Site hacked? We clean it and lock it down.

The first thing is not to panic and not to delete everything on impulse. If you can, put the site in maintenance mode or take it offline: this stops the malware reaching visitors and the server from sending spam, which would harm the domain's reputation.

Then change all passwords, not just the panel one: hosting, FTP, database, email and admin accounts. Make a copy of the site's current state, even if infected, because it's needed to understand how they got in and to recover content. Finally, before you start tinkering, contact a professional: improvised attempts often destroy the only recoverable copy. If you like, write to us: the initial analysis is free.

The most common signs are redirects to unknown sites (often gambling or pharma, sometimes only on mobile), spam pages appearing on Google under your domain, the red "Deceptive site" warning in the browser, and emails landing in spam or getting rejected.

Other, more technical clues: sudden slowdowns, abnormal traffic spikes, files with recent modification dates you didn't touch, new admin users appearing from nowhere or plugins you don't remember installing. A hacked site rarely "goes dark": more often it keeps working while quietly acting against you. If you notice even one of these signs, it's worth having it checked.

It depends on how extensive the infection is, the type of site and what needs recovering, so there are no one-size-fits-all figures. What we can guarantee is the method: first we do a free analysis to understand the real scope, then we give you a clear quote, item by item, with timelines.

You know in advance what you pay and what you get, with no surprise costs and no inflated scaremongering to push up the bill. You decide whether to proceed, with all the information in hand. A site cleaned properly once almost always costs less than repairing it repeatedly because the infection was only removed on the surface.

We reply to every request within 24 hours, and much sooner for emergencies — site down, damage in progress, active blacklist. That's why the form has a dedicated urgency field: it helps us prioritise the requests that can't wait.

The intervention time itself depends on severity: a simple clean-up can take a few hours, a complex case with multiple sites or compromised databases a few days. In any case, after the initial audit we give you a realistic time estimate before starting, and we keep you updated on progress throughout.

We work on WordPress and WooCommerce — by far the most targeted — but also on custom-built PHP sites and the main e-commerce platforms. WordPress is the most frequent target precisely because of its popularity and the many third-party plugins that, if not updated, easily open up gaps.

Whatever the technology, the approach is the same: understand how they got in, clean at the root, close the vulnerabilities and harden. If you're not sure how your site is built, that's no problem: tell us in the form and we'll check during the initial analysis.

Yes. When Google marks a site as "deceptive" or "may harm your device", traffic collapses because almost no one gets past that red screen. We first genuinely clean the site, then handle the reconsideration request through Google Search Console.

This order is crucial: requesting a review with the site still infected only drags out the timeline and can lead to a harsher block. We document the work done, respond to any Google findings and follow the case through to the removal of the warning, so the site becomes visible again and visitors trust it once more. Recovering lost reputation takes method, but it's entirely achievable.

No, don't pay. A ransom gives you no guarantee of getting access back, flags you as a target willing to pay — and therefore worth hitting again — and effectively funds more attacks. In almost every case there are alternative recovery paths that don't involve paying.

If you've received such a demand, the best thing is to isolate the site, keep every message and screenshot as evidence, and have us contacted to assess the concrete recovery options. Often, from a clean backup or by sanitising the existing installation, you get back up and running without giving in to any blackmail.

A cleaned site left unprotected often gets hit again fast, because the gap that was exploited is still there. That's why prevention is part of our work: constant updates of CMS, themes and plugins, robust credentials, correct file permissions, an application firewall and verified automatic backups, so you always have a healthy copy to restart from.

On top of that comes continuous monitoring, which keeps an eye on the site and flags the first suspicious movements, often before you or your customers notice. Security isn't a one-off job, but an ongoing watch over time: it's the difference between putting out a fire and installing smoke detectors.

Yes. After the clean-up you can activate continuous monitoring: we keep an eye on the site, its files and suspicious activity, and alert you at the first signs, so you can act before a small problem becomes a new emergency.

Alongside monitoring we keep security updates current and periodically verify backups, so they're always ready and working when needed. A single contact handles everything and stays available: if you notice anything odd, one message is enough and we take care of it.

Yes. We're a web agency based in Bassano del Grappa, but we handle site hardening entirely remotely, so we work with clients across all of Italy and abroad too. This kind of intervention doesn't need a physical presence: everything that matters happens on the server and the site.

What doesn't change, wherever you are, is having a human contact who answers you, explains what's happening in plain words and follows you through to the solution. You can write to us via the form or on WhatsApp: for emergencies, chat is often the fastest channel.