What should you do in the first hour?
Don't start deleting files. Change your hosting and WordPress admin passwords, tell your host, and if the site is sending visitors somewhere harmful, have the host take it offline. Then call us at 813-531-9400, so the cleanup starts from evidence instead of guesswork.
If your site runs WordPress or other PHP software, confirm your host has patched PHP for the October 2026 PHP2Shell flaws. A cleanup on an unpatched server doesn't last, so we check that first.
How does hacked website repair work?
Every cleanup follows the same order, so nothing gets skipped in the rush:
- Contain. We lock the site down so it stops serving infected pages, and save a copy of its current state so the entry point can be traced.
- Find the way in. Logs, changed files, users and plugins show how the attacker got in: an unpatched server, a vulnerable plugin, a stolen password or a leaked key.
- Clean. We restore from a clean backup where one exists, or clean file by file where it doesn't, and remove backdoors, hidden admin accounts and rogue scheduled tasks.
- Close the hole. We patch PHP, WordPress, plugins and themes, change every password and key, and harden the setup.
- Clear the warnings. We request Google's review in Search Console and help with host or blocklist flags.
- Report. You get a plain-language report: what happened, what we removed, and what keeps it from happening again.
Can you help with PHP2Shell?
Yes. In October 2026 the PHP project fixed two critical flaws, nicknamed PHP2Shell, that let attackers run code on servers running PHP, which covers most WordPress sites. We confirm your PHP version with your host, update it where your plan allows, move sites stuck on PHP 8.1 or older to a supported version, and check for anything an attacker left behind before the patch.
Which sites do you repair?
Mostly WordPress and WooCommerce, plus other PHP sites and custom builds. Sites another developer built are the norm for us. If nobody remembers who hosts the site or where the logins are, that's a normal starting point.