Establish what has changed
If a WordPress site serving customers in Austria starts sending visitors to unexpected pages, treat it as a possible incident rather than merely an SEO problem. Capture the time, affected URL, symptoms, recent deployment and hosting environment. Check the public result and the server-side files without exposing credentials or customer records.
CERT.at explains common signs of compromised websites, including hidden search spam, and recommends finding the entry point, checking for backdoors and restoring the site. Involve an incident specialist when the cause or scope is unclear.
Preserve evidence and contain access
Coordinate with the site owner before changing files or rotating credentials. Preserve relevant access and error logs, a copy of affected files and the timeline in a restricted location. Assess whether to isolate the workload or temporarily restrict administration based on the impact. Confirm who can approve the action and who communicates with customers or authorities if necessary.
Repair the entry point, not just the symptom
Inventory WordPress core, plugins, themes, administrator accounts, scheduled tasks, hosting users and deployment keys. Check for unsupported components, unexpected users, modified files and suspicious jobs. Remove an unsafe component only with a tested recovery plan: a plugin can also be a dependency of checkout or customer forms.
Restore from a verified clean backup where appropriate, rotate affected credentials through approved channels, and update the vulnerable software after checking compatibility. Search spam may return if the attacker’s access path remains open.
Verify and hand over
Test the site, login, forms, checkout and scheduled tasks; inspect logs after restoration. Ask for a written incident timeline, known gaps and an update plan. Clouvenix can scope server hardening as part of a remote support engagement. Local reporting or privacy decisions should be made with the customer’s responsible advisers.