Platform Engineering

Recover and secure a compromised website

A compromised site is two problems with two clocks. One is the intrusion, which has to be contained before anything else. The other is the flag that has already removed you from search, which clears on other people's schedules. We work both, in that order.

The problem

The damage is usually found through traffic, not through monitoring

Most owners discover a compromise when organic traffic collapses, when a browser shows a warning, or when a customer reports a redirect. By that point the site has been flagged by third parties whose assessments run independently, and clearing that reputation is a separate job from fixing the intrusion. What decides the total cost is how long the two have been running unobserved.

Traffic dropped sharply with no change to content, templates or configuration
Visitors are redirected somewhere you did not configure
A browser, antivirus or firewall product displays a warning about the domain
Search results carry a warning, or the site has stopped appearing
Files, users or scheduled tasks have appeared that nobody recognises
Administrator access is behaving unexpectedly, or credentials no longer work
Hosting has suspended the account or restricted outbound mail
A security vendor emails about the domain and you cannot tell whether it is genuine

Who this is for

The people who usually bring us this problem

A business owner who has just found out

You have a warning in a browser or a message from your host, you do not know the scope, and you need to know what to do in the next hour without making it worse.

A marketing or operations lead

Organic traffic has collapsed and you need to establish quickly whether this is a compromise, a security flag, or an ordinary ranking problem — because the three have different recoveries.

An in-house developer or IT contact

You can see the symptom and you are not certain of the entry point. You need the investigation done properly before cleanup, so the same route is not left open.

What it costs

What this costs while it goes unfixed

Engineering faults are rarely confined to the engineering layer. These are the commercial consequences we see most often.

Cleaning before investigating usually guarantees a second incident

Removing the injected files destroys the evidence that identifies how they arrived. The visible problem goes away, the entry point does not, and the same compromise returns — often within days.

A flag is a removal from search, not a ranking decline

When a domain is marked unsafe, it is not positioned lower — it is withheld, with a warning in front of anyone who arrives anyway. Recovery is per-vendor and does not happen on your schedule.

Cleaned source code is not a cleaned site

Injected content routinely survives in compiled output, caches, upload directories and generated files that no repository tracks. A site can pass a code review and still be serving injected content.

The cost compounds with every hour of exposure

Exposure is measured in lost transactions and in lost search performance, and the second recovers far more slowly than the first. Containment is the highest-value thing that can happen early.

What we do about it

Capabilities

Each of these is work we carry out, not an area we advise on.

Triage and containment

Stopping the bleeding first: identifying what is actively serving malicious content, containing it, and keeping the site available where that is possible. Under an active incident the sequence is contain, then investigate, then clean — not the reverse.

Evidence preservation

Capturing logs, access records and file state before anything is removed, because the entry point is usually reconstructable only from what existed at the time. This is the step most often skipped under pressure and the one that determines whether the incident is genuinely closed.

Entry-point investigation

Establishing how access was obtained — an unpatched component, a compromised credential, an exposed administrative path, a vulnerable integration — and confirming which of those it was rather than assuming the most common one.

Scope determination

Working out what was actually touched. An injected file in a public directory and a modified authentication routine are very different incidents, and the second is not found by looking at the front end.

Malware and injected-content removal

Removal across the application, the database, upload directories and build artefacts — including the compiled and cached locations where injected content survives a source-level cleanup.

Entry-point remediation

Closing the route that was used, then addressing the paths most likely to be tried next. Removal without remediation is why the same site appears on the same list three months later.

Credential rotation

Rotating access credentials through a process that does not involve sending them to us: the accounts are changed by you, or through a channel you control, on a schedule we set together. We do not ask for them and we do not want them.

Safety-flag clearance

Establishing which security vendors have flagged the domain, supplying each with the evidence its own process requires, and confirming clearance per vendor — because they assess independently and clear independently.

Search recovery

Restoring crawl and indexation after clearance, including any reconsideration request, and verifying recovery against a pre-incident baseline rather than assuming it.

Relapse prevention and handover

Public-surface monitoring, a written incident record, and a handover to whoever owns the site day to day — so the next anomaly is caught by monitoring rather than by a customer.

How we work

Engineering methodology

The sequence is deliberate. The order is usually what determines whether the work holds or has to be repeated.

Contain before you clean
An active compromise continues to do damage while it is being investigated. The first action is always to stop active malicious serving, even at the cost of temporary functionality, because a partially available clean site is a better position than a fully available compromised one.
Preserve the evidence, then investigate, then remove
The sequence is not negotiable, and it is the single decision that most determines whether the incident recurs. Removing injected content is fast, satisfying and destructive to the only record of how it arrived.
Find the entry point rather than the most likely one
It is tempting to assume the cause from the symptom. An exposed admin path, a stale component, a leaked credential and a vulnerable integration produce similar front-end symptoms and have entirely different fixes. We establish which it was.
Clean the artefacts, not just the source
Anything the application writes to is in scope: compiled output, caches, upload directories, generated files. Injected content is drawn to the places a code review does not look.
Separate the intrusion from the flag, and sequence them
The site has to be genuinely clean before a vendor will clear it, and vendors clear independently of one another. Trying to clear a flag first wastes the request; trying to close the incident at the flag wastes the search recovery.
Verify in search, not only in security tools
The incident is closed when crawl and impressions are back against the baseline. A clear warning and a recovered site are different states, and the second lags the first by weeks.

Deliverables

What an engagement produces

Documentation is a deliverable, not an afterthought. On most of these engagements a large part of the value is a defect report precise enough for another team to act on.

Incident assessment

What is currently being served, and to whom
Scope: which parts of the site and estate are affected
Entry point, established from preserved evidence
Which security vendors have flagged the domain, and what each requires
An honest statement of what cannot be determined from the available records

Containment and remediation

Active malicious serving stopped
Malware and injected content removed across application, database and artefacts
Entry point closed
Credential rotation run through a process you control
Related sites and accounts on the same infrastructure reviewed
Administrative and front-end access verified after the work

Recovery

Per-vendor flag clearance with supporting evidence
Search reconsideration and indexation recovery where required
Crawl and impression verification against a pre-incident baseline
Public-surface monitoring so a recurrence is detected quickly
A written incident record you can hand to insurers, clients or your board

Under the hood

Architecture and technology

What we need from you, and what we will never ask for

Safe to share: the domain, what you are seeing, who hosts it, and roughly when it started
Safe to share: whether a warning is appearing, and in which browser or product
Safe to share: whether anything about the site was changed recently by anyone
Control of credentials stays with you — never send passwords, keys or login links
Access is granted on the day it is needed, on your terms, and revoked when the work ends

What is and is not included

Included: containment, investigation, removal, remediation, flag clearance and search recovery
Included: a written record of what was found and what was changed
Not included: forensic evidence to a legal standard, or expert testimony
Not included: a contractual response time — we do not advertise one we cannot staff
Not included: recovering data that was deleted or encrypted before we were contacted

Related work

Where we have done this

Engagements where this capability was the substance of the work rather than a line item.

Fintech & capital markets

Search engineering at stockbroking scale

A stockbroking platform publishing at news velocity was losing search visibility to problems that had nothing to do with content quality. Two workstreams ran in parallel: sustaining a high-volume editorial output across business and market categories, and diagnosing the technical faults — a domain safety flag, recurring server errors, and a metadata defect on a templated page type — that were suppressing how much of that output search engines could actually reach.

225Msitewide impressions

All case studies →

Adjacent problems

If this is not quite your problem

These overlap at the edges. Sending you to the right page is more useful than having you work it out.

You want to reduce the chance of this happening

Preventive assessment and hardening is a different engagement from incident response.

Website security assessment and hardening

The server is being overwhelmed rather than exploited

Hostile traffic that affects availability without compromising the application is a reliability problem.

Platform reliability

You are not sure whether this is a compromise at all

Traffic loss has several causes and only one of them is security.

Crawl and indexation diagnosis

The platform is WordPress specifically

WordPress compromises have their own patterns and their own review points.

WordPress maintenance and security

Questions

Frequently asked

What should I send you?

The domain, what you are seeing, who hosts it, and roughly when it started. That is enough to begin. Never send credentials, API keys, database details or login links in any form, to us or to anyone else responding to an incident — legitimate responders will tell you how to grant access on your own terms rather than asking you to transmit it.

Will the site need to go offline?

Sometimes, and we will tell you before we start rather than during. Containment often means disabling something temporarily — an upload handler, a compromised integration, occasionally a whole site — while the alternative is continuing to serve malicious content. Where a partial mitigation gets the same result we prefer it, but availability is not worth preserving a compromise for.

Do you offer an emergency response time?

No, and we will not advertise one. This is a small practice, and a promised response window that we cannot staff around the clock is worse than no promise, because you would make decisions based on it. We will tell you honestly when we can start. If you need guaranteed round-the-clock response, that is a provider whose business is built for it, and we will say so.

Can you guarantee the security warning will be removed?

We cannot guarantee it, because the decision belongs to each vendor and not to us. What we can do is fix the underlying cause, identify every vendor that has flagged the domain, supply each with what its own process requires, and follow each request through. In practice a genuinely clean site with a properly evidenced request does get cleared, but the timetable is theirs.

Our backups are clean. Can we just restore?

Rarely, and it is worth understanding why. A restore returns the site to a previous state without identifying how it was compromised, so the entry point remains open and the same thing recurs — which is the most common reason a site is compromised repeatedly. It also risks restoring a backup that already contained the intrusion, since compromises often predate the symptoms by weeks. A restore is sometimes part of the recovery; it is not a substitute for the investigation.

How quickly will organic traffic come back?

Search recovery is the slowest part of the process and the least predictable. Once the flag is cleared, the search engine has to observe the change and re-crawl the site, and impressions recover over the following weeks rather than days. We track it against a pre-incident baseline so you can see the actual trajectory rather than waiting for a feeling.

Do we need to tell anyone?

That is a legal and regulatory question rather than a technical one, and it depends on your jurisdiction, your sector and what data was involved. We will tell you plainly what we found and what was accessible, because you may need that to take advice — but we are not qualified to tell you whether notification is required, and we will not pretend to be.

Related capabilities and work

Bring us the problem you have not been able to fix

Describe what is happening rather than what you think the cause is. If we are not the right people for it, we will say so.

Discuss your engineering challenge View our work