Our Recovery Process

Phase 1: Analyse

First contact

You tell us what you are seeing, ideally with the text file from our incident checklist. We reply by email with the safe immediate steps, the questions we need answered, and how we would approach it. Please do not send passwords; we will ask you to create temporary accounts instead.

Containment

If visitors are being harmed, the first job is stopping that, usually with a maintenance page. Containment also matters if customer data may be involved, because the OAIC's response steps begin with containing the breach ^[4].

A full copy

Before anything changes, we copy the files, database and available logs. The copy is our safety net, your evidence, and the source of any recent content that needs bringing forward.

Extent and entry point

We compare files with clean originals, search the database, list user accounts and scheduled tasks, and read the logs. By the end of this phase we know what was changed, roughly when, and the most likely way in. You receive a short summary and, for incidents, a fixed quote for the rest of the work.

Phase 2: Clean and fix

We remove injected code, backdoors, spam content and rogue accounts. Where a file can be replaced with a clean original, we replace it. Custom code is cleaned by hand. If the damage is too extensive to clean with confidence, we switch to a restore or rebuild and explain why.

Broken functionality caused by the attack, or by earlier panicked fixes, is repaired in the same phase, so the site you get back works as it did before the incident.

Phase 3: Secure

Cleanup without closing the way in is half a job. In this phase we:

• update WordPress, themes and plugins, and remove what is unused;
• reset passwords and security keys, and review every administrator account;
• switch on two-step sign-in for administrators;
• set file permissions, protect wp-config.php and switch off dashboard file editing;
• set up logging and backups if they were missing.

Each of these follows the WordPress project's own hardening guide ^[1].

Phase 4: Restore and support

Testing

We test what matters to your business: forms, logins, search, checkout or bookings, and the pages that bring in most visitors. We also fetch pages the way search engines and mobile visitors see them, because some infections only show to those audiences.

Reopening

Once testing passes, the maintenance page comes down and the clean site goes live.

Google review

If Google flagged the site, we confirm every issue in the Security Issues report is fixed on every page, then send one review request describing the problem, the steps taken and the result ^[2]. How long Google takes depends on the issue type, and is outside our control; the guide to Google review requests quotes Google's own figures ^[3].

Report and follow-up

You receive a written report covering what was found, what was changed, the likely entry point, the hardening applied, and anything left for you to do. If your quote includes a follow-up check, we schedule it before closing the job.

How long it takes

We plan small cleanups to fit within a few working days from approval, and larger recoveries in stages over a longer period. We give you a specific estimate after the assessment, and we update it straight away if we find more than expected. Google's review time comes on top and is outside our control.

What we need from you at each phase

Most delays in a recovery come from waiting on access or decisions, not from the technical work. Knowing in advance what you will be asked for helps keep things moving.

When the plan changes

Sometimes the work reveals more than the first check could show. A second WordPress install in a subfolder, a reinfection hidden in the database or a hosting account shared with other sites can all change the scope. When that happens, we stop, explain what we found and why it matters, and send an updated quote. Nothing extra is billed until you approve it in writing.

You can also change your mind. If you decide part way through to rebuild the site rather than clean it, or to move to a new host, we hand over what we have found so far so the next step starts from facts, not from scratch.

How we keep you informed

You will hear from us at the end of each phase, and sooner if we find something that changes the plan, such as signs that customer data was accessed. Updates are by email so you have a record. If you prefer a call for decisions, we arrange one.