Skip to content

21 Oct 2026, 18:57 CEST: All our servers are patched against php2shell.

Read more about the php2shell vulnerability
noen
Contact us
When your site is hacked or down, or your supplier isn't answering.

Emergency WordPress help

A developer looks at your site the same working day and finds the source of the problem.

Book a call

If your WordPress site is down,do this first

The first thing to do is leave the site as it is. It's easy to make the damage worse by deleting files at random or restoring an old backup without checking it. If the site has been hacked, restoring a backup like that can overwrite the logs that show how the attacker got in.

Then check the simple things, such as whether the domain has been renewed and whether the hosting provider is responding. Take screenshots of what the site is showing and send them to us. An error code in a screenshot often makes the fault much quicker to find.

When you contact us, we start by working out what has happened. A senior developer reads the server and error logs before anyone changes anything. If you have a maintenance agreement, its response time applies, and on the Enterprise tier that's 30 minutes, also outside working hours. Without an agreement you hear back the same working day, and a site that's down goes ahead of our planned work.

You talk to a developer from the first contact. It's usually the same person who reads the logs and writes the report at the end.

All our WordPress services
Before our monitoring alerts us to downtime
60s
Response to critical faults on an Enterprise agreement
<30min
WordPress sites restored after hacks and crashes
40+
Years of running and troubleshooting WordPress
10+

How we clean upa hacked WordPress site

When WordPress has been hacked, it's tempting to delete everything that looks unfamiliar. We start instead by taking a full copy of the files and database, then we read the logs until we know how the attacker got in. In nine jobs out of ten, the trail leads to a plugin that hasn't had a security update in months.

Infected files in the WordPress core and plugins are replaced with the originals from WordPress.org. That's safer than patching them by hand, because a single altered line is easy to miss. Then we look for backdoors. An attacker who has been inside usually leaves a way back in, such as an extra admin user, a scheduled task on the server or a file with a harmless-looking name. If a backdoor is left in place, the attacker can get back in even after everything else has been cleaned.

Finally we make the site more secure than it was. Every password and API key is changed, along with the keys WordPress uses to encrypt logins, and administrators have to use two-factor authentication. We tighten the setup to the same baseline we use in our WordPress security agreements. If Google has blacklisted the site, we request a review straight away.

Afterwards you get a report written for people without a technical background. It explains what the attacker did and what we've done to stop it happening again, and it's short enough to take to a board meeting.

Six signs your WordPress site has been hacked

  1. Visitors from Google are sent on to websites you don't recognise. If you go to the site directly, everything looks normal, because the redirect only affects traffic from search.
  2. There are unknown administrators under Users in the admin panel. Attackers usually create an account of their own.
  3. Google shows "This site may be hacked" under your listing, or Search Console has warned you about security issues.
  4. Your customers receive spam from your domain, or your email ends up in recipients' junk folders because the domain has been blacklisted.
  5. The site has slowed down although nobody has changed anything. Scripts that send spam or mine cryptocurrency can be using up your server without anything showing on the site.
  6. Google shows pages under your domain that you never created, such as pharmacy ads or Japanese product pages.

If you see any of these signs, someone should look at the site soon. Google can warn visitors away from an infected site or remove it from search results.

Talk to a developer

When your supplier stops answering,we can take over the site

Sometimes the supplier that built a site stops answering emails, for example because the company has closed or has prioritised other clients. You may also be paying a fixed monthly amount without anyone in the company knowing what it covers, and nobody has documented the setup. Often the admin password is missing too, because the person who had it has left.

We regularly take over sites other people have built, including ones with no documentation and no help from the previous supplier. First we secure ownership. If the domain and the website are yours, you can get access back even if the supplier has gone quiet. We know the procedures at Norid, the registry for .no domains, and at Norwegian hosting companies.

Then we go through the code. We check which plugins are running, what has been custom-built, and whether the server runs PHP 8.4 or a version that stopped getting security updates years ago. On the sites we take over, it's usually the latter. You get a condition report in plain language. If you need someone to keep developing the site afterwards, you can hire a WordPress developer on a monthly block of hours.

After the emergency fix

Emergency help gets the site back up and closes the hole the attacker used. New security holes in plugins are still found all the time. If the plugins aren't kept up to date, automated scanners will find the site again, because they search for known holes around the clock.

That's why many emergency jobs end in a WordPress maintenance and operations agreement. Basis covers tested updates, backups, monitoring and an agreed response time during working hours. Pro adds a shorter response time, a website firewall (WAF) and tested backups.

A maintenance agreement is a fixed monthly cost you can budget for.

How our WordPress help works

  1. 01 / 04

    Get in touch

    Call or write, and tell us briefly what's happening and when it started. If anything changed just before the problem began, we'd like to know. If you have a maintenance agreement, its response time applies.

  2. 02 / 04

    Assessment and stabilising

    We secure logs and evidence before doing anything else, then stabilise the site. The goal for day one is to have it safely back online.

  3. 03 / 04

    A price before we start

    We clean up after a hack for a fixed price, and other fixes are billed by the hour. You get the fixed price or an estimate before we begin.

  4. 04 / 04

    A maintenance agreement if you want one

    Once the site is stable, we can suggest a maintenance agreement that suits it. You don't need one to get help now.

If your site is down or hacked, we usually look at it the same working day.

Get in touch

Frequently asked questions

What does emergency WordPress help cost?

Emergency troubleshooting costs NOK 2,250 an hour. Hack clean-up has a fixed price from NOK 15,000, which includes analysing the attack and securing the site afterwards. The price depends on the size of the site and how long the attacker had access. If you have a maintenance agreement from NOK 2,500 a month, response times and support hours are included in it. You get the price or an estimate before we start work.

My website has been hacked. What should I do?

Leave the files as they are. If you delete something now, you may also delete the traces that show how the attacker got in. Put the site into maintenance mode, or ask your hosting provider to block it temporarily. Change your hosting and WordPress passwords, then your email password, using a different device from the one you suspect is infected. Take a full copy of the files and database as they are now, because the analysis needs them. Hold off on restoring an old backup, as the backdoor may be in there too. Then contact someone who can analyse the attack, whether that's us or another supplier.

How quickly can you help?

With a maintenance agreement, its response time applies. On the Basis tier we respond during working hours, and on the Enterprise tier critical faults get a response within 30 minutes, also outside working hours. Without an agreement, we take urgent cases the same working day, and a site that's down or hacked goes ahead of planned work. The site is usually stabilised on day one. The clean-up itself normally takes one to three working days, depending on the scope.

Can you take over a site you didn't build?

Yes, we do it often. We don't need documentation or help from the previous supplier, only proof that you own the domain and the business. First we get control of the domain and hosting back for you, then we go through the code. You get a technical condition report you can base decisions on. What happens next is up to you.

Is WordPress secure?

WordPress itself is secure, and a large security community maintains the code continuously. The problems lie in the plugins and themes around it. Around 90 percent of hacked CMS sites run WordPress, and almost every break-in comes through outdated plugins and themes or reused passwords, very rarely through WordPress itself. Whether a site is safe to run depends mostly on whether it gets tested security updates and someone keeps an eye on it.

Do you help without a maintenance agreement?

Yes. You don't need an agreement to get emergency help, and you pay either by the hour or a fixed price for a defined clean-up. When capacity is tight, clients with a maintenance agreement go first, but we don't turn away anyone whose site is down or hacked. We clean up first, and then you can decide in your own time whether a maintenance agreement suits you.

Get help with your WordPress site

Write a couple of sentences about what has happened, and one of our senior developers will reply.

Book a callSend us a message