Hacked websites
Analysis, cleanup, recovery, plugin review, backup and actions that reduce the risk of the same incident happening again.
SecuureIT / 3on Security
Secure systems for companies that can’t afford downtime.
We combine incident response, hacked website recovery, ongoing website service and security agreements, and secure system architecture built in from day one.
Security layer · visual preview
Intrusion detected. System secured.
The original 3on effect is back as an illustrated incident flow for analysis, isolation, backup and hardening. It is a visual simulation of the workflow, not a scan of your device.
3on / secuureitincident sequence · preview
INTRUSION DETECTED
- AUTH / edge request verifiedok
- CORE / files checkedok
- MALWARE / suspicious pattern isolatedisolated
- BACKUP / restore point confirmedok
- HEADERS / policy hardenedok
- STATUS / secureok
Threat isolated · illustrated sequence complete
What we secure
From urgent recovery to ongoing security ownership.
Service & security agreements
Ongoing updates, security checks, backups, recovery readiness, a priority incident path and one clear technical owner.
WordPress & hosting
Hardened configuration, separated environments, WAF/Cloudflare, logging, updates, backup strategy and a reduced attack surface.
Secure web apps
Roles, server-side APIs, secure forms, validation, file uploads, admin protection and clear permission levels.
Anonymised response case
Two websites recovered after weaknesses had been exploited over an extended period.
Large client in the workshop sector.
Following a compromise, we recovered two affected websites. The work did not stop when the sites were back online: we investigated root causes, identified weaknesses that had been available to attackers over an extended period, removed remaining risks and hardened the environments.
The client identity and details that could increase the attack surface are not published. The operating principle is simple: recover first, understand the path in, remove persistence, harden afterwards.
Security Lab
We document what can be shared safely.
Some incidents can be published with detailed methodology and metrics. Client incidents usually require anonymisation. Security Lab covers both without exposing customer information or useful attack details.
View Security Lab →Ongoing protection
A security agreement should reduce both risk and time to recovery.
Patch & update
Controlled updates of WordPress, plugins, themes and dependencies with compatibility and security in mind.
Checks & logs
Recurring review of security signals, unusual traffic, vulnerabilities and changes that require action.
Backup & restore
A backup strategy and recovery path designed before an incident happens, not after the site is already down.
Priority incident path
An established contact and known technical context allow analysis and recovery to begin faster when something happens.
Practical security
What happens before, during and after an incident.
The older security pages contained useful detail about backup, malware, WordPress and recovery. It is collected here again, with a clearer line between urgent help and preventive work.
If something already looks wrong
Change as little as possible
Do not mass-update plugins or delete files before the current state, logs and backups have been secured.
Preserve evidence and access
Note errors, timing and recent changes. Check who has admin, hosting and domain access.
Isolate and prioritise
Stop harmful flows, secure a recovery point and then choose cleanup, restore or rebuild.
Security Check
What a Security Check can review
The exact scope depends on the platform and incident, but a first review can cover the full chain below.
Backup and recovery
Is there a working, external and testable copy of the website and database?
Users and permissions
Admin roles, passwords, 2FA, API keys and old accounts.
Plugins, themes and dependencies
Known risks, abandoned extensions, version conflicts and unnecessary attack surface.
Malware, spam and changed files
Suspicious processes, redirects, scripts, form abuse and file changes.
Hosting, logs and protection
Server environment, Cloudflare, headers, rate limits, cache and relevant logs.
Post-fix plan
What needs monitoring, updating and documenting to reduce future risk.
Action plan
A security plan people can use when something happens.
The plan must be short enough to find under pressure and concrete enough to guide the first hour. The structure below summarises practical elements from NCSC’s small-business guidance and CERT-SE’s incident process for websites and smaller digital environments.
This is 3on’s practical summary, not an authority-issued template or legal advice. The incident, organisational responsibilities and any reporting duty must be assessed separately.Map what the business cannot operate without
List domain, DNS, hosting, website, email, payments, customer data, administrators and critical suppliers. Add an owner and contact route for each item.
Decide when an outage becomes serious
Assess impact after four hours, one day and one week. This makes it clearer what must be restored first and what can wait.
Set a preventive baseline
Document ownership for security updates, MFA, permissions, external backups, recovery tests and removal of old accounts and components.
Create a fallback for operations and communication
Decide on an alternative contact route, who can change DNS or disable functions and how customers are informed if the website, email or payments are unavailable.
Write a first-hour incident card
Record what happened, when it was detected, who leads, what was isolated and which logs must be preserved. Include hosting, 3on, insurance and CERT-SE contacts where relevant.
Start
Three common ways to start
Start at the right level instead of buying a large security package on guesswork.
Security Check
Review of backup, access, plugins, malware signals, hosting and the most urgent risks.
From SEK 3,500 excl. VATWordPress Rescue
For a slow, broken or hacked WordPress site where the current state must be secured before rebuilding.
From SEK 3,500 excl. VATSecurity Care
Ongoing updates, backup checks, hardening and a clear routine for websites that need to stay operational.
Scoped to the environmentPrices are starting points, not fixed quotes. Urgent incidents may need a short initial diagnosis before scope can be assessed.
Process
From risk signal to controlled response
Secure the current state
Backup, access, logs and a clear incident picture before larger changes.
Analyse and respond
Find the root cause, clean or restore and verify critical flows.
Harden and follow up
Reduce attack surface, document changes and add sensible monitoring.
Bring in senior capacity
Ownership when you need it. No premature full-time hire.
For owner-led and mid-sized companies that need an experienced digital counterpart, temporary leadership or someone who can both prioritise and deliver.
Technology + digital
Fractional CTO / external IT lead
Roadmap, systems, vendors, programmes, risk and hands-on digital development supporting the CEO and leadership.
See technology setupMarketing + growthFractional or interim CMO
Positioning, web, SEO, AI search, campaigns, measurement, team and vendors in one prioritised plan.
See marketing setupSenior specialistAdvisor, programme lead or second opinion
Support for the CEO, marketing lead or project owner when an important decision or digital initiative needs senior breadth.
See technical partnerHow we work
What can be inspected builds trust.
Verified reviews should be traceable to a source. Here are the principles you can assess during a 3on engagement.
LinkedInClear start
Goals, ownership, risks and the first delivery are defined before a larger build.
Visible work
Priorities and next steps can be followed without the client chasing status.
Ownable delivery
Code, data, content and decisions are documented so the solution can be maintained.
Honest follow-up
What works is measured. What creates no value is removed or redesigned.
FAQ
Security FAQ
Can 3on help with a hacked WordPress site?
Yes. 3on can analyze, clean and secure hacked WordPress environments, including backup, restore, plugin review and improved hosting structure.
Can you take ongoing responsibility for website security?
Yes. We offer website service and security agreements covering updates, security checks, backups, recovery readiness, a priority incident path and ongoing technical improvements.
Do you only work with WordPress security?
No. We also work with secure systems, web apps, APIs, hosting structure, permissions, form protection, Cloudflare and technical architecture.
Can you build security into new systems from day one?
Yes. New systems can be built with secure authentication, roles, server-side APIs, logging, validation, file handling and a clear separation between public frontend and admin features.
Can security be combined with AI and automation?
Yes. We can build flows for monitoring, alerts, lead protection, form protection, spam filtering and internal incident routines.