Owner of a WordPress site currently serving spam pages
Google flagged the domain, the host suspended the account, and the last clean backup is 3 weeks old.
Services
Stop a hacked site from getting reinfected
We clean compromised sites, close the hole the attacker used, and harden what is left. This is a one-off job, or an add-on for software we already build.
What arrives
- A clean codebase and database, with every injected file and row listed
- The entry point identified in writing, with the log lines that show it
- Patched dependencies and a pinned version list, so the fix stays applied
- Hardened configuration: file permissions, admin paths, headers and rate limits
Who this is for
Three profiles. If none of them is recognisably you, this is probably the wrong page - and the line below is the one worth reading before you book anything.
Not a fit: This is not a compliance audit or a staffed 24/7 response desk; if you need SOC 2 evidence, hire a dedicated security firm.
CTO of a small team running a public API
Logs show credential stuffing against the login endpoint, and nobody on the team has handled this before.
Client whose application we already build and maintain
A customer's security questionnaire arrives before renewal, and it asks about hardening, patching and incident response.
What you get
- A clean codebase and database, with every injected file and row listed
- The entry point identified in writing, with the log lines that show it
- Patched dependencies and a pinned version list, so the fix stays applied
- Hardened configuration: file permissions, admin paths, headers and rate limits
- A web application firewall in front of the site, tuned to your traffic
- Rotated credentials and keys, with the old ones revoked and documented
- A short incident report your customers or your insurer can read
What we build it with
-
Cloudflare
- Wordfence
- ModSecurity
- Fail2ban
- OWASP ZAP
- Snyk
-
Nginx
Chosen per project, not per fashion. If your team already runs something else and it works, we use that.
How the work runs
-
1
Same day
Triage
We take a forensic copy, confirm the compromise, and tell you within hours whether to take the site down.
From you: Server and hosting access, plus permission to take the site offline if needed.
-
2
2-5 days
Clean and close
We remove the injected code, restore clean files, and patch the vulnerability the attacker used to get in.
From you: A recent backup if one exists, and the list of people holding admin access.
-
3
3-5 days
Harden
We rotate every credential, tighten permissions and headers, and put a firewall and rate limits in front of traffic.
From you: Domain or DNS access, and a decision on which admin paths stay public.
-
4
30 days
Report and watch
We write up what happened, hand over the hardened setup, and watch logs for 30 days to confirm it holds.
From you: One contact who receives alerts and can approve a block or a takedown.
How we work together
Fixed project
Scope and price agreed up front. Best when the outcome is known and the deadline is real.
Dedicated team
A named team for a quarter or more. Best when the roadmap will change and you want the context kept.
Staff augmentation
Engineers inside your process and your tools. Best when you have the lead and need the hands.
Invoiced in
- USD
- EUR
- GBP
- CHF
- SGD
- AUD
- CAD
- AED
- SAR
- QAR
- JPY
- INR
Paid by
Card, netbanking, wallet and UPI through Razorpay, which is what our checkout runs on, so anything it accepts we accept. Bank transfer, SEPA, Wise and Payoneer for invoices that prefer it.
NDA before the first call. Full IP assignment on delivery. Contracts under Indian, English or Delaware law.
Work like this
Case studies are being written up
Three are in legal review. We can walk you through the work on a call in the meantime, including the parts that did not go to plan.
What clients say on Google
Live from our Google Business listing - not retyped here.
Loading reviews from Google - read them on Google.
Questions we get asked
No. Recilens builds software, and security work sits alongside that. Most of this service goes to clients whose applications we already build, or to companies with a live incident that needs fixing once. We say so plainly, because a full-time security firm is the right call for some jobs.
Usually the same working day, and within a few hours during Indian business hours. The first step is a forensic copy and a decision about taking the site offline. We will tell you honestly if our queue means someone else should take it, rather than letting damage spread.
Come back to us, and we look again at no charge for 30 days after handover. Reinfection usually means a second entry point, a stale admin account or an unpatched plugin, and finding it is part of the job. Past 30 days it becomes a new engagement, agreed up front.
Yes, and that is the better order. A preventive pass reviews dependencies, authentication, file uploads and access control, then fixes what it finds before anyone exploits it. For clients whose software we maintain, this runs as a scheduled check each quarter rather than a separate project.
You decide that, and we give you what you need to do it. The incident report states what was accessed, when, and what the attacker could have taken, in language a non-technical reader follows. If your regulator or insurer needs detail, we supply logs and a technical appendix.
Site compromised right now?
Send the domain and your hosting details, and we will tell you today what we are seeing.