Technical help after an incident
Hacked website analysis and recovery
A website incident is an event in which a site is hacked, infected with malicious code or stops working because of a security breach. We help assess a hacked or broken website, preserve the files and logs that are still available, remove the malicious changes we find and get the site working again. We provide technical help for the website. This is not certified digital forensics, legal advice or evidence examination for law enforcement.
On this page 10 sections
- 01First steps when you notice an incident
- 02How can you tell a website has been hacked?
- 03Why do websites get hacked?
- 04What can we do?
- 05How does website recovery work?
- 06What is different about an online store incident?
- 07Preserving backups and logs
- 08Limits of the service
- 09What not to send through the public form
- 10How can you lower the risk of another incident?
First steps when you notice an incident
Change no more data than you have to. Save the hosting and system logs, note when you noticed the problem and, if you can, restrict access to the affected site without destroying the information you have.
How can you tell a website has been hacked?
A hacked site usually gives itself away through changed behaviour that visitors, Google or the hosting provider notice before the owner does. If you see even one of these signs, check the site the same day.
- 01
Visitors are redirected to other sites
Often only on mobile or only when they arrive from Google search, so the owner may not see it.
- 02
Unfamiliar pages have appeared in search
Google results show pages on your domain about medicines, casinos or other unrelated topics.
- 03
Warnings in the browser or Search Console
A message appears in the security issues section of Google Search Console, and the browser shows a warning.
- 04
Unknown administrators or files
Accounts nobody created have appeared in the WordPress user list, or unknown PHP files show up on the server.
- 05
The hosting provider has restricted the account
The hosting provider reports malicious code, spam sending or unusual load.
Why do websites get hacked?
Small business websites are often compromised by automated bots that look for known vulnerabilities in outdated WordPress plugins and themes. Common causes are old plugins, illegally distributed copies of paid themes, weak passwords without two-factor authentication, and administrator logins left behind by former employees or developers.
That is why cleaning the files is not enough after recovery. If the vulnerability remains, the same site can be compromised again within a few days. During recovery we look for the way the attacker got in and close it.
What can we do?
What is possible depends on the website's platform, the hosting environment, and the backups and access available.
- 01
Initial technical assessment
- 02
Checking backups, files and logs
- 03
Removing malicious changes and getting the site working again
- 04
Recommendations on access, updates and next steps
How does website recovery work?
We split recovery into stages. Before we change the site, we preserve what helps explain the incident, and after recovery we can check the result.
Isolation and backup
We restrict access and save the current state, the files, the database and the available logs.
Analysis
We look for changed files, unknown users, injected code and the likely way in.
Cleaning or restoring
We remove the malicious changes, or restore a clean backup and move the new data across.
Hardening and checks
We update the system, change logins, review permissions and submit a review request to Google if one is needed.
What is different about an online store incident?
The risk is higher in an online store, because it holds customer contacts, orders and payment pages. If you suspect the checkout page has been altered, first restrict access to the store and contact your payment provider, for example Paysera or Montonio, so they can assess the risk on their side.
If personal data may have been affected, the GDPR provides that the data controller usually notifies the supervisory authority of the breach within 72 hours of becoming aware of it. In Lithuania that authority is the State Data Protection Inspectorate. Whether you need to notify it in your case is for you to decide with a lawyer. We provide technical information on which data may have been accessed.
Preserving backups and logs
Where possible, we save copies and the available system logs before removing malicious changes. This helps us understand what happened on the site, but it does not provide a formal chain of custody for evidence and does not replace the work of a certified expert.
Limits of the service
We do not examine devices or disks, monitor employees, carry out legal investigations or do law enforcement work. We do not guarantee that the attacker will be identified. If the incident involves personal data or regulated information, you may need a lawyer, a data protection specialist, your hosting provider or a certified incident response team.
What not to send through the public form
Do not send passwords, API or private keys, personal data sets, databases, log extracts, archives, malicious files or incident evidence. At first, give only a general description of the situation without sensitive details.
How can you lower the risk of another incident?
After recovery, what matters most is regular updates, backups that have been checked and a clear list of who has access to the site. Managed hosting at €20/month includes Cloudflare protection, backups and uptime monitoring, and website maintenance helps you keep up with updates. Recovering a typical hacked WordPress site costs from €150. For a more complex case, we agree the extra time before we start the cleanup.
Frequently asked questions
How much does hacked website recovery cost?
Recovering a typical hacked WordPress site costs from €150. The price includes removing the malicious code, closing the way in, restoring from a backup or cleaning the site, changing access passwords and checking the site's status in Google search. If the work needs more than about three hours, we agree the extra time at €45/hour in advance.
What should I do first if my website has been hacked?
First restrict access to the affected site, but do not delete anything. Save the hosting and system logs and the backups, and note when you noticed the problem. Do not change everything at once, because that can destroy information about the breach. Then contact us, but do not send passwords, keys or other confidential data through the public form.
Can you guarantee that all files will be recovered?
No. How much can be recovered depends on the nature of the breach, the backups available, the surviving logs and the access you have. Recovery is usually easier when a clean backup exists. After assessing the situation, we tell you what can realistically be recovered, what may be lost and which steps we suggest to prevent a repeat.
Is this digital forensics for court?
No. We provide technical help for the website: we analyse the breach, remove the malicious changes we find, restore the site and reduce the risk of a repeat. This is not certified digital forensics, legal advice or evidence investigation for law enforcement. If a court or the police will need evidence, contact certified experts before changing the site.
Is every incident a GDPR breach?
No. An incident may count as a personal data breach when personal data could have been affected, for example customer contacts or orders. In that case the impact and the legal obligations need a separate assessment, which the data controller carries out, with a lawyer if needed. A technical analysis can help establish which data may have been accessed.
Tell us what happened to your website and when you noticed it.
We reply with a proposed first stage and a clear price. You can also write to us directly:
info@techprojects.ltReport a website incident