Skip to content
Prospicience Consultancy
E09In production

A repeatable clean-up playbook for hacked websites

Group of WordPress sites

Prospicience cleaned several hacked WordPress sites on one hosting account and turned the work into an eight section playbook: malware types, clean up steps, bad patterns, database work and clearing spam from Google. An assistant follows it by driving the hosting control panel like a person, so the next incident starts from a proven routine.

SpeedCleaned and documented in one day

playbook sections
8
host automation available
none
backup before every change
yes
How it works
  1. 01

    Cleaned the infected sites and wrote the playbook along the way

  2. 02

    Built an assistant that follows the playbook by driving the...

  3. 03

    Recorded which tool suits which job

The gate

Configuration files are backed up before any change, and every step states what it expects to see before it moves on. If a site is not in the expected state, the assistant stops, so a live site is never put at risk by a guess.

The challenge

Several sites on one hosting account were hacked and serving spam, and the host offered no automation to clean them up.

Why it mattered

Hacked sites lose search ranking and visitor trust every day they stay infected, and reinfection is common. A one off rescue would have left the next incident starting from scratch, possibly with a different person at the keyboard.

What we built

  • Cleaned the infected sites and wrote the playbook along the way: malware types, clean up steps, file manager access, the site list, known bad patterns, database work and Google spam removal.
  • Built an assistant that follows the playbook by driving the hosting control panel the way a person would.
  • Recorded which tool suits which job, so each run starts where the last one ended.

The result

  • Infected sites cleaned, with configuration backed up before every change.
  • An eight section playbook anyone on the team can follow.
  • An assistant that repeats the clean up on a host with no automation of its own.
  • A written procedure for clearing spam pages from Google results.

Built for trust

Configuration files are backed up before any change, and every step states what it expects to see before it moves on. If a site is not in the expected state, the assistant stops, so a live site is never put at risk by a guess.

AI at work

An AI assistant works through the clean up playbook on the hosting control panel the way a person would, on a host that offers no automation of its own. It backs up configuration first and stops the moment a site is not in the state it expects.

What it produces

  • cleaned sites, with configuration backed up first
  • step by step runs of the eight section playbook
  • spam pages cleared from Google results
  • notes on which tool suits which job

How it works, day to day

When a site is hit, the assistant opens the hosting panel, backs up configuration and follows the playbook, checking each step's expected state before moving on. Anything it stops on goes back to a person to decide.

Where it saves time, and gets better with use

  • The next incident starts from a proven routine rather than from scratch, whoever is at the keyboard.
  • Each run records which tool suits which job, so the next one starts where the last ended.
  • Known bad patterns are written down, so every new infection is checked against what was found before.

The technology

  • A written playbook anyone on the team can follow
  • An assistant that works the hosting panel like a person
  • Notes on which tool suits which job, so the next run starts where the last ended
  • Backups before any change
  • Claude (Anthropic)
Technical notes
  • Eight section runbook: malware taxonomy, clean up procedure, file manager access, site inventory, bad configuration patterns, search console spam removal, database operations, tooling
  • Browser driven remediation where the host exposes no API
  • Configuration files backed up before modification, and every step states its expected precondition

Questions we get asked

Why write a playbook instead of just cleaning the sites?
Because reinfection is common, and the person cleaning up next time may not be the person who cleaned up this time. With a written playbook, the second incident costs a fraction of the first.
What if the host has no API?
The assistant drives the hosting control panel through the browser the way a person would. It works on any host, whether or not it offers automation.
How do you avoid breaking a live site during clean up?
Configuration files are backed up before any change, and every step declares what it expects to see before it proceeds. A step that does not recognise the state it is in stops rather than guessing.

Related systems

Have a process that should run itself? Let us build it.

Tell us the problem. We will show you what we would build, how fast we can ship it, and what it will deliver, from a first pilot to a full platform.

Book a consultationcontact@prospicience.in