged, we state what can be recovered and what cannot.
How much does it cost?
Diagnosis starts at €50. The cleanup and the hardening are quoted afterward, with a closed scope. The price depends on the incident, not on how long it takes.
Do I have to close the site?
Only if the active risk requires it. It is decided with you and the reason is explained; the site is not closed by default, nor left open when there is risk.
Do you work with my hosting, theme, and plugins?
Yes. We work on what you already have and document any exception, missing license, or hosting limit.
Do you remove the Google warning?
The status is reviewed and the cleanup is documented; removing the warning depends on Google and is not guaranteed.