Website hacked – what to do? Cleanup, restoration, protection

Stay calm and don't delete anything in haste, so that the cause remains traceable later. Have all passwords for the website, hosting, database and email changed, inform your hosting provider and preserve existing backups. Have it checked whether a notification obligation under GDPR applies – this does not replace legal advice – and contact us for analysis and cleanup.

Typical signs are foreign content or links, redirects to other sites, unknown administrator accounts, spam sent from your server, or warnings from Google and your hosting provider. Some attacks remain invisible to visitors and only show up in search results or in Search Console. If you are unsure, we check your website and tell you whether an incident has actually occurred.

That depends on how deep the attack goes, whether clean backups exist and how extensive the website is. Depending on scope, cleaning up and securing a company website can fall under the Starter package from €2,500, and complex stores or web applications under the Professional package from €8,000. You will receive the exact quote after the free initial consultation, in which we assess the situation.

It's best to call us directly – we respond quickly by arrangement and clarify in the first conversation when we can start. How long the cleanup takes depends on the extent of the attack and the condition of the backups. After the analysis, we give you a concrete timeframe.

Yes. We check core files, plugins, themes, uploads, database and user accounts, remove malware and hidden backdoors and bring all components up to date. Then we secure logins and permissions so that the same route cannot be used again.

That is a legal question that depends on the individual case, for example on which data is affected, what was agreed by contract and what protective measures were in place. Please clarify liability questions with your legal counsel. This does not replace legal advice. On the technical side, we support you with traceable documentation of what happened and which measures were taken.