Website Hacked: Malware Clean-up and Recovery

If your site redirects visitors to strange pages, Google or your host has warned you about malicious code, or pages you never made appear in search, the site has been hacked. We find the malicious code and hidden back doors, work out how the attacker got in, close the way in and bring the site back.

Signs of a hack

• The site redirects some visitors to casino, pharmacy or phishing pages, often only on mobile or from search.
• Google marks the site as dangerous or shows “This site may be hacked” in results.
• Thousands of pages you never created appear in Search Console and in search.
• Your host suspended the account or emailed you about malicious files.
• Unknown users appear in the admin panel and spam goes out from your domain.

What we do

1. Permission and access. We sign a scope letter and get access with the minimum rights needed.
2. Finding the malicious code. Injected code, web shells, rogue users, changed files and scheduled tasks.
3. The way in. We establish how they got in: an outdated plugin, a stolen password, a flaw in the code, a neighbouring site on the same hosting.
4. Closing and cleaning. We remove the malicious code, close the way in and update whatever let them in.
5. Recovery. We bring back a working version and test a backup by restoring it.
6. Afterwards. We change passwords and keys, help lift Google and hosting warnings, and write the report.

What you get in hand

• A clean site or server with the way in closed.
• Changed passwords and keys, and a backup tested by restoring it.
• A report: how they got in, what was affected, what was done, and what to change so it does not happen again.

Keeping it from happening again

Most small-site hacks come through outdated CMS software and plugins, weak or reused passwords, and admin panels without a second sign-in step. After the clean-up we offer hardening: updates, access rights, MFA, backups with a tested restore, and alerts. See the cybersecurity audit page.

Timing and cost

We start the investigation as soon as the permission is signed. Cost: a fixed quote after a first look and an agreed scope.

Who does the work

Security work is carried out by INNOVA CONSULT LTD., Corporation Number 1522612, Ottawa, Ontario (Corporations Canada). The team works from its own experience with strong tools, including Claude models, to find problems faster. A person checks every finding before it reaches the report. INNOVA CONSULT LTD has been approved for Anthropic's Cyber Verification Program (CVP), which lets verified organizations use Claude models for defensive cybersecurity work.

Hacked website questions

Can we just restore the site from a backup?

Only together with finding the way in. If the vulnerability stays, the site gets reinfected, sometimes the same day. The backup itself may already contain the malicious code.

Should we delete the infected files ourselves?

Leave everything as it is until work starts: files and logs show how they got in and what was affected. Change the passwords right away.

Which CMS do you work with?

WordPress, MODX and other popular CMS, as well as custom PHP sites.

Will you help remove the Google warning?

Yes. After the clean-up we request a review in Search Console and follow it through.

Will you find out what was taken?

Yes, as far as the server and site logs allow. The report states what was affected and what was done.

How much does a clean-up cost?

A fixed quote after a first look and an agreed scope.

Related services

• Cybersecurity audit for websites and servers
• Penetration testing for websites and web apps
• Online website support
• IT infrastructure for companies

Tell us what happened to the site. We will reply and agree the scope.