A WordPress site that is stuck, broken or hacked. We take it over.

When people call us

• Your developer or agency has gone, and nobody has the logins.
• The site is redirecting visitors, showing spam, or has been flagged by Google or your host.
• An update broke the site, or it shows a white screen or error.
• The site still works, but nobody knows what is on it or whether it is safe.
• Another supplier left the work half-finished.

Taking over a site: how we start

1. Get safe access. We work out who controls the domain, the hosting and the WordPress admin, and tell you how to share access securely. Please do not send passwords by email.
2. Back up before touching anything. We take a full backup first so every change can be traced and undone.
3. Find out what is there. We review the hosting, the PHP version, WordPress core, the plugins and theme, the user accounts, the backups and the known problems.
4. Work on a staging copy where we can. Where the site allows it, we test fixes on a staging copy before they go on the live site.
5. A prioritised list. You get a plain-English list of what to fix first and why, and we agree the scope and cost in writing before we fix it.

If the site has been hacked

A hacked site needs more than deleting the file you can see. We look for how the attacker got in and what they left behind, and we deal with both.

• Checking the files, the database, the user accounts and scheduled tasks for anything that should not be there.
• Replacing WordPress core, plugin and theme files with clean copies.
• Resetting passwords and keys, and removing accounts that should not exist.
• Finding and closing the way in, such as an outdated plugin or a weak login.
• Checking the site again afterwards, and helping you request a review where a search engine or host has flagged it.

No one can promise that a website will never be attacked again. What we can do is clean it properly, close the way in, and set it up so that updates, backups and access are looked after. We explain what we found and what remains.

What we need from you

• What you noticed, and when it started.
• Who has access today: your host, your domain registrar and anyone who has had a WordPress login.
• What must not go down, for example a booking form or a shop.
• Anything you already know was changed recently.

After the rescue

A site that is rescued and then left alone drifts back into the same state. We can look after it afterwards with updates, backups, monitoring and small changes. See Web Support. If you are wondering whether WordPress is still the right platform, read WordPress or Next.js.