Shop incident

WooCommerce shop hacked

In the event of a security incident in WooCommerce, ongoing orders, customer accounts and the payment process must be taken into account. Whether individual functions should be temporarily paused depends on the initial technical indications.

I secure the current state, clean the installation without resetting ongoing order data, and then check the entire ordering process.

Elias Arndt, WordPress expert from Schleswig
Elias Arndt

WordPress security and technical support
★★★★★ 5,0 on Google

  • Response within 4 hours
  • Restoration within 6 hours; half price if exceeded
  • Cleanup €280 net at a fixed price
  • Money-back guarantee
0157 57244734
Fill out the form

Report an emergency

I will get back to you within 4 hours.

Special requirements for WooCommerce

The cleanup is tailored to the current data set, the payment methods used and the installed extensions.

Ongoing orders

New data may be generated during the work. Backups and restoration must therefore take the current database state into account.

Ordering and payment process

The shopping cart, checkout, redirection to the payment provider and order confirmation are checked for technical manipulation and functionality.

Personal data

Customer accounts, addresses and order data are taken into account when technically assessing possible access.

WooCommerce extensions

Additional modules and customizations are checked for suspicious changes, known security issues and available original files.

This is how the shop cleanup works

1

Coordinate immediate measures

Based on the initial indications, we clarify whether the ordering or payment process should be temporarily restricted.

2

Secure the current state

Files and the database are backed up. Ongoing order data is retained in the process.

3

Clean up installation

Detected malicious code and unauthorized access are removed. The identified access route is closed.

4

Check and document the ordering process

I conduct a controlled functional test from the shopping cart through to confirmation and document findings as well as measures taken.

Services and prices

Malware scan

50 €

plus VAT · one-time

  • Assessment of files, database and server configuration
  • Analysis of available access logs
  • Written report with documented findings
  • Recommendations for the next technical steps

If you commission the cleanup afterwards, the 50 € will be fully credited.

Fixed price

Cleanup

280 €

plus VAT · fixed price, scan included

  • Technical assessment included in the price
  • Removal of the identified malicious code
  • Restoration of normal operation
  • Securing the identified access route and renewing relevant access credentials
  • Basic hardening of the WordPress installation
  • Technical report for the insurance company on request: €200 net
Money-back guarantee: If the cleanup or restoration is unsuccessful, the cleanup fee paid will be refunded.

Ongoing support

from €65

per month, plus VAT.

  • Controlled updates for WordPress, plugins and themes
  • Regular checks for malicious code
  • Continuous checks for newly reported vulnerabilities
  • Cleanup included in the monthly fee during the support period

Further terms and conditions:

  • All prices are plus 19 % VAT.
  • For work on Saturdays, Sundays or public holidays, a one-time weekend flat rate of €100 is charged.
  • The agreed response and restoration times apply Monday to Friday from 8 a.m. to 8 p.m.
  • The restoration period begins as soon as all required access credentials are available.
  • I will clarify the effort required for multiple websites in one installation, multisite systems and WooCommerce shops with ongoing orders before starting. Additional costs will be agreed before commissioning.

Frequently asked questions

Does the shop have to be closed during the cleanup?

That depends on the findings. If there are indications of manipulation of the payment process, this area should be temporarily paused. Other shop functions may remain available after technical assessment.

With external payment providers, card data is usually processed outside WooCommerce. Manipulated code in the shop can capture entries before forwarding. The technical assessment checks whether there are indications of this.

For a normal scope, the fixed price is €280 net. For very large or complex shop installations, I will quote the price after a brief review and before starting the work.

The documentation describes identified findings, the period that can be narrowed down and technical access possibilities. It can be used for a legal assessment; legal advice is not included.

Review and clean up a WooCommerce incident and shop

During the free initial consultation, we clarify the symptoms observed, the available access credentials and the sensible next step. If the cause is likely to lie outside WordPress, you will receive an appropriate assessment.

Call now: 0157 57244734
Emergency form

You can reach me Monday to Friday from 8 a.m. to 8 p.m. Related topics: WordPress hacked – what to do now · Remove WordPress malware · Secure WordPress · Restore a WordPress website