If your site is showing a warning screen, redirecting visitors, or turning up in search results with text you never wrote, it has been compromised. We clean it out by hand, close the way in, and put it back in front of Google for review.
Free look first $800 to $3,500 by severity Recheck window included
Before Alp I spent years on the tier-three escalation team at one of North America's largest website companies. Infected sites reached that desk after the front line had run out of options, and cleaning them was a daily part of the job. Over those years I worked through several hundred of them, file by file.
That is the reason this service works the way it does. I have seen where this class of malware hides, which is why the clean is done by a person reading the code rather than a scanner, and why hardening is part of every tier rather than an upsell afterwards.
Most owners notice one of these six before they notice anything else. Each one points at a likely severity, which is what sets the tier.
Six steps in the same order every time, with the price agreed before step two begins.
Severity sets the tier and the free look tells you which one you are in. An unusually large site can be quoted between two tiers, and either way you approve a fixed number in writing before the work starts.
One WordPress site that is still online and serving customers, with a quiet infection: injected code in your files, spam links in the footer, or an administrator account nobody created.
Visitors are meeting a browser warning, the site redirects somewhere it should not, or spam pages under your domain are showing in search results.
A store taking payments, a multisite install, several sites cross-infected on one hosting account, or a site that has been cleaned before and came back.
Prices in CAD. If the site turns out to be badly enough rotted that a rebuild costs you less than a recovery, we will say so and point you at a custom rebuild instead.
Every tier carries a recheck window, and reinfection inside that window is on us to sort out. Beyond it, the honest answer is that a site can be compromised again through a route that had nothing to do with the first infection.
Knowing which one applies to you is most of the work, and it is the part a scanner cannot do.
What owners ask once the panic has passed, answered plainly.
Almost always through a plugin or theme that went a long time without an update, a password reused somewhere that leaked, or a neighbouring site on the same shared hosting account. Core WordPress itself is rarely the way in. Part of the free look is telling you which of those it was, because a cleanup that skips that question tends to get undone within a month.
Sometimes, and it is worth asking. A restore helps when you know the exact date the infection started and your backup predates it. It fails when the backup is already infected, when the way in is still open, or when weeks of orders and form submissions would be thrown away with it. A restore also leaves the original hole untouched, so the same visitor comes back.
A Standard cleanup is usually done inside one business day. Blocklist recovery runs two to four days, because Google reviews on its own schedule once the site has been resubmitted. Full recovery depends on how many sites share the account, and we give you a date in writing before the work starts.
Once the site is clean and hardened, we submit it for review through the tools Google provides for exactly this. Google then re-crawls and clears the flag, which typically takes anywhere from a few hours to a few days. We cannot make that faster, and anyone promising a specific hour is guessing.
Hosting or cPanel access, WordPress admin, and DNS if the domain needs work. We ask you to create a fresh account for us rather than share your own. Every credential involved is rotated at the end of the job, including ours, so nothing we used stays valid once the work is signed off.
Yes, if you want that. The care plans are $99 or $399 a month and cover hosting, SSL, security, monthly backups, and round-the-clock uptime monitoring, which is what stops the next infection turning into a week of downtime. There is no obligation to take one, and a cleanup stands on its own.
Send us the domain and whatever your host has told you. The look costs nothing, and you will have a severity, a fixed price, and a date before you commit to anything.
Most enquiries get a reply the same day, usually within a couple of hours.
