Wie lässt sich ein Angriff sicher feststellen?

Eine belastbare Einschätzung erfordert die Prüfung von Dateien, Datenbank und verfügbaren Protokollen. Diese Prüfung kostet 50 € netto und wird bei einer anschließenden Bereinigung angerechnet.

Was soll ich bis zur Prüfung tun?

Vermeiden Sie Änderungen an Dateien und Datenbank und bewahren Sie vorhandene Backups sowie Meldungen des Hosters auf. Bei einem betroffenen Shop sollte anhand der ersten Hinweise geprüft werden, ob der Bestell- oder Bezahlvorgang vorübergehend pausiert werden muss.

Muss ich Kunden oder eine Behörde informieren?

Das hängt davon ab, ob personenbezogene Daten betroffen sein könnten. Mein technischer Befund dokumentiert die festgestellten Zugriffsmöglichkeiten und unterstützt damit Ihre rechtliche Bewertung. Eine Rechtsberatung ist darin nicht enthalten.

Wie lange dauert die Bereinigung?

Die zugesagte Bearbeitungszeit beträgt bis zu 6 Stunden ab Vorliegen aller erforderlichen Zugänge, montags bis freitags von 8 bis 20 Uhr. Wird diese Bearbeitungszeit überschritten, zahlen Sie die Hälfte.

Active incident

WordPress hacked – what to do now

Unknown accounts, redirects or warning messages may indicate unauthorized access to your WordPress installation. An examination of files, database and logs clarifies the scope and possible access route.

I back up the current state, remove the malicious code, close the identified vulnerability and document the results. The cleanup costs 280 € net at a fixed price.

Elias Arndt

WordPress security and technical support
★★★★★ 5,0 on Google

Report an emergency

I will get back to you within 4 hours.

Possible signs of an attack

A single symptom may also have technical causes. If several irregularities occur, the installation should be examined promptly.

Access no longer works

The known administrator password is rejected, the reset remains unsuccessful or the account has fewer permissions than before.

Unknown user accounts

Administrator accounts appear in the user overview that you cannot assign to any authorized user.

Different content for visitors

Visitors see unfamiliar advertising or are redirected. This may occur only on certain devices, referring pages or sessions.

Deleted files reappear

A suspicious file is recreated after being deleted. This may indicate a scheduled process or another manipulated file.

External security warnings

Google, a browser or the host reports malicious content, spam being sent or suspicious server activity.

How the cleanup works

Initial assessment

You describe the irregularities and provide the available access credentials. Before starting, I clarify whether an examination is sufficient or cleanup is required.

Securing the current state

I back up the files and database in the state found. This preserves the initial state and relevant traces.

Analysis and Cleanup

I examine the files, database and available server logs. Any malicious code found and unauthorized access points are removed.

Security hardening and documentation

I close the identified access route, renew the affected access credentials and document the findings, measures and results.

Services and prices

Malware scan

50 €

plus VAT · one-time

If you commission the cleanup afterwards, the 50 € will be fully credited.

Fixed price

Cleanup

280 €

plus VAT · fixed price, scan included

Money-back guarantee: If the cleanup or restoration is unsuccessful, the cleanup fee paid will be refunded.

Ongoing support

from €65

per month, plus VAT.

Further terms and conditions:

All prices are plus 19 % VAT.
For work on Saturdays, Sundays or public holidays, a one-time weekend flat rate of €100 is charged.
The agreed response and restoration times apply Monday to Friday from 8 a.m. to 8 p.m.
The restoration period begins as soon as all required access credentials are available.
I will clarify the effort required for multiple websites in one installation, multisite systems and WooCommerce shops with ongoing orders before starting. Additional costs will be agreed before commissioning.

Frequently asked questions

How can an attack be reliably detected?

A reliable assessment requires examining the files, database and available logs. This examination costs 50 € net and is credited toward any subsequent cleanup.

What should I do until the examination?

Avoid making changes to files and the database and retain existing backups and messages from the host. In the case of an affected shop, the initial indications should be used to assess whether the ordering or payment process needs to be paused temporarily.

Do I need to notify customers or an authority?

This depends on whether personal data could be affected. My technical findings document the identified access possibilities and support your legal assessment. Legal advice is not included.

How long does the cleanup take?

The promised processing time is up to 6 hours from receipt of all required access credentials, Monday to Friday from 8 a.m. to 8 p.m. If this processing time is exceeded, you pay half.

Have a WordPress incident examined and cleaned up

During the free initial consultation, we clarify the symptoms observed, the available access credentials and the sensible next step. If the cause is likely to lie outside WordPress, you will receive an appropriate assessment.

You can reach me Monday to Friday from 8 a.m. to 8 p.m. Related topics: Remove WordPress virus · Remove WordPress malware · Unauthorized administrators in WordPress · Restore WordPress website