Why Does My Site Keep Getting Hacked?
A site that was cleaned by a plugin, a host or another provider and came back infected still has something the cleanup did not reach: a scheduled task, a database entry, a server account, a credential. We look at every layer, not just the files, close it and put it in writing. If we did the previous cleanup, write to us first: we review our own work before anything else is discussed.
Who this is for
- Owners whose site was cleaned once or several times, by a plugin, a host or another provider, and came back infected.
- Agencies managing a site that is burning hours on repeated cleanups.
- Hosts with one account that keeps triggering alerts after every cleanup.
Reinfection Investigation
Starting price for one site cleaned elsewhere that came back infected. It includes the full cleanup of everything found (a standard cleanup alone is €220); the difference is the layer-by-layer investigation and the report. Confirmed in writing before we start.
What's included
- Review of what previous cleanups did and did not cover.
- Persistence hunt across all layers: cron jobs, must-use plugins, database options and posts, scheduled events, object cache, MySQL triggers, modified core files, .htaccess and PHP configuration files.
- Check of other accounts, sites and users on the same server that can write to this site.
- Credential and access review: administrator accounts, application passwords, API keys, SFTP and database users, hosting panel sessions.
- Software and configuration review for the open door: outdated or abandoned components, exposed backups, writable directories.
- Removal of everything found, with evidence copies first.
- Report: where the reinfection came from, what was removed, what still needs to change on your side.
What's not included
- Guarantees that a site with an unpatched, known-vulnerable component will stay clean if the component stays. The report names it; replacing it is your decision.
- Cleanup of other sites on the server that are not part of the engagement. If we find them infected, we tell you and quote them.
- Ongoing monitoring. See Maintenance & Security Monitoring, which includes cleanups.
How we work
A reinfection investigation is wider than a cleanup and narrower than a full incident investigation. It is built around one question: what keeps bringing the malware back.
History and accessday 1
You tell us when the site was cleaned, by whom, and what came back. We ask for panel, SSH/SFTP and database access, and any previous reports.
Evidence and baselineday 1
Full copy of files and database. Hashes of everything we will examine, so we can prove later what changed.
Layer-by-layer huntdays 1–3
Files, database, cron, server-level locations outside the web root, other accounts on the server, credentials, scheduled tasks and caches. Obfuscated payloads are decoded, not just deleted.
Close and clean
Everything found is removed. Where a legitimate file was modified it is restored. Risk points that only you can change (passwords, abandoned components, hosting settings) are listed clearly.
Verify and reporttypically 3–7 business days total
Verification pass, external check, written report. We stay available for questions after delivery.
What you receive
- Written report naming the reinfection mechanism, with evidence.
- Inventory of every malicious artefact removed, with paths and hashes.
- Clean, verified site.
- Short list of the changes only you can make, in priority order.
What changes the price
- Several sites or accounts on the same server involved in the reinfection chain.
- Server-level persistence (root cron, system services, modified binaries): see Server Security & Remediation.
- Need for a formal incident report for third parties: see Incident Investigation.
Frequently asked questions
My security plugin says the site is clean, but it keeps getting hacked. Why?
Plugins scan what they can see from inside the application. Reinfection usually lives where they do not look: cron jobs, the database, PHP configuration files, other accounts on the same server, or a credential the attacker still holds. Those are the layers we check by hand.
Is it my hosting provider's fault?
Sometimes a neighbouring account on a shared server is the source; often it is a component or credential on the site itself. We do not guess. The report states what the evidence shows, and we can share it with your host if cross-account access is involved.
Do you replace the vulnerable plugin or theme?
We identify it and tell you. Replacing or removing components you chose is your decision, because it can change how the site works. If you want us to do it, we add it to the scope.
Does this include the cleanup?
Yes. Everything we find during the investigation is removed as part of the price. The investigation is the extra work on top of a standard cleanup.
You cleaned my site and it came back. Do I pay this?
Write to us first, with the case reference. We review our own work before anything else is discussed. This service is priced for sites that were cleaned by someone else.
What if the site was restored from a backup that was already infected?
That is one of the most common reinfection patterns. We check backups you still have and tell you which restore point is actually clean.
Can you prevent it from happening again?
We close what we find and list what you need to change. For continued protection the right product is a Maintenance plan, which includes monitoring and cleanups.
Related reading
From our research notes
Cleaned it twice already?
Tell us the history: when it was cleaned, by whom, what came back. We reply with the access we need and the next steps.