Straight answers, up front
What do I do first if my site is hacked?
Slow down and change nothing in a panic: a cleanup can still use the evidence. Take a full backup of the site exactly as it is, save the suspicious files and your host's warnings instead of deleting them, and do not install a security plugin over the top. The first-hour steps on this page walk you through it.
What does the cleanup cost?
For the first 50 businesses, the Founders Fifty cleanup is a flat CA$299 for one WordPress site, paid in full before work begins. After the 50, the standard cleanup price is CA$399. A big or complex site is quoted flat in writing before any work; the quote is the price.
How long does a cleanup take?
Most standard sites are verified clean within 24 to 48 hours of access. You judge the job by the proof report, not by the clock.
What if you cannot clean my site?
Then your payment is refunded in full, automatically. You keep the evidence report, the backup, and a plain written note of what we found. And if your site is hacked again within 90 days of a successful cleanup, we clean it again free.
The first hour: what you can do right now
It is a sick feeling: your name on a warning, your customers sent somewhere else. Before anything else, breathe. The first hour is about not making it worse.
- Do not delete anything. The strange files are evidence of how they got in, and deleting them first destroys the trail and usually misses the backdoor they left behind.
- Change your hosting and site passwords from a clean device, one you trust, not from a computer you suspect. Turn on two-factor sign-in where it is offered.
- Tell your host. Most hosts can put the site into a holding state, and many keep clean backups from before the break-in. Ask what backups exist and their dates; do not restore one yet.
- Warn anyone whose data may be involved. If your site takes payments or holds customer accounts, your obligations may include telling people. A short honest note beats silence.
- Write down what you noticed and when. Screenshots of the strange pages, the exact warning text, and the first date a customer reported trouble. This becomes the starting point of the recovery scope.
What recovery involves, and what it never is
Recovery is not running a scanner and deleting what it flags. A scanner finds symptoms; the job is finding the way in and closing it, or the site is reinfected within days, which is the most common story owners tell us about cheap cleanups. A proper recovery runs in this order: preserve the evidence and a full backup of the current state, identify the entry point from the logs and files, remove the malicious material and any hidden accounts or backdoors, close the entry point (which is very often a neglected plugin, an outdated WordPress, or a stolen password), reset every credential that touched the site, and only then bring the site back and ask Google to review the warning. You receive a written record of what was found, what was removed, and what was closed.
And while it sits there, it spends trust you took years to earn.
One honest boundary: if the database itself is compromised, the job becomes a rebuild, and its exact price is named in the written scope before any work, under the service terms. Nobody can responsibly quote that blind, and a fixed menu price for it would be a lie.
What it costs
For a hacked WordPress site, the rescue path is the Founders Fifty cleanup. The first 50 businesses pay a flat CA$299, and the terms are the offer: free evidence check first, then you pay in full before we start, we clean, and you receive the proof report. If we cannot clean your site, your payment is refunded in full, automatically. Hacked again within 90 days, we clean it again free. It is a special price for the first 50 businesses. After the 50, the standard cleanup price is CA$399.
A big or complex site, such as a large store, is quoted flat in writing before any work; the quote is the price. If your site is not WordPress, or the damage goes beyond a cleanup, recovery is scoped in writing before work begins, because the entry-point fix and hardening are part of the job, not extras. Where the scope shows a rebuild, the exact price is named in writing before any work. The details are in the service terms.
Once it is clean, keep it that way: Website Protection fixes the flaws that let the hackers in, and watches for what comes next.
When it is over, the site is yours again: clean, closed to the way they came in, and documented in a report you hold. You go back to running your business, and if anyone asks what happened, you have the proof in writing.
In the form, choose "I think my site may already be compromised" and describe what you are seeing. We reply within 1 business day; if your host offers an emergency holding state, use it while you wait.