Hacked sites and security
I clean up a hacked site, find out how they got in and close the hole. Then I keep it updated so it doesn't happen again.
The signs
A hacked site usually gives itself away with something odd: Google lists pages in Japanese under your domain, the browser warns that the site is dangerous, the hosting company suspends the account, your emails end up in spam.
What I do
- I save a copy of the site as it is, to work out what happened, and take it offline if needed.
- I compare the files with the original WordPress or Joomla and plugin files, and remove the ones that were added.
- I search the database for admin users and code that shouldn't be there.
- I find out how they got in: usually an old plugin or a stolen password.
- I change passwords and keys, update everything and ask Google to remove the warning, if there is one.
So it doesn't happen again
On WordPress nearly all published vulnerabilities are in plugins, and the update comes out before the attack. With maintenance I do the updates, and SitePing flags versions that no longer get security fixes, changed files and admin logins.
Problems I often solve
Hacked WordPress site: what to do right now
Google shows pages in Japanese, the browser says the site is dangerous, or the host has suspended the account. Here are the first steps to take straight away, and how I clean the site up and close the hole they came in through.
NIS2 in Italy: the technical side of servers, sites and software
Italy's NIS2 decree asks for multi-factor authentication, tested backups, inventories and monitoring, with the documents to prove it. I handle the technical side on servers, websites and business software; risk analysis and the ACN paperwork stay with your consultant.
Cyber Resilience Act: if you sell software or connected products
Since 11 September 2026, anyone selling software or connected products must report exploited flaws within 24 hours, and all obligations apply from 11 December 2027. I get components, updates and vulnerability handling in order.
Reporting a cyberattack within 24 hours in Switzerland
Since 1 April 2025, Swiss critical infrastructure operators must report cyberattacks to the federal cybersecurity office within 24 hours, and since October 2025 fines reach CHF 100,000. I prepare servers, websites and business software so 24 hours is enough.
Cyber Resilience Act: if your Swiss company exports to the EU
Switzerland has no similar law yet, but the Cyber Resilience Act covers every digital product sold in the EU, even one made in Lugano. I set up the component list, vulnerability checks and update channel.
Italy's cloud and cybersecurity voucher: what it covers
From 10 November 2026, Italian SMEs and freelancers can claim a 50% grant, up to EUR 20,000, for cloud and security. Only listed suppliers count, and I'm not one: I help you work out what you need and connect what you buy to the rest.