Recovery of infected websites

Has your website or online store been infected? We act fast: we recover your data, remove the malicious code, update and secure the system, then bring it back online.

We also help when we did not build the site and its original developer can no longer be reached.

Signs that your website may be infected

• redirects to unknown sites, ads or spam content,
• a Google or browser warning that the site may be dangerous,
• unknown files, administrator accounts or pages showing up in search results,
• your hosting account suspended or spam being sent from your server,
• in an online store: a modified payment page or customers reporting card fraud,
• a sudden slowdown or unusually high server load.

How we restore your website

1. Containment and diagnosis. We cut off the attacker, preserve the traces of the attack and find out how the intrusion happened.
2. Data recovery. We restore content and data from the last clean backup or manually clean the files and the database.
3. Updates. We upgrade the CMS, plugins, modules and server software, closing the vulnerabilities used in the attack.
4. Hardening. We change passwords and keys, tidy up permissions and add file change monitoring and extra server protection.
5. Relaunch. We bring the site back online and help remove blocks and warnings, including in Google.

If personal data may have leaked

If the attack involved customers' personal data, the data controller has 72 hours to notify the data protection authority under the GDPR. We provide the technical analysis needed to establish the scope of the breach and prepare an accurate notification. We have done this before: in 2019 we handled a personal data breach that ended with a positive assessment of our actions by the President of the Polish Personal Data Protection Office (UODO).

Supported technologies

WordPress, PrestaShop, Magento, TYPO3, Drupal, Symfony and PHP applications, and Linux servers (Apache, Nginx, OpenLiteSpeed).

How to prevent another attack

Most infections come back if the site stops being updated after the clean-up. That is why, once the site is restored, we offer ongoing care under an SLA contract: monitoring every 5 minutes, security patches without delay, an anti-skimming system and backups with restore testing.

More about our approach: cybersecurity at NETTOM.

Report an infected website or call: +48 500 294 194