Do you suspect your website has been hacked?

We start working as soon as we receive your request. The cleanup itself takes on average 4 to 6 hours for a standard infection (malicious files, redirects, backdoors). For more complex cases — deep infections across hundreds of files, compromised databases, or entire servers affected — the work may take longer. In all cases, we keep you updated in real time on the progress.

That is what most people who call us think, and it is what brings them back a few days later. A restore returns your files to the state they were in at an earlier date. It does not touch the vulnerability the attacker came through: that vulnerability was already there before the infection, so it gets restored along with everything else. The attacker comes back the same way, often within days, sometimes within the hour when the site is watched by a bot. Second problem, nobody knows the exact date of the intrusion until the access logs have been read: restoring an already-infected backup is very common. A restore is a useful reprieve to get a site back online quickly, but it never replaces finding and fixing the way in.

This is one of the first things we check during our analysis. We inspect access logs, suspicious database queries and any potential exfiltration scripts. If data has been compromised, we help you assess the exact impact, secure access, and notify the relevant authorities if necessary (GDPR obligation). We also provide a detailed report to document the incident.

After each intervention, we perform a complete scan of all files and the database. We provide a detailed report listing every cleaned file, every removed backdoor and every patched vulnerability. We also verify that Google no longer shows any warnings and that your host has lifted any suspension. If the problem returns, we intervene again free of charge.

Cleanup alone is not enough: we systematically identify and patch the vulnerability that allowed the intrusion. Then we implement concrete measures: CMS and plugin updates, access hardening (passwords, file permissions, FTP/SSH access), automatic backup configuration. For ongoing protection, we offer our PrestaSecure solution that monitors your site 24/7.

Yes, we systematically recommend it. You can file a report online through your government's cybercrime reporting platform or at your local police station. This is important for several reasons: it feeds ongoing investigations into hacker groups, it may be required by your professional insurance, and it is a legal obligation if personal data has been compromised (GDPR). We can provide the technical evidence to support your report.