The first hour: what you can do right now
- Do not delete anything. The strange files are evidence of how they got in, and deleting them first destroys the trail and usually misses the backdoor they left behind.
- Change your hosting and site passwords from a clean device, one you trust, not from a computer you suspect. Turn on two-factor sign-in where it is offered.
- Tell your host. Most hosts can put the site into a holding state, and many keep clean backups from before the break-in. Ask what backups exist and their dates; do not restore one yet.
- Warn anyone whose data may be involved. If your site takes payments or holds customer accounts, your obligations may include telling people. A short honest note beats silence.
- Write down what you noticed and when. Screenshots of the strange pages, the exact warning text, and the first date a customer reported trouble. This becomes the starting point of the recovery scope.
What recovery involves, and what it never is
Recovery is not running a scanner and deleting what it flags. A scanner finds symptoms; the job is finding the way in and closing it, or the site is reinfected within days, which is the most common story owners tell us about cheap cleanups. A proper recovery runs in this order: preserve the evidence and a full backup of the current state, identify the entry point from the logs and files, remove the malicious material and any hidden accounts or backdoors, close the entry point (which is very often one of the proven problems on this site: an exposed PHP, a WordPress in the exploited range, a stolen password), reset every credential that touched the site, and only then bring the site back and ask Google to review the warning. You receive a written record of what was found, what was removed, and what was closed.
One honest boundary: if the database itself is compromised, the job becomes a rebuild, and its exact price is named in the written scope before any work, under the service terms. Nobody can responsibly quote that blind, and a fixed menu price for it would be a lie.
What it costs
Recovery enters at Secure It, CA$397 at minimum, because the entry-point fix and hardening are part of the job, not extras. Where the scope shows a rebuild, the exact price replaces the shelf price in writing before work begins. The sequence never changes: finding first, written scope, your approval, payment, then work.
In the form, choose "I think my site may already be compromised" and describe what you are seeing. We reply within 1 business day; if your host offers an emergency holding state, use it while you wait.