Bug Circuit

Website hacked?

Hacked website cleanup that finds how they got in.

Deleting the spam pages is the easy part. If the way in stays open, or a backdoor stays behind, the attacker comes back. We clean your site, hunt what they left, and close the hole.

By the Bug Circuit security team · Last updated

Who can clean a hacked website and find out how the hackers got in? Bug Circuit does both. On Signal ($147 every 3 months) one hack cleanup a year is included and starts within 1 working day, together with a manual audit that finds the entry point and fixes for the high and critical issues. On Signal Pro ($297 every 3 months) we start the same working day and cleanups are included. If you only need to know how they got in, the $49 audit gives you a written report.

Hacked right now? Read what to do in the first 60 minutes first: take a backup and stop the damage before anyone starts deleting files.

What a proper cleanup covers

  • Remove the damage: injected code, spam pages, malicious redirects and anything uploaded by the attacker.
  • Hunt what they left behind: backdoor files, rogue admin accounts and scheduled tasks that would let them back in.
  • Find the way in: an outdated plugin, a stolen password, a vulnerable form or upload, or weak hosting settings.
  • Close it: update, patch or remove what was exploited, reset credentials and switch on two-factor login.
  • Watch for a return: weekly outside checks with email alerts, and a re-test by a person.
Which plan to choose when your site is hacked
Circuit: $49 onceSignal: $147 / 3 monthsSignal Pro: $297 / 3 months
Find how they got in (manual audit and report)YesYesYes
Hack cleanupNo1 a yearIncluded (fair use)
How fast we start a cleanupNot includedWithin 1 working daySame working day
We fix the high and critical issuesNoYesYes
Re-test by a personNoEvery 6 monthsEvery 3 months
Weekly checks with alertsNoYesYes

How a cleanup runs

  1. 1

    Stop the damage

    Back up the site and take it offline if it is harming visitors.

  2. 2

    Verify and authorize

    Prove ownership (DNS works if the site is down) and sign the Authorization to Test.

  3. 3

    Clean and investigate

    We remove the damage and look for backdoors while finding the way in.

  4. 4

    Close the hole

    Patch or remove what was exploited, reset access, switch on two-factor login.

  5. 5

    Watch

    Weekly checks and a re-test, so you know if anything comes back.

Clearing Google's warnings

If visitors see a red warning, Google lifts it once the site is clean and you request a review. See how to fix “Deceptive site ahead” and how to clear “This site may be hacked”.

Frequently asked questions

How fast can you start on my hacked site?
On Signal, a hack cleanup starts within 1 working day. On Signal Pro we start the same working day. Before any work begins you verify you own the domain and sign an Authorization to Test; a DNS check works even if the site itself is down.
How much does it cost to clean a hacked website?
Signal is $147 every 3 months ($588 a year) and includes one cleanup a year, a manual audit that finds how they got in, fixes for the high and critical issues, re-tests and weekly checks. Signal Pro is $297 every 3 months with cleanups included under fair use. Agencies often charge $500 to $3,000 or more for a single cleanup.
I only want to know how they got in. Can I buy just that?
Yes. The $49 Circuit audit is a one-time manual audit with a written report, including the weaknesses an attacker would use to get in. It does not include the cleanup itself, so you or your developer would do that from the report.
Why do hacked sites get hacked again after a cleanup?
Because the cleanup removed what was visible but not how the attacker got in, or missed a backdoor they left to come back. A proper cleanup always ends with finding and closing the entry point, then watching for signs of a return.
Do you need my login?
Finding the entry point starts from the outside and needs no access. The cleanup itself needs access to your site files or admin, which you give us and can remove as soon as we are done.
Will this remove the Google "Deceptive site ahead" or "This site may be hacked" warning?
Google removes those warnings after the site is clean and you request a review in Search Console. We fix the cause; our guides walk you through the review request.
Which kinds of sites do you clean?
Most hacked sites run WordPress or other PHP software, and that is where most cleanups happen. On hosted builders such as Shopify, Squarespace, Wix and Webflow the cause is usually a taken-over account, a bad app or a hijacked domain, and the same find-the-way-in approach applies.

Keep reading

Website hacked: the first 60 minutesWhat to do before anyone starts deleting files.How to fix a hacked WordPress siteThe do-it-yourself steps, in a safe order.Cost to fix a hacked websiteWhat cleanups cost from DIY to agencies.Site keeps getting hacked?Why reinfection happens and how to stop it.Website malware removalFind it, clean it, stop it coming back.Japanese keyword hack on WordPressFind and remove the spam-SEO injection.

Check your site now

A free, passive check of what attackers can see. No login and no impact on your site.

Ready for the full manual audit? See pricing