Server Security & Remediation
When the problem is bigger than one site: malware across accounts, processes you do not recognise, outbound spam or attacks from your IP. We clean the server, harden it and set up a malware scanner that keeps watching.
Who this is for
- Hosting providers and system administrators with a compromised shared or dedicated server.
- Agencies running their clients' sites on their own VPS.
- Businesses whose server was flagged for spam, abuse or attacks by the datacenter or an abuse list.
Server Security & Remediation
Starting price for one server with a moderate number of accounts. Server antivirus and malware scanner setup alone: €120 per server.
What's included
- Server-wide malware scan of every account and system location, with manual review of the results.
- Hunt for persistence outside the web roots: rogue processes and masqueraded daemons, cron jobs, SSH authorised keys, systemd units, modified binaries, PHP and web server configuration overrides.
- Identification of the compromised accounts and the shared paths between them.
- Cleanup of every account in scope, with evidence copies first.
- Server hardening: SSH and panel access, firewall, PHP handler and open_basedir / CageFS-type isolation where the platform offers it, mail sending limits, permissions.
- Setup and tuning of a server antivirus and malware scanner with real-time protection (€120 per server, also available standalone).
- Written report per server with findings, actions and open items.
What's not included
- Operating system reinstallation or migration to a new server. If the compromise is at a level where reinstall is the honest answer, we say so and help plan it.
- Ongoing server administration. We remediate and hand over; retained monitoring is arranged separately.
- Cleanup of individual sites outside the agreed scope. Found infections in other accounts are reported and quoted.
How we work
Server work is done with the administrator present or informed at every step. Every change is logged.
Scope and accessday 1
Panel type, number of accounts, symptoms, what the datacenter or abuse report said. Root or administrator access is arranged over an agreed channel.
Evidenceday 1
Running processes, network connections, cron, keys, logs and the suspect files are captured before anything is killed or removed.
Server-wide huntdays 1–3
Scanner results reviewed by hand, system locations checked, accounts correlated. Masqueraded processes and in-memory persistence are identified, not just files.
Clean and harden
Accounts cleaned, persistence removed, access tightened, scanner installed and tuned. Each change is logged in the report.
Verify and reporttypically 3–7 business days per server
Re-scan, process and connection review, external checks (blacklists, open ports). Report delivered with open items for your team.
What you receive
- Per-server report: affected accounts, persistence found, actions taken, hardening applied, open items.
- Indicator list (hashes, IPs, domains) for your firewall or abuse desk.
- Scanner configured with real-time protection and a tuned ignore list.
- Evidence archive, kept 30 days unless agreed otherwise.
What changes the price
- Number of accounts and sites on the server, and how many are infected.
- Root-level compromise (modified system binaries, kernel modules, rootkits) widens the scope.
- Scanner setup only, no cleanup: €120 per server.
Frequently asked questions
Which panels and platforms?
cPanel/WHM, Plesk, DirectAdmin, CloudWays-type managed stacks and plain Linux (Debian, Ubuntu, AlmaLinux, Rocky, CentOS). The method is the same; the paths differ.
Which server antivirus do you install?
A commercial server antivirus and malware scanner for Linux web servers with real-time file protection, suited to the control panel in use. We install, tune and hand over the configuration; the licence is in your name.
The datacenter says our IP is sending spam or attacks. Can you find the source?
Yes. That usually means a compromised account, a rogue process or a mail script. We correlate outbound connections, mail logs and processes to find it and remove it.
Do you need root?
For server-level work, yes, or an administrator on the session with us. For a single-account cleanup, the account access is enough; see Malware Removal.
Will the server need downtime?
Normally not. Processes are stopped individually; services are restarted only when a configuration change requires it, at an agreed time.
Can you work with our own administrator?
Preferably. We work alongside your team, explain what we find and leave the server in a state they can maintain. Hosting providers have partner terms on the B2B page.
Related reading
From our research notes
Server flagged or compromised?
Tell us the panel, the number of accounts and what you observed. We reply with the access we need and the next steps.