Your site redirects to other pages, the browser shows a warning or spam appeared in search. We analyse the incident from the traces in the logs, clean the site and explain how they got in.
A site file under a magnifier: ultraviolet light reveals malicious code hidden among normal code
1<?php2// theme-cache.php3require_once __DIR__ . '/inc/config.php';4$cache = get_option('theme_cache');5$ver = defined('THEME_VER') ? THEME_VER : '1.0';6if (!empty($cache)) {7$data = $cache;8}9add_action('init', 'theme_boot');10function theme_boot() { return true; }11add_filter('the_content', 'theme_filter');12function theme_filter($c) {13return $c;14}15add_action('wp_footer', 'theme_footer');16function theme_footer() { echo ''; }17if (is_user_logged_in()) { return; }18setcookie('visited', '1', time() + 86400);19// end of file20?>
Infections found: 0 of 5
Move the magnifier over the file: ultraviolet light shows what is hidden
These steps do not clean the site, but they keep the traces and stop the damage from growing. Tick off what you have done.
Do this now
All steps done. It is better to continue with a specialist: we find the source and close the hole.
Tick what you have noticed in recent weeks. This is a quick estimate, not a diagnosis: a precise answer comes from analysing files and logs.
Tick the signs
The needle shows how much the situation looks like a hack. Nothing is sent anywhere.
Ticked: 0 of 10
Do not see your signs or not sure? Describe what you see and we will tell you where to start.
Answers are not saved or sent until you press the button yourself.
The minimum we almost always do: put the site in quarantine, take a copy as it is, find the source, clean, work out the cause, close the hole, change the access, verify and hand over a report.
Site infected: 5 sources
We close the site to visitors and to the attacker: a maintenance page and limited access. Damage and blocklisting stop growing.
We take a copy of files, database and logs in their current state. We search for the source with it, and you can roll back to it if something goes wrong.
We compare files with a clean platform version and look for injected code, hidden files, extra users, scheduled tasks and other traces: altered database records, foreign rules in .htaccess, added access keys, suspicious lines in the logs.
We remove the malicious code, restore the original files and clean the database of spam pages and links. Every action is logged.
From the logs we find how they got in: an old plugin, a weak password, infected hosting or a leaked key. Without this the hack repeats.
We update or remove the vulnerable plugin, fix permissions and settings, and forbid running code where it is not needed.
We change passwords, keys and tokens and remove foreign users and sessions. New access is passed to you in a safe way.
We scan again, check forms and orders and remove browser and search engine warnings. The report: what we found, what we did, what we recommend.
Cleaning without finding the cause is pointless: they come back through the same door. We check all the typical entry points and beyond them, instead of guessing at one.
Doors closed: 0 of 6
A hack hits more than the site. The browser scares visitors, search shows foreign pages and customer emails go to spam.
An illustration, not a real site.
How we remove it
How we remove it
How we remove it
Is your site already blocked or is mail not arriving? Tell us what you see.
After the analysis you get not a phrase "all fixed" but a document: what happened and when, what was found, how they got in, what was done and what to do next. Press the tabs.
Incident report sample
Request: the site redirects visitors to foreign pages.
Quarantine: a maintenance page, access limited.
A copy of files, database and logs taken.
5 sources found: a theme file, a hidden file in uploads, a scheduled task, an extra administrator, a replaced home page.
Sources removed, files restored from the original, database cleaned of spam.
Cause found: an outdated plugin with a file upload vulnerability.
The hole closed, passwords and keys changed, the foreign user removed.
Re-check passed, a request to remove the browser warning prepared.
wp-content/themes/shop/theme-cache.phpInjected code reads commands from a request and runs them.
Cleanedwp-content/uploads/2026/11/x.phpA hidden shell the attacker used to come in.
Removedcron: */5 * * * *A task that downloaded malicious code every five minutes.
Removeduser: admin2An administrator the owner never created.
Removedindex.phpA redirect of visitors from search to a foreign address.
Restored from the originalThrough a vulnerability in an old version of a slider plugin, a file with code was uploaded to the site. The access log shows a request to the plugin and a file appearing in the uploads folder right after it.
Closed: the plugin updated, running files in the uploads folder forbidden, admin access limited.
A sample: the data is fictional, a real report contains your files, times and conclusions.
The price is made of hours: platform, number of sites, whether there is a clean copy, whether blocks must be removed. Below is a guide. We name the exact price after the diagnosis and before work starts. The minimum diagnosis is from 4 hours.
Local cleaning
—
One site, clear symptoms, a clean copy exists: find the source, clean, close the hole.
What is included
This is a guide, not an offer: the exact price and time are fixed after the diagnosis.
No one can promise that a site will never be hacked. We answer for what we found and closed.
Choose a case from the list
What if:
Covered. We clean it again at no extra charge if this is the cause from our report.
Covered. We check it against a copy: the clean backup, or, if there was none, the copy we took from the hacked site. If it worked there, we fix it at no extra charge under the guarantee. When needed, we deploy the copy on a server to check.
Not covered. We closed the hole in the current version. Rolling back to an old copy brings it back.
Not covered. This is a new case: we do a new analysis on the usual terms.
Not covered. We changed the new access. Returning the old one opens the door again.
Not covered. The term is over: a new analysis on the usual terms.
Not covered. The copy means the clean backup or, if there was none, the copy we took from the hacked site. This is not a result of the cleaning. If the feature is missing from the copy because the hack destroyed it, restoring it is development from scratch on regular terms. If the copy deployed on a server shows it did not work there either, the client pays for the time to deploy it and diagnose.
Not covered. We answer for the code as we handed it over after the cleaning. The guarantee does not cover other people's changes.
The guarantee does not make a site invulnerable: it covers what we found and fixed. All guarantees on the cleaning last 30 days, no longer.
To start we need little: a couple of access items and a description of what you see. And we say plainly what we do not do.
Required ready: 0 of 2
How to pass access safely: create a separate user or a temporary password and do not send passwords in plain emails. After the work we ask you to disable or change them.
Press a card: we tell exactly how.
People who hack sites are often professionals and experts at their craft: educated, with vast experience in cybersecurity. They know how platforms and servers work and look for the weak spot systematically.
They read the code of popular systems and plugins and learn about new vulnerabilities first.
Bots and scripts check thousands of sites in a row: old versions, weak passwords, forgotten files and test pages.
Very often sites are hacked through gaps and channels that have been known for months and sometimes years, and that owners ignored. A plugin you did not update or a password that has already leaked somewhere is enough.
A site has to be run and maintained, not launched and forgotten. Neglect costs more than regular care.
Cleaning the site is not enough: the hack must not repeat. Three steps after recovery, choose what you need.
Updates, access rights, backups and monitoring: we close what attackers use most often.
A check of versions, access, forms and server settings with a fix list, before anything happens.
Regular updates, backups and monitoring by the hours of a subscription, with a report by dates.
Website support detailsA team of developers works on the case, and the project manager answers you and watches the deadlines.
You get one person in charge, a step-by-step report and an honest answer if something goes off plan.
CEO
15.8+ years in IT: development, design, marketing
Project manager
Takes care of you and your project as if it were their own: keeps things in order and adds warmth to every message
Backend developer
Solves hard server-side tasks and finds their way around other people's code
QA engineer
Tests changes before the release: browsers, phones, forms
Frontend developer
Makes interfaces fast and convenient on any device
Full-stack developer
Takes tasks end to end: from the interface to the server and the database
Content manager
Fills and updates the site and keeps the texts and pages in order
Team lead
Leads complex tasks and makes sure everything is done to the specification and on time
Reviews of the agency's clients about working with us.
We express our gratitude for the high-quality development of the site's advertising and its upgrade. All deadlines were met. Questions that came up along the way were resolved on the go, without any problems.
A. A. KhamenDeputy General Director, Woodcraft LLC
Navigation on the site is intuitive, and the pages load instantly on mobile and in the browser. Special thanks to Stanislav Voloshin for his very careful attention to detail and control of deadlines. Within the agreed time we reached the Top 10 in Google and Yandex for our key queries.
Kirill ZhukovskyDirector, “Otopitelny Standart” LLC
Our company has worked with Voloshin IT Agency since 2016. We later continued the cooperation on SEO promotion and support of corizza.by. We appreciate the response to any request in “ambulance” mode.
A. S. MakalManager, “DesyatkaBug” LLC (Corizza)
Technical support of the project has always been at the highest level. The request system that was set up lets our medical registrars book patients into a single electronic log. For the name of the medical center the site is in the Top 10 and keeps rising in the results.
A. V. AkulovDirector, “Med-Praktika” LLC
Our site has a catalog of more than 500 product items and works in 4 languages. Despite the large amount of work, the delivery deadlines were not missed. We are confident in the high professionalism of your team.
M. N. BugaevHead of Marketing, Brest Meat Processing Plant (OJSC)
We ordered a turnkey service, from design and writing the content to setting up contextual advertising in Yandex. The site loads instantly in the browser and on mobile, and all the features work well. We continue the cooperation on SEO optimization.
V. N. LuzhinskySole proprietor, pol360.by
The necessary information is provided on time, and reports are explained clearly, in plain language. But the most important factor for me is the attitude toward the client. They always understand and wait for payment if we have any problems on our side.
Ekaterina LashkevichSole proprietor, Bayu.by
The high-quality management of the advertising campaign and the proposals for improving and developing it convinced me of the high professionalism of the staff. During our cooperation the results improved significantly.
Sergey MikhailovSole proprietor, lafet-pricep.by
We want to note the high professionalism and mobility of the staff, the individual approach and quick decisions on every order. Through its work the company has significantly improved the workflow of our enterprise.
STOPGOBelagroservis branch, used auto parts store
Very pleased with the cooperation, the result exceeded my expectations!
Sergey MikhailyukDirector, MANHARD
Typical signs: redirects to foreign pages, a browser warning, foreign pages in search, unknown administrators, a malware notice from hosting. Take the self-check above: it shows how much the situation looks like a hack.
Save a copy of the site and the logs, change passwords from a clean device and close the site to visitors if it redirects people or sends spam. Do not delete files at random and do not restore an old copy over the site.
If the site redirects visitors, shows malicious pages or sends spam, turn on maintenance mode: you will not expose customers or get blocklisted. If there are no visible problems, we decide by the situation.
Scanner plugins find some infected files but do not look for the cause and can erase the traces. Without removing the cause the infection usually comes back.
Hosting and site admin access, and if needed FTP or SSH and the database. After the work we ask you to change passwords or disable temporary users, and the report lists what we changed.
It depends on the platform, the number of sites and how deep the infection is. The calculator above gives time guides, and we name the exact time after the diagnosis.
Yes, but it takes longer: files and the database have to be checked by hand and compared with a clean platform version. In the estimate it is separate hours.
Sites on WordPress, Joomla, Drupal, 1C-Bitrix and Bitrix24, MODX, DLE, UMI.CMS, NetCat and TYPO3. Online shops on OpenCart, WooCommerce, Magento and PrestaShop. Sites on PHP, Laravel, Symfony, Yii, Python (Django, Flask) and Node.js, as well as custom-built engines. If you have another platform, write to us and we will say whether we take it.
The price is counted in hours: platform, number of sites, whether there is a clean copy, blocks. The calculator gives a guide, and we name the exact price after the diagnosis and before the work.
If the site is infected again through the same cause we found and closed, we clean it again at no extra charge within the guarantee term. The terms and the cases that are not covered are described above.
We remove the infection and the cause, then prepare a review request in Search Console and file it together with you: owner rights are needed. The review time depends on the search engine.
Access is needed only for the time of the work and is not passed to third parties. We fix confidentiality terms in the contract.
More than 15 years of experience.
300+ clients, many of whom have come back to us.
No padding: we show only real ones, with the authors' consent.
Hours times a rate, no hidden percentages, a quote before work starts.
Analysis, design, development, SEO and advertising with no gaps between contractors.
You talk to the project manager, who owns the result and the deadlines.
We write the terms into the contract and show what has been done.
We hand over access, code and documentation, with no lock-in to us.
Convenient ways to reach us: Telegram, WhatsApp and the contact form.
If the task can be solved more simply or cheaply, we will say so.
Questions about your case? Describe the situation.
Write what you see: we tell you what to do right now and where we start.