Webdesign Redirects to other sites
Visitors suddenly end up on advertising, sweepstakes or scam pages, often only on smartphones or only on their first visit.
Emergency help
Website hacked? I help fast and clean it up thoroughly
Redirects to other sites, spam on Google or a browser warning: I find the malicious code, close the hole the attackers used to get in and bring your website back online, clean. For WordPress, TYPO3, PrestaShop, WooCommerce and other PHP systems.
AI-generated
First aid
Website hacked: what you should do now
In short: Stay calm and don't just delete everything. Back up the current state, change the most important passwords from a clean device and get help that doesn't just remove the visible symptoms but also finds the cause.
- Don't delete anything in a hurry. The current state shows how the attackers got in. Without these traces, the hole is hard to find.
- Change your passwords, using a device that is definitely not affected: hosting, FTP, database and admin accounts.
- Inform your hosting provider. Many hosts help with log files or temporarily block a website to limit the damage.
- Check data protection. If customer data could be affected, for example from forms or a shop, a report to the data protection authority usually has to be made within 72 hours.
- Call me. I take care of the analysis, cleanup and hardening so you can focus on your business.
A recent example of a critical vulnerability is the PHP security flaw php2shell.
Warning signs
How to recognize a hacked website
An attack is often noticed late because the attackers want to stay undetected. Take these signs seriously.
Spam pages on Google
When you search for your domain, pages about medication, gambling or brand-name goods show up that you never created.
Warning in the browser or on Google
Chrome, Firefox or Google Search warn about your website. Visitors then almost always leave.
Unknown users and files
There are administrators in the backend you don't know, or files with strange names on the server.
Notice from your hosting provider
Your host reports malware, blocks the website or complains about an unusually high number of emails being sent.
Slow or full of errors
The website becomes slow for no obvious reason, shows errors or contains foreign content in the page source.
AI-generated
Thorough, not superficial
How I clean up your website
Many cleanups fail because only the visible malware is deleted. The back door stays open, and a few days later the website is infected again.
- Preserve evidence: files, database and log files are backed up before anything is changed
- Find the entry point: outdated plugins, themes, extensions or stolen login credentials
- Remove all back doors: including hidden files disguised as images or loaded with every page request
- Check the database: unknown admin accounts, injected scripts and spam content
- Compare system files: against the vendor's originals and reinstall them if needed
Process
From emergency to secure website in four steps
Contain immediately
We have a short phone call. I back up the current state and, if needed, temporarily put the website into maintenance mode so that no visitors are harmed.
Find the cause
I analyze files, database and log files and find out how the attackers got in.
Clean up
Malicious code, back doors and unknown accounts are removed, and system files are checked against the originals and replaced.
Secure and relaunch
Close the hole, install updates, renew all login credentials and, if necessary, request a review from Google.
AI-generated
Prevention
So it doesn't happen again
Most attacks hit websites whose software is out of date. A few measures significantly reduce the risk.
- Regular updates: for the core system, theme, page builder, plugins and extensions
- New login credentials: strong passwords, new security keys and as few admin accounts as possible
- Hardened configuration: for example, no execution of PHP files in upload folders
- Current PHP version: on a well-maintained server
- Backups and monitoring: as part of a maintenance contract, so an attack is noticed early and can be reversed quickly
How attackers operate today
Most attacks are not the work of a targeted hacker but of automated programs that scan the internet around the clock for known vulnerabilities. When a hole in a widely used theme, page builder or plugin becomes known, thousands of websites are attacked within a few days. Small businesses are affected just as much as large ones.
From my own work, I know the typical patterns: PHP files disguised as images sitting in the upload folder, hidden extensions loaded with every page request, injected spam pages for Google and manipulated security rules meant to lock out other malware. That's why it is not enough to remove only the visible symptoms.
Your data and data protection
During an attack, attackers may be able to see database credentials and data from contact forms or shops. If a risk to the people affected is likely, the breach usually has to be reported to the competent data protection authority within 72 hours under Art. 33 GDPR. I document what I find so you can make this decision. Note: This is not legal advice.
Frequently asked questions about hacked websites
My website has been hacked. What should I do first?
Don't delete anything in a hurry, change the most important passwords from a clean device, inform your hosting provider and get help. Feel free to call me directly, and we'll discuss the next steps.
Which systems do you help with?
WordPress, TYPO3, PrestaShop, WooCommerce and other PHP-based websites and shops. It doesn't matter who built the website.
How quickly can you help?
Call me or send an emergency request. I'll get back to you as quickly as possible so we can limit the damage first.
How much does it cost to clean up a hacked website?
That depends on the extent of the infection and the system. After an initial assessment, I tell you the effort involved before I start the cleanup.
Is it enough to restore an old backup?
Usually not. A backup also brings back the old vulnerability, and often the backup itself is already infected because attacks go unnoticed for a long time. Without finding the cause, the website will soon be infected again.
Is a security plugin enough?
A security plugin can help, but it is no substitute for a thorough cleanup. Many back doors are not detected by plugins, and an already infected website can manipulate the plugin itself.
Google warns about my website. How do I get rid of the warning?
First, the website has to be completely cleaned up. Then a review is requested in Google Search Console. I take care of this for you as soon as the website is clean.
Is my customer data affected?
That depends on the attack. I check what the attackers had access to and document it. That way, you can decide whether a report to the data protection authority is necessary.
How do I prevent it from happening again?
With regular updates, secure login credentials, a hardened configuration and monitoring. As part of a maintenance contract, I take care of this for you, including daily backups.
Can you host my website afterwards, too?
Yes. If you like, I move the cleaned website to my servers in Germany free of charge, where I keep an eye on both the server and the website.
