Home / Services / Hacked WordPress recovery / Clean, move and maintain

Clean, move and maintainHacked WordPress recovery

$1,5902–4 weeks30-day cover

What this package is

This package is for sites that have been hit more than once, or that cannot afford to stop, because in many cases the problem is not the site itself but the building it lives in.

A great many cheap hosts put many sites on one machine without genuinely separating them, so the site next door gets compromised and it reaches you even though your site did nothing wrong. I move you somewhere genuinely isolated, harden the server layer, and block code execution in the uploads folder from the bottom up.

Then a fresh check and a health report every month for three months, plus one training session for your team on spotting the early symptoms, recorded so it can be watched again.

See it working

Why move at all, when your site did nothing wrongPlenty of cheap hosting stacks many sites on one machine without genuinely separating them. The site next door gets broken into and it reaches you, even though yours is clean.

Where it is now

Sharing one machine with 180 other sites
File permissions not separated, so neighbours can read your files
PHP 7.4, which is past end of life
Seven days of host backups, kept on that same machine
The uploads folder can execute PHP

Where it goes

An isolated instance running this site and nothing else
Permissions fully separated, unreachable by any other site's processes
PHP 8.3, still supported
Daily backups held off the machine, 30 days back
The uploads folder cannot execute code, enforced at the server

The actual plan, in the order it happens

The whole site is copied across first
The current site keeps trading throughout. Customers never know a move is under way.
Opened on a temporary address and checked
Every page, the checkout, the forms and the notification emails, all before anything switches.
Email on the same domain is moved first
This is what breaks moves more than anything else. Skip it and the company email goes dark along with the site.
DNS cache time lowered 24 hours ahead
So when the switch happens the world sees the new home within minutes rather than a day.
The switch itself runs in the window you choose
Orders pause for eight minutes while the database makes its final hop, so nothing is lost.
The old host is kept for another 14 days
If anything unexpected turns up, it rolls straight back without restoring from a file.

Eight minutes of downtime in total, in a window you pick yourself.

The figures and names here are built for the demonstration and are not any client's data.

Everything in the sealing and the recovery packages is part of this one too

This package is not only the move. The full clean-up and the tracing from the two packages below are included, and every button works the same way.

What happened that night, in orderCleaning alone is not enough. Without knowing how they got in, they come back the same way within weeks. The two highlighted lines are the answer.

03:11:48
203.0.113.44 probes 180 paths in 40 seconds, looking for which plugins are installed.
03:12:31
Finds wp-content/plugins/easy-gallery-pro/ version 2.4.1
03:12:35
POST to easy-gallery-pro/ajax-upload.php returns 200 while not logged in at all.
03:12:39
The file uploads/2026/07/img-4821.php appears, four seconds after the request above.
03:14:02
The administrator account wp_admin_2 is created, through the file just uploaded.
03:21:17
Core files start being modified and scripts are injected into the database.

The way in was a gallery plugin that accepted file uploads without checking permissions

Not a leaked password, and not a bad host, which are the two things people guess first. Guess wrong and you close the wrong door.

The logs and the plugin name here are built for the demonstration. They are not any client's data and do not refer to a real plugin.

Everything in the recovery package is part of this one too

This package is not only the tracing and the sealing. The whole clean-up from the first package is included, and every button below works the same way.

Sample site, a garden furniture shopbaansuay-furniture.example

1Back up2Scan3Clean4Report

What is actually wrong with this site

Run the scan to see what the tooling finds. Everything is backed up before anything is touched, so it can always be rolled back.

This is a worked example built from the symptoms that come up most often, not any client's data.

This package ends at a clean site that works again. Finding how they got in and closing that door is the next package.

Everything you get

This list is the entire scope of the package. Nothing is hidden in a contract.

Everything in Clean and close the way in
Moved to hosting that genuinely isolates sites, not a shared pile
Server-level hardening, including no code execution inside uploads
One training session for your team on spotting early signs, recorded
A monthly re-scan and health report for three months
Continue on a monthly care plan afterwards if you want to. No obligation

Not included in this package

A guarantee that it will never happen again. Nobody can honestly promise that. What I can do is close the hole I found, reduce the surface, and tell you plainly where risk remains.
Recovering data that was deleted with no backup anywhere. If the host keeps no history and the server was wiped, what is gone is gone.
Identifying who did it. Attribution is police work. I can collect the technical evidence for you to file a report with.
Hosting, domain and third-party service costs. Those go straight to the provider and I tell you the numbers first.

What I need from you before starting

Every question needs an answer, because these are the settings your system is built from. None of them can be skipped. If one is not settled yet, put down what you know today and we adjust it when work starts.

Everything the two earlier packages need Required

The cleaning and the sealing must finish before the move. Moving something still dirty into a new house moves the problem with it.

Your current host, and what is left on the contract Required

If you have just renewed for a year, I can plan the move so that what you already paid is not wasted.

What on this site cannot stop Required

It decides when the move happens and what the fallback is.

What you can spend on hosting per month Required

Genuinely isolated hosting costs more than shared. I match it to the budget and tell you the trade-off plainly.

Who on your team will look after it Required

So the training session is aimed at whoever actually does the work, rather than the owner with the operator absent.

Do you have email on the same domain as the site Required

This is what breaks migrations most often. Unasked, the company email goes dark along with the move.

How the work runs

Tell me what you are seeing

What looks wrong, the site address, and who hosts it. No technical vocabulary needed. Describe it the way you would to a friend.

I assess it and tell you how bad it is

Within 24 hours you get a straight answer on what kind of compromise it is, whether it is recoverable, and which package fits. Nothing to pay at this stage.

We agree the scope and one price

The full number is on the table before work starts. Nothing gets added along the way.

I do the work and hand over the report

You get a working site back, plus a written account of what happened, what was found, what was changed, and what to do next.

Paying and getting started

Full price of this package$1,590

Paid in full at order The price is fixed and the scope is written out. No numbers appear later.
Work starts as soon as it lands No call to book and no quote to wait for.
30 days of cover after delivery Anything wrong with my work is fixed at no charge.

Bank transfer or PromptPay. A receipt is issued every time, and a stamped work contract if you want one.

How to reach you

Your namePhone, LINE or email

Questions about this package

Will the site go down during the move?

Normally not. The site is set up in the new house and tested until it works, and only then is the destination switched, as the last step. During the switch some visitors still reach the old machine for a few hours, and both sides serve the site. I schedule the switch for whenever your business is quietest.

Is the new hosting included in this price?

No. Hosting and the domain are paid directly to the provider in your own name, roughly 500 to 1,500 baht a month depending on size, and I give you the figure before the move. It works this way because the account has to be yours. The day you stop working with me, you must be able to take all of it with you.

What do the three months of care actually include?

A fresh check each month for modified files, new administrator accounts and newly published vulnerabilities in what you run, followed by a report you can read rather than a note saying everything is fine. Anything due an update gets updated, and anything needing a fix is fixed in that month.

Do I have to continue after three months?

No. You can continue on a monthly care package if you want someone still watching, or stop and handle it yourself. The training session covers spotting the early symptoms and the recording stays with you. This is not designed to make you dependent on me.

Does the company email move too?

If the email sits with the current host, it moves at the same time and I confirm mail flows in and out before the old one is closed. If you are on Gmail or Outlook separately, nothing changes. I ask about it first because it is where migrations most often break.

Often booked together

security-audit monthly-care business-website

← Back to all three packages