$ cat signals.md
Learn moreBlog about hacked sites
Advice on WordPress security and site cleanup. How to recognize a hacked site, what to do after the first signal, and when a local review makes sense.
$ read --malware --backdoors --spam
Signs a site is hacked: 18 signals to check
Signs a site is hacked are rarely obvious. Here are 18 signals in the browser, Google search, WordPress admin and hosting - and how to check...
Hacked WooCommerce store: how we cleaned it up
A real case: a hacked WooCommerce store with backdoor files, a fake admin and a cron job that restored everything. What we found and how we...
Infection returns after cleanup: why it keeps coming back
Infection returns after cleanup and you do not know why? It almost always means one thing. Here is where the cause hides and how to break th...
Hosting account suspended for abuse: first 60 minutes
Host suspended your account for abuse or spam? Do this in the first 60 minutes to find the cause and get the site back online.
How much does cleaning a hacked site cost and what it depends on
How much does cleaning a hacked site cost? We explain what the price depends on, why offers differ, and what to watch before you pay.
My site is hacked: what to do first and in what order
Your site is hacked and you do not know where to start? Here is a calm step order, what to do in the first hour, and when to call for help.
How to find a WordPress backdoor and remove it
Infection comes back after cleanup? There is probably a WordPress backdoor still on the site. Here is where it hides, what it looks like, an...
Website sending spam emails: why and how to stop it
Your host says your website is sending spam emails, or the account is suspended? Here is why that happens, how to find the cause, and the or...
Site redirects to another site: cause and fix
Your site redirects visitors to someone else's pages, but it looks fine to you? Here is why that happens, how to reproduce it, and what to d...