12 signs your WordPress site is infected
Malicious code rarely announces itself. These twelve signs mean something is already happening on your site.
Insights
Short articles from practice: how to recognise an infected site, what to do after a breach, why a site is slow and what public sector websites must meet.
Your website redirects visitors to unknown pages
Redirect malware works selectively: the administrator never sees it, while visitors from Google land somewhere else.
Japanese keyword hack: foreign characters in your search results
Search results show Japanese or Chinese text under your site name. Here is what is actually happening.
Google flagged your site as dangerous: an action plan
The red browser warning stops almost all traffic. Here is the order in which it gets resolved.
Unknown administrator accounts in WordPress
A rogue administrator is not the cause of a breach but its consequence. Here is what it tells you.
eval, base64_decode and other traces of hidden code
How to recognise obfuscated code in WordPress files, and why looking only in the theme is not enough.
Your website is sending spam: when the server becomes a relay
Emails stop reaching customers and your IP lands on blacklists. The usual causes and what to do first.
Sudden server load: a cryptominer on your machine
The CPU is maxed out, the site is slow and traffic has not changed. How to spot a foreign process.
Webshell: remote control on your server
A single file that gives an attacker the same access as your developer. How to find it.
Why a cleaned site gets reinfected a week later
Reinfection almost always means the cleanup was done without an investigation.
The first hours after a breach: what not to do
Four instinctive actions that look sensible but destroy the data an investigation needs.
How to report a cyber incident to the national CSIRT
Who must report, within what deadlines and what information you will need. A practical checklist.
Suspect your site is infected?
We check it externally and send a report with the concrete findings.