This is specifically for after a compromise has already been cleaned up somewhere else — by your host, a specialist, or a previous provider — and you want a genuine review of whether the door that let the attacker in has actually been closed, not just the visible damage undone. We do not perform the malware removal or cleanup itself; this starts once that work is already done.
Confirm the cleanup itself is already complete before ordering this
This review assumes malicious code, backdoors, and unauthorized changes have already been removed by whoever handled the incident. If your site is still actively compromised right now, this isn’t the right fix — you need the cleanup finished first, from us or from whoever else is handling it, before a hardening review has anything solid to evaluate.
Post-incident hardening review
A post-cleanup review confirming the door is actually closed — this isn't the cleanup itself.
- Full backup taken before we start
- If we can’t fix it, you get your money back
- We never ask for your own password
What we need from you
- Confirmation that cleanup is complete, and by whom, if known
- Whatever information exists about how the compromise happened, if any was determined
- Full admin, FTP, and hosting access to review the current state thoroughly
This or something else?
| Your site was compromised, cleanup is already done, and you want to confirm the door is actually closed | This fix covers it |
| Your site is currently still compromised, actively | Not this fix — you need malware removal or forensic cleanup first, from a specialist in that work |
| You want general hardening on a site that was never compromised | Security hardening pass – config, permissions, XML-RPC, login, the standard version |
| You want ongoing monitoring in place after this review, not just a one-time check | File integrity monitoring setup, worth adding afterward |
What we do
- Confirm with you that active cleanup is genuinely complete before starting
- Review the site thoroughly for any remaining signs of the original entry point
- Apply hardening specifically targeted at how the compromise is understood to have happened
- Check for any residual backdoors or unauthorized access the cleanup may have missed
- Implement broader hardening measures appropriate to the incident
- Document findings and the hardening applied, for your own record
What is included
- A thorough post-cleanup security review
- Hardening targeted at the specific entry point, where known
- A check for any remaining unauthorized access
- A written report of findings and actions taken
Not included
- The malware removal or forensic cleanup itself — this fix starts after that’s already done
- Investigating an active, ongoing compromise — a different, urgent specialism
- Ongoing ongoing monitoring, available as a separate, complementary fix
- Guaranteeing no further compromise is possible, which no single review can promise absolutely
Questions about this fix
What if I'm not certain the cleanup was actually done properly?
That's worth raising honestly before we start — this review checks whether the door is closed, but it works best when there's at least some confidence the visible damage has already been addressed, otherwise we may be reviewing a site still mid-incident.
Can you do the malware removal as part of this if it turns out it's needed?
Not as part of this fix — if our review finds cleanup wasn't actually complete, we'll tell you plainly and point you toward what that work involves, rather than scope-creeping into forensic cleanup we don't specialise in.
Why wouldn't the original cleanup provider have already closed the entry point?
Cleanup and hardening are genuinely different skills — removing malicious code doesn't always include the deeper review of how it got in, which is exactly the gap this review exists to check.
How do you know if the entry point is genuinely closed versus just not currently visible?
We review configuration and access against what's understood about how the compromise happened, which is a meaningful check, though no single review can promise absolute certainty against every possible re-entry method.
Should I get this even if I'm confident everything is fine now?
If a compromise happened at all, a second, independent look at whether the underlying cause was actually addressed is generally worth the reassurance, even when things currently look fine.
Related fixes
If this is the second time this year
A bad update breaking the site is a symptom of updates not being tested first. Care plans run every update on a staging clone before it reaches your live site, which is the actual fix for this happening again.
Your access, your rules
Create a separate admin account for us and delete it when we are done. For anything else, we get in touch and agree a method — never a form field on this site, never by reply to an email.
We back up first, always
Before anything is touched we take a full backup and keep it for 30 days. If a fix goes wrong, we put the site back exactly as it was.
If it is not what you bought
If the problem turns out smaller than what you ordered, we refund the difference. If it is bigger, we stop and send a quote before doing any extra work.
If we cannot fix it
You get back what we received. Diagnosis is on us — you only pay when the problem is actually solved. The payment processor takes its fee before the money reaches us, so we never hold it and it is not ours to return. That is true here as everywhere else.
If it comes back
Reply within seven days of delivery and we put it back on the bench at no cost. The fix is not finished until it holds.
What we are responsible for
If something goes wrong with a fix, our responsibility is limited to what you paid for it. We take a full backup first so mistakes can be undone, and we tell you before doing anything outside what you bought.