Rescue: hacked site cleanup
Hacked site? We’ll clean it and close the way in.
Spam pages, strange redirects or a Google warning? We remove the infection, find how the attacker got in, and close that gap.
You get it in writing. An incident report with the timeline, the cause, what we changed and the checks we ran.
Sample report
Site
yourbusiness.co.uk
Cause
How they got in, in plain words
Fixed
What we removed and changed
- Backed up and contained
- Way in found and closed
- Checks passed: sign-in, forms, checkout
Check first
Signs your site has been hacked
Seeing even one of these? You’re in the right place. Hacks spread, and Google and hosts act on them quickly.
Pages you didn’t write. Spam for pills, loans or fake goods.
Strange redirects. Visitors land on another site, often only on phones.
A Google warning. “This site may be hacked” or “Deceptive site ahead”.
An email from your host. Your account is suspended or flagged for malware.
Odd pop-ups. Customers report fake offers or fake payment pages.
Admin users you don’t know. Or your own login stops working.
Blocked email. Your messages bounce or land in spam.
A sudden traffic drop. Search visits fall with no change on your side.
BearStackHacked, redirected or showing spam?
Take back your website.
Suspicious redirects or spam? Start your website recovery here.
Right now
While you wait for us
A few safe steps help. A few common reactions make things worse.
Safe to do now
- If you think card details are at risk, take the site offline from your host’s control panel now.
- Take screenshots of warnings, odd pages and host emails, with the time you saw them.
- Change your hosting and email passwords from a computer you trust.
- Reply to your host. Say you’ve brought in help, and keep their emails.
- Tell your payment provider if the site takes card payments.
Please don’t
- Delete the site or restore an old backup. It wipes the evidence, and the backup may be infected too.
- Install several security plugins. They clash and can hide what happened.
- Send passwords by email or chat. We’ll send you a secure link instead.
- Pay anyone who contacts you first. Offers to remove the warning are often scams.
Service options
Choose the scope of work
Every plan removes the infection. Only the second and third find the way in, close it, and ask Google and your host to lift their warnings.
01
Emergency cleanup
Stops the damage and removes the infection. It doesn’t look for the way in.
- Site contained, so visitors stop seeing spam
- Infected state backed up for evidence
- Malicious code, files and users removed
- Clean reinstall of WordPress, theme and plugins
- Short written summary of what we found
- Not included: finding and closing the way in
- Not included: asking Google and your host to review the site
02
Recommended
Cleanup and hardening
The full fix: cleaned, the way in found and closed, and the warnings reviewed.
- Everything in Emergency cleanup, plus:
- Included: the way in found and closed
- Included: Google review requested to lift the warning
- Included: host review requested to lift a suspension
- Updates, password resets and two-step sign-in
- File permissions and server settings tightened
- Full written incident report
03
Cleanup and 3 months of care
The full fix, then three months of updates and monitoring while trust rebuilds.
- Everything in Cleanup and hardening, plus:
- Weekly updates, tested before they go live
- Daily off-site backups, with a monthly restore test
- Uptime and malware monitoring
- Small edits each month
- Dated monthly log of every change
We assess the problem and confirm the scope and next steps in writing before work starts.
How it works
How the cleanup works
Seven steps, in this order. We tell you when each one is done and when you’ll hear from us next.
Emergency cleanup covers steps 01, 02, 04 and 07. Steps marked Plans 2 and 3 come with the other two plans.
01
We contain it first.
Maintenance mode or a block on the bad redirects, so customers stop being exposed.
02
We back up the infected state for evidence.
Files, database and logs are copied before we change anything, and kept apart from the live site.
03
We find the entry point.Plans 2 and 3
Logs and file comparisons show how they got in: an old plugin, a stolen password or a weak setting.
04
We remove malicious code and users.
Infected files and database entries are cleaned, unknown admins deleted, and software reinstalled from clean copies.
05
We patch and harden.Plans 2 and 3
We close the way in, update everything, reset passwords and add two-step sign-in.
06
We request the Google and host reviews.Plans 2 and 3
We ask Google to review the site in Search Console, its free tool for site owners, and ask your host to lift any suspension.
07
We report back in writing.
A full incident report with plans 2 and 3, or a short written summary with Emergency cleanup.
Why BearStack
A cleanup you can check, not just trust
Deleting the spam is the easy part. What matters is knowing how it happened and showing it’s fixed.
01
We find the cause, not just the symptoms.
If the way in stays open, the spam returns. With plans 2 and 3, we don’t sign off until we know how they got in.
02
We keep evidence before we touch anything.
The infected copy is stored safely, so the diagnosis can be checked later.
03
You hear from us at agreed times.
Each update says what’s confirmed, what’s next, and when we’ll update you again.
04
We assess the problem and confirm the scope and next steps in writing before work starts.
After the initial assessment, you get the price and scope in writing. No hourly meter.
05
We explain it in plain words.
You’ll know what happened and what it means for your business.
Access
What we need from you
Access is what lets us start. Here’s what helps, and how to share it without creating a new risk.
Never send passwords by email, text or WhatsApp.We send you a one-time secure link that expires once it’s opened. Already emailed one? Tell us, and we’ll change it as soon as we’re in.
Hosting access.A login for your hosting control panel, or SFTP details (a secure way to reach the site’s files).
A temporary admin account.Create a separate WordPress admin user for us, and delete it when we’re done.
Domain access, only if needed.Some hacks change your DNS, the address book that points your domain to your site. We’ll tell you if so.
What you’ve seen.Your screenshots, the host’s emails and roughly when it started.
Proof
What you get in writing
An incident report you can keep and forward to your host, insurer, developer or payment provider.
Emergency cleanup includes a short written summary instead of the full report.
In every incident report
01 Timeline
When it started and every step since, with dates and times.
02 Cause
How the attacker got in, in plain words, with the evidence that shows it.
03 What changed
Everything we removed, updated or reset: files, plugins, users and settings.
04 The checks
How we confirmed it’s clean and working: scans, a manual review, and tests of sign-in, forms and checkout.
05 Next steps
What we recommend, in priority order, to keep it from happening again.
Related Rescue services
Security hardening Not hacked, but worried? Close the common ways in first. See security hardening
Domains, DNS and SSL Domain pointing somewhere odd, or a padlock warning? We fix your DNS records (the settings that point your domain to your site) and your SSL certificate (the certificate behind the padlock). See domains, DNS and SSL
Start your recovery
Start your website recovery.
Share the website address, what you are seeing and when it started. We’ll discuss the cleanup scope and next steps with you.
- 01 Share your website
- 02 Describe the problem
- 03 Agree the next step
FAQ
Questions owners ask us
We assess what is happening and confirm the next step with you.
How long does a cleanup take?
It depends on the size of the site and how deep the infection goes. We’ll give you a time during the initial assessment, then update you at agreed times until it’s done. Containing the site always comes first, so your visitors are protected while we work.
Will I lose any data?
We back up the whole site before we change anything. We remove only what the attacker added or altered, so your pages, products, orders and customer records stay. If the attacker damaged something of yours, we tell you and restore it from the cleanest copy available.
Will Google remove the warning?
With Cleanup and hardening, or Cleanup and 3 months of care, we request a review in Google Search Console once the site is clean. Google makes the decision and sets the timing, so we can’t promise a date. We send a complete request and tell you as soon as Google replies. Emergency cleanup doesn’t include the review request.
Can it come back?
Yes, if the way in is left open. Emergency cleanup removes the infection but doesn’t look for the way in, so that risk remains. The other two plans find and close it. No one can honestly say a site will never be attacked again, but updates and protected logins keep the risk low.
Do you work with sites that aren't WordPress?
Yes. We also clean sites built on Joomla, Drupal, custom PHP and plain HTML, as long as we can reach the files and database. On hosted builders such as Wix or Squarespace, the platform runs the server, so the problem is usually a hijacked account or domain, and we help with that. We confirm the fixed fee during the initial assessment.
What if I don't have any backups?
That’s common, and we can still help. We clean the live site rather than rolling back, so we don’t need an old backup. We take a full copy of the current state first. With Cleanup and 3 months of care, we also set up daily off-site backups.
Do I need to pay my developer too?
No. Our fixed fee covers the cleanup itself. If your developer built custom features, we may ask them a quick question, and we’re happy to share the report with them. They’re welcome to stay involved, but we don’t need them to start.
How do I share access safely?
We send you a one-time secure link. You paste the login details into it, and it expires once we’ve opened it. Where you can, create a separate admin account for us and delete it when we finish. Never send passwords by email or chat.
My host has suspended the site. Can you still help?
Yes. Most hosts still let you reach the files and database while the public site is offline. We clean it there. With plans 2 and 3, we then send the host the evidence they ask for and request reinstatement. If you’re locked out completely, we help you through their process to regain access.