# Hacked website clean up and remediation, with a playbook your team keeps

Source: https://ai.prospicience.in/capabilities/security-and-remediation

We clean up compromised sites and leave you equipped to handle the next incident quickly. For a group of sites on one hosting account with no host automation, we wrote an eight section playbook covering malware types, clean up steps, bad configuration and search spam removal, then built an assistant that follows it through the hosting panel.

## What you get

- Evidence is preserved before anything is deleted, so the entry point can be found and closed.
- Configuration files are backed up before every change, so each step can be undone.
- You keep a written playbook, so whoever handles the next incident starts from a proven process.
- Spam pages are cleared from search results as part of the job, so your reputation recovers along with your site.
- Where the host offers no automation, an assistant follows the playbook through the hosting panel the way a person would.

## Systems we have shipped for this

- E08 Moving a magazine's website out of a hacked install, in three languages (Family magazine publisher): https://ai.prospicience.in/work/trilingual-publisher-migration
- E09 A repeatable clean-up playbook for hacked websites (Group of WordPress sites): https://ai.prospicience.in/work/wordpress-cleanup-playbook

## What businesses come to us for

- A publisher's ten year archive sat on a compromised install and needed to be moved as well as cleaned.
- A multi site hosting account needed repeatable remediation an assistant could run, in place of one off fixes.

## Questions

### What do you do first when a site is hacked?

Preserve evidence, identify the entry point, then clean. That order is what stops the same attack happening again next month.

### Why write a playbook instead of just fixing it?

Because it makes every future incident quicker and cheaper. Whoever handles the next one starts where the last clean up finished, with every step written down.

### What about spam pages already in Google?

Removing them is part of the clean up. Injected pages are cleared through search console as a step in the playbook, so your search presence recovers with the site.