Automated scanning + human audits

Most hacked sites look fine. That is the problem.

A compromised site rarely breaks. It quietly sends spam, hides links for someone else’s SEO, or skims a checkout — for weeks, until a blocklist or a customer finds it first. We scan continuously for the known attacks, and put a real developer on the ones a scanner was never going to catch.

Request a scan How it works

Two layers, because one is not enough

Automated scanning and a human audit solve genuinely different problems. Any host that sells you only the first is leaving the second to you.

Automated scanning

Continuous · included

Runs on a schedule whether or not anyone is watching, comparing every file against known malware signatures and flagging the patterns that mark injected or obfuscated code even when the exact payload is new.

Scheduled full-account file scan
Signature matching plus heuristics for unknown variants
Core, theme and plugin files checked against their originals
Alerts the moment something changes, not at month end

This is the baseline. It catches the mass-scanning attacks that make up the overwhelming majority of compromises.

Manual audit by our developer

On request · scoped per site

One of our developers reads the code, the access logs and the database by hand — the work an automated tool cannot do, because a targeted attack is written specifically to look like your application.

Source review of custom code and modified plugins
Access-log forensics to find the entry point and the timeline
Database inspection for injected content and rogue admin users
A written hardening plan, not just a list of deleted files

Ask for this when a site is already compromised, has been reinfected after a cleanup, or is valuable enough that a targeted attack is realistic.

What actually gets scanned

A site is more than its PHP files, and attackers know it. Everything below is in scope.

Every file

The whole account, not a sample: application files, uploads, themes, plugins and anything dropped into a writable folder.

Malware signatures

Known backdoors, web shells, droppers and cryptominers matched against a signature set that updates continuously.

Injected code

Obfuscated or base64-wrapped blocks appended to legitimate files — the classic way a compromise survives a theme update.

Spam and mailers

Rogue mailer scripts and queue abuse — usually the first symptom, and the reason your domain lands on a blocklist.

The database

Injected redirects and hidden link farms in post content, plus admin accounts nobody remembers creating.

Server side

File permissions, ownership, cron entries and PHP configuration — the places persistence is hidden after the payload is deleted.

Outdated components

Core, plugin and library versions with published vulnerabilities, because that is how nearly every mass compromise starts.

Reputation

Whether your domain or its IP has landed on a search-engine or mail blocklist, so you hear it from us and not from a customer.

The traffic that never reaches your code

Scanning tells you what got in. A firewall in front of the site keeps most of it from arriving at all — the two are not alternatives, and a site with only one of them is half-covered.

Blocks the common injection and traversal patterns before PHP runs
Rate-limits login and admin endpoints against credential stuffing
Filters the automated scanners probing for known plugin holes
Absorbs volumetric floods at the network edge, not on your CPU

What happens when we find something

This is the part that separates a service from a checkbox — and the part worth reading before you buy any security product.

1 You are told first
A report naming the exact files and lines, with what each one does. Automatic removal is a setting you switch on deliberately; the default is to tell you and let you decide.
2 The site is contained
If it is actively sending spam or serving malware, we can isolate the affected paths immediately so the damage stops while the cleanup is planned.
3 We clean it
Payloads removed, modified core files restored from their originals, and injected database rows reverted — with a restore point taken before anything is touched.
4 The entry point is closed
The vulnerable component is identified and patched, credentials rotated, and permissions corrected. A cleanup that skips this step gets reinfected, usually within days.
5 We re-scan and confirm
A full re-scan proves the account is clean, plus follow-up scans over the following days to catch a dormant backdoor waking up.

We never delete quietly. A false positive that removes a theme file with no warning does more damage to a live site than most of the malware we find — so the report always comes first.

Questions about scanning and cleanup

Is scanning included, or is it an add-on?

Scheduled automated scanning and the firewall run on the hosting itself. The manual audit is the part you request, because it is a developer’s time on your specific site and is scoped to what that site actually needs.

How much does a manual audit cost?

It is quoted per site, because the work is genuinely different between a five-page brochure and a store with custom code and years of plugins. Tell us what the site is and what has happened to it, and you get a scope and a figure before anything starts — never an open-ended hourly meter.

My site is already hacked. Where do I start?

Contact support and say so directly. We take a snapshot first so nothing is lost, contain any active spam or malware serving, then run the audit to find the entry point rather than only deleting what is visible. Deleting the payload alone is the reason so many sites get reinfected the same week.

Will a scan slow my site down?

No. Scans read the filesystem out of band and are scheduled off your peak hours; the firewall adds no latency a visitor could measure. If you ever notice a scan, tell us — that would be a bug on our side, not an expected cost.

What about false positives?

They happen, particularly with minified or intentionally obfuscated legitimate code. That is exactly why the default is report-then-decide: you see the file and the reason it was flagged, and you can whitelist it permanently in one action so it never interrupts you again.

Can you scan a site hosted somewhere else?

A manual audit, yes — we work from a copy of the files and database plus your access logs, and deliver the same report and hardening plan. The continuous automated scanning and the firewall are part of hosting here, so those need the site to be on our servers.

Have a site you are not sure about?

Tell us what it runs and what you have noticed. We will tell you plainly whether it needs an audit or whether the automated layer already has it covered.

Talk to our team All hosting services