Site Rescue • Joomla · Drupal · WordPress · Custom PHP

We don’t disinfect a hacked site. We rebuild it.

Most cleanups scan your files, match what they recognise and delete it. That works right up until the attacker used something the scanner has never seen — and on a site running software that no longer gets security updates, that is the normal case, not the unlucky one.

So we do it the other way round. We delete the installation and replace the core files with a fresh copy from the vendor’s own source, bring your content back rather than the old code, and rotate every credential the site touches. Malicious code doesn’t have to be recognised to be gone — it simply isn’t carried across.

Request a Site Rescue Start with a free Site Check

Every rescue ends with a written report

Not a “your site is clean” email. A document you can keep, covering:

✓What we found — files, admin users, cron entries, database injections, with paths
✓What we removed and replaced, and which version we replaced it from
✓Any code we could not replace from a canonical source, and therefore read by hand
✓What we rotated, and what we hardened
✓The limits of the report — including what a comparison cannot detect, and what stays exposed

How the rebuild works

1Snapshot before anything changesA full copy of files and database, stored off the docroot. It is evidence, not a restore point — we never restore from it to “fix” the site, because it contains the compromise.
2Compare against a clean coreA pristine copy of the exact same version, diffed across all file types — not just the executable ones. Phishing kits and redirectors are usually plain HTML, which is precisely why signature scanners walk past them.
3Rebuild from the vendor’s sourceThe installation is deleted and replaced from canonical source. Your content comes back; the old code does not. Anything that cannot be re-obtained from a canonical source is read by hand and listed in your report.
4Rotate everything, then hardenAdministrator accounts, the database user, FTP/SSH, API keys and mailbox passwords. Then ModSecurity, executables denied in upload directories, unused extensions removed, permissions corrected.

Where a rebuild is more complete, and where it is less. On WordPress, core and almost the whole plugin and theme estate can be re-obtained from canonical sources, so very little non-content code survives the rebuild. On Joomla and Drupal the extension and custom-code estate is far less canonicalisable — more code has to be judged rather than replaced. We tell you which of your files fell into that second group.

Guaranteed on WordPress. Refused on Joomla and Drupal — here’s why.

WordPress — 30-day re-infection guarantee

If a WordPress site we rebuilt is re-infected within 30 days of delivery, we rebuild it again at no charge.

We can promise that because the rebuild is near-total there: so little non-content code survives that there is very little left to carry an infection across. The residual risk, stated plainly, is a zero-day in a plugin you choose to keep — which no one can rule out.

Joomla and Drupal — we don’t offer it

Not because the work is worse. Because the platform cannot be made safe, so the promise would be one we couldn’t keep.

Joomla 3 security support ended 17 August 2023, and the paid extended support programme that replaced it closed on 17 February 2025, stating “no new updates will be released”. Drupal 7 reached end of life 5 January 2025; Drupal’s own security team no longer issues advisories for core or contributed modules and says “zero-days may occur”.

There is no route to security updates for either platform at any price. A flawless clean puts the site back exactly as it was — including the way in.

That is the honest position, and it is why the ladder has three rungs. A rescue stops the bleeding. Legacy Shield contains the risk while you plan. Only moving off end-of-life software actually ends it.

Ways in

Site Rescue

The full rebuild described above, plus hardening and blacklist-removal requests, ending in your written report.

Same-day emergency

When the site is down, defaced or flagged and it cannot wait for the next scheduled slot.

Small Fix

For “it broke after a PHP change” — a single contained problem rather than a compromise.

Rescues are quoted at a fixed price after the free Site Check, so you know the number before any work starts — and if the job turns out to be materially larger than described, we stop and re-quote rather than bill you a surprise.

Free Legacy Site Check

Not sure whether you need a rescue at all? Send us the address and we will send back a one-page report within two business days, at no charge and with nothing to cancel.

✓Which CMS and version the site runs, and whether it is past end of life
✓The PHP version it needs, and whether that is still supported
✓SSL state, Google Safe Browsing and blacklist status
✓Obviously outdated extensions
✓One concrete recommendation for what to do next
✓Including, where it applies, that the right answer is to leave it alone

What we don’t claim

That a clean site is a safe site

On Joomla 3 or Drupal 7 it isn’t. We will clean it, and we will tell you in writing that the way in is still open, because it is.

A track record on upgrades

We have hosted end-of-life sites for years, but we have not delivered a Joomla or Drupal platform upgrade. The Upgrade Assessment is a scoping exercise that ends in a written quote — not a claim of experience we don’t have.

A turnaround time we haven’t measured

We’d rather give you a date after looking at your site than publish a number we can’t keep for every case.

Questions people actually ask

My site was cleaned before and got re-infected. Why would this be different?

Usually because the previous clean removed what it could identify and left everything it couldn’t. A rebuild doesn’t depend on identifying anything: the code is replaced from the vendor’s own source, so whatever was added is simply not carried across. What it cannot fix is the underlying vulnerability in end-of-life software — which is why we are explicit about that rather than quiet about it.

Do I have to move my hosting to you?

For a rescue, yes — we deliver the clean on our own platform, where we control the PHP version, the isolation and the hardening. Migration is included with a hosting plan.

Will my site keep working? It needs an old PHP version.

That is the normal case for these sites and it is handled. Each site runs the PHP version it actually needs, isolated from every other site on the platform.

What happens to my content and my custom code?

Content comes back. Custom code and any extension we cannot re-obtain from a canonical source is reviewed by hand before it is kept, and every such file is listed in your report — that list is the honest boundary of the clean.

Can you just upgrade the site instead?

Often that is the right answer, and it is the only one that ends the risk. It starts with a paid, fixed-price Upgrade Assessment that inventories the extensions, custom code and content and returns a written scoped quote — and the fee comes off the project if you go ahead. For Drupal 7, Backdrop CMS is usually the cheapest credible route, though its own documentation is clear that it is not a no-work migration.

Request a Site Rescue

Tell us the address and what you are seeing. If it is simpler than it looks we will say so, and if it is bigger than we can sensibly take on we will tell you that too and point you somewhere better.

Nothing is touched before you authorise it in writing. You will get the scope, what will change, what we need from you and a fixed price first.