Establish what happened and organise the repair.

Describe what you have seen

Report redirects, warnings, new pages, altered files or access problems. Include when they appeared and what has already been done, particularly by the hosting provider.

Keep the available evidence. If the website appears to expose data or carry out unwanted actions, the host can help consider temporary access restrictions while the situation is examined.

Agree access and the intervention

The initial scope identifies the WordPress installation, available backups, authorised access and any dependencies on the wider hosting account. Depending on the symptoms, the review may include core files, extensions, the theme and the database.

Availability and timing are confirmed before engagement. This is not a promise of round-the-clock incident response.

Address the cause as well as the visible symptom

1. Record: preserve useful information and establish the initial state.
2. Investigate: identify changes and the area that can be examined.
3. Repair: clean or replace the agreed components and review affected access.
4. Check: verify the pages, administration and critical functions in scope.

If the cause cannot be established within the original scope, we explain what remains uncertain before proceeding.

Plan what happens after the repair

The handover separates completed work from further measures. Updates, access, backups and maintenance responsibilities need a practical owner after the incident.

Related French resources cover prevention, extension choices and backups: Guide complet sécurisation WordPress 2025; Choisir la bonne extension sécurité; Sauvegardes WordPress : bonnes pratiques.

Define the completion checks

The proposal specifies what will be examined, repaired and verified. Removing a technical problem does not automatically remove a warning in Google or a security service; those services have their own review processes.

You receive the findings and recommendations needed to continue looking after the website.