We reply 24/7 every day · usually within 2 h
Emergency help for hacked WordPress sites
For businesses, organisations and individuals. We go through the site and tell you what's wrong and what it costs – from €229 excl. VAT. You approve the price before we touch anything.
Case #0042
example.com
Inspection in progress
Inspection · logwp 6.4.3 · php 8.1
SCANwp-content/ · 4 812 files
FOUNDeval(base64_decode(...)) in wp-content/uploads/2024/03/cache.php
FOUNDunknown admin: wp_support_admin
FOUNDwp_options.siteurl → hxxps://casino-bonus.example
FOUND.htaccess: redirect for mobile visitors
INFOwp core verify-checksums · 3 files
SCANwp_posts · 2 318 rows
Example case. The site and findings are made up, but typical.
Process
Five steps. You know what's wrong and what it costs before we start cleaning.
Fill in the form and tell us what you see. We reply around the clock, every day – usually within 2 hours.
We look at the site as it is now: files, database and users. Nothing is changed.
If we're confident it can be fixed within the included hours, you get a starting price. You approve before we start.
We remove backdoors and injected code, replace modified core files, clean the database and close fake accounts.
- RewriteCond %{HTTP_USER_AGENT} (android|iphone|mobile) [NC]- RewriteRule ^(.*)$ hxxps://casino-bonus.example/ [R=302,L] # BEGIN WordPress RewriteEngine On
You get a report on what we found, how the break-in most likely happened and what to do next.
Services
Level 1
For when the break-in is in the site's files. We remove malicious code and hidden backdoors and replace modified WordPress files with clean originals.
From€229€286 incl. VATincl. 2 h
Choose this package: Files onlyLevel 2
Everything in Files only, plus the database. We remove scripts planted in posts and pages, unknown admin accounts and changed settings that send visitors to other sites.
From€365€456 incl. VATincl. 3 h
Choose this package: Files + databaseLevel 3
Everything in Files + database, plus hardening. We update everything, replace the site's security keys, tighten who can change files and advise on a firewall and two-step login. Afterwards we monitor the site for 30 days.
From€595€744 incl. VATincl. 5 h
Choose this package: Files, database + hardeningEach hour beyond what's included: €72/h (€90 incl. VAT)
Prices exclude VAT. Individuals pay the price incl. VAT.
Pricing
You pay for time, and you know roughly how much before we start. If we need more time than included, we tell you first.
You contact us.
We look at the situation.
If we're confident it can be fixed within the included hours, you get a starting price.
Each extra hour costs €72/h. We ask before going over.
You approve before we start.
Can't be saved?Then you only pay for the inspection: €72 excl. VAT
No subscriptionsYou pay per case. Monitoring is only part of level 3.
Contact
The more you tell us, the faster we can start. If you don't know an answer, skip it.
Don't send passwords here. We'll arrange access securely when we get in touch.
Questions
Sajtjouren is run by Eric Sjöberg, a platform engineer and consultant. Day to day he works with web hosting and server operations: Linux servers, automation, email, DNS and SSL. He also builds backend services and internal tools, and troubleshoots production problems across the whole chain, from the server to the application.
The same day you approve the price, usually within a few hours. Any day of the week, weekends included.
Yes. We reply around the clock, every day – usually within 2 hours.
Never put passwords in the form. We'll arrange access securely when we get in touch. If you don't know how to log in to your hosting account, we'll guide you.
Usually not. We always take a backup first and may put the site in maintenance mode for a short while as we clean it.
No one can promise it never happens again. The hardening in level 3 lowers the risk, and we then monitor the site for 30 days afterwards. A new break-in is handled as a new case.
It can happen. Infected plugins or themes may need to be removed or replaced. We always tell you what we did.
You get an invoice once the site has been cleaned and we've verified the result. Payment is due within 10 days.
Don't delete anything, not even files or accounts that look suspicious. Note down what you've seen and when. If you think your email has been affected, change its password.