Protecting businesses in every province and territory
Experiencing a breach? Get help now
Website and application security
A hacked website costs sales and search rankings. We clean infections within 24 hours, block attacks with a web application firewall and watch your site around the clock.
CONSOLEDemo tenantSOC online00:00:00 ET3MTWeb / WAF
Web traffic
Requests 24 h
1.82 M
Blocked
41,906
Origin uptime
100%
Blocked by type
Blocked, live
Certified partner of
Why this cannot wait
Hacked right now?
The first steps are about keeping evidence and locking the attacker out. Cleaning comes after. Restoring last month’s backup does not fix it: the backdoor may be in the backup, and the vulnerable plugin is still there.
Before anyone starts cleaning
01
Do not delete files or restore an old backup yet
You will likely destroy evidence and leave the attacker’s way in open.
02
Take a full copy of the site and database
That copy is the evidence if customer data is involved or your insurer asks questions.
03
Change passwords from a clean device
Hosting, CMS and database passwords first.
04
Call us, any hour
If customer data may be involved, also consider your privacy reporting obligations.
Most hacked sites are cleaned within 24 hours. If the same site is reinfected within 30 days, we clean it again at no charge.
If the attacker also reached Microsoft 365 or your internal network, we move into full incident response.
Tick each one that is true for your site. Nothing is sent anywhere.
Overview
Protecting public websites, online stores, customer portals and web applications from attack, and repairing them when an attack succeeds.
For many Canadian SMBs, the website is the most exposed system they own. It sits on the public internet all day, often runs software nobody has updated since launch, and is managed by a web agency that may not do security at all.
Platform
Includes: WordPress, Shopify, Magento or a custom application
We do: CMS core kept current, admin logins protected with MFA
Hosting
Includes: Hosting account, database, FTP and API access
We do: Credentials rotated after any incident, off-site versioned backups
Code and plugins
Includes: Plugins, themes and your own code
We do: Patching, abandoned plugins removed, testing for custom code
Traffic coming in
Includes: Visitors, bots, login attempts and floods
We do: Web application firewall and DDoS protection through a CDN
Scripts in the browser
Includes: What runs on your pages and checkout
We do: Checks for injected scripts, checkout script monitoring
A Kelowna winery
Worried about the kind of hack that quietly redirects mobile visitors to scam sites for weeks before a customer mentions it.
A Toronto law firm
A WordPress site, eleven plugins and an admin password shared between two former marketing coordinators.
A Moncton retailer
Takes card payments on a self-hosted checkout and needs to meet PCI DSS.
A software company
Runs a customer portal that holds client personal information.
Lower risk: a simple brochure page on a fully managed platform with no logins and no forms. Keep it updated, use MFA on the admin account and do not overspend.
Hacked site repair
Removing the spam pages you can see is the easy part. Behind the signs, the attacker has usually left more behind.
Got in through an outdated plugin or theme, or with a stolen or guessed admin password.
Planted a backdoor so they can return even after you change passwords.
Added spam, phishing pages or redirects often shown only to some visitors, so you do not notice.
On stores, injected a skimming script that copies card details as customers type them.
Contain and preserve
A full copy of files, database and logs before anything changes.
Find the entry point
Plugin, credentials, hosting account or something else. Cleaning without this step is how sites get reinfected within days.
Clean thoroughly
Malware, backdoors, malicious users, scheduled tasks, injected database content and rogue scripts removed. Where faster and safer, we rebuild from clean sources.
Rotate everything
Hosting, CMS, database, FTP and API credentials. Admin accounts reviewed.
Request blocklist removal
Once verified clean, review requests go to Google Safe Browsing and other relevant blocklists.
Harden and protect
The protection described below goes in, so it does not happen again.
CONSOLEDemo tenantSOC online00:00:00 ET3MTWeb / Cleanup
Hacked site cleanup
maplecrest.ca cleanup
WordPress 6.6 · 4,812 files scanned · entry: outdated form plugin
Google Safe Browsing
Dangerous siteNo unsafe contentReinfection is common when cleanup stops at the visible symptoms. Every cleanup ends with:
Shared or forgotten logins are a frequent cause, which is why access held by agencies and former staff is part of the review.
Day-to-day protection
Five controls, each aimed at a different way sites get hurt. Whether you came to us after a hack or before one, this is what keeps the site clean.
Usually delivered through a content delivery network. It filters known attack patterns before they reach your server, and the same network absorbs floods that would knock a small hosting plan offline.
Helps stop
Valid certificates, automatic renewal, modern protocol settings and HTTPS everywhere. An expired certificate on a Friday evening is an avoidable outage.
Helps stop
CMS core, plugins and themes kept current. Abandoned plugins removed. Admin logins protected with MFA, limited to the people who need them and, where possible, restricted by location.
Helps stop
Uptime checks, file integrity monitoring, checks for injected scripts on key pages, certificate expiry alerts and blocklist monitoring. Analysts review anything unusual rather than forwarding raw alerts.
Helps stop
Off-site, versioned and tested, so a clean restore is possible when you need one.
Helps stop
CONSOLEDemo tenantSOC online00:00:00 ET3MTWeb / Site health
Site health
maplecrest.ca
Was D in August
Uptime · last 30 days
99.97%
Blocklists
Clean on 8 of 8
File integrity
No changes
Checkout scripts
4 approved
By site type
Pick the closest match. A checkout page, a client portal and a five-page brochure site carry very different risks and need different spending.
Card-skimming attacks (often called Magecart-style attacks) inject JavaScript into checkout pages to steal card details as customers type. PCI DSS version 4.0.1, whose newer requirements became mandatory on March 31, 2025, includes controls for managing scripts on payment pages and detecting unauthorized changes.
Using a hosted payment page reduces your scope considerably, but the page that loads it still needs protecting.
What we focus on
Custom applications and APIs need more than a WAF. They need secure code review and testing. A customer portal that holds client personal information also brings privacy obligations if it is breached.
A WAF reduces risk but does not replace patching and secure code.
What we focus on
Automated tools scan the internet for outdated WordPress plugins, weak admin passwords and known flaws, then compromise whatever they find. Nobody has to choose your site. A hacked business site is typically used to host phishing pages, send spam or redirect visitors to scams.
Many of these sites run software nobody has updated since launch and are managed by a web agency that may not do security at all.
What we focus on
If your site is a simple brochure page on a fully managed platform with no logins and no forms, your risk is lower.
Do not overspend. We will tell you on the scoping call if this is you.
What we focus on
How the engagement runs
A hacked site and a healthy site start differently and end up in the same place: protected and monitored.
01
Assess or triage
02
Clean and fix
03
Protect
Put the WAF, DDoS protection, TLS, hardening and backups in place.
04
Monitor
Ongoing uptime, integrity and blocklist monitoring, with patching tracked and reported.
Questions worth asking anyone you consider, with our answers.
Every Cyberphore employee is certified
Canada and cost
If the hack exposed customer accounts, order history or form submissions
It may be a breach of security safeguards under PIPEDA.
If there is a real risk of significant harm
It is reportable to the Office of the Privacy Commissioner of Canada, and affected people must be notified. Breach records are kept for 24 months.
If you operate in Quebec or Alberta
Quebec’s Law 25 and Alberta’s PIPA have their own requirements.
If card data was compromised
That also triggers obligations to your payment processor.
Evidence preserved before cleanup helps establish what was accessed. See privacy compliance.
General information, not legal advice.
FAQ
Do not just delete the suspicious files or restore an old backup and move on. You will likely destroy evidence and leave the attacker's way in open. Take a full copy of the site and database, change hosting, CMS and database passwords from a clean device, and contact us. If customer data may be involved, consider your privacy reporting obligations.
Google Safe Browsing and other blocklists remove warnings after the site is verified clean. That means removing all malware and backdoors, fixing the vulnerability that let the attacker in, and requesting a review through Google Search Console and any other listing services. Requesting review before the site is truly clean usually fails and delays removal.
Yes, constantly, and usually not because anyone chose them. Automated tools scan the internet for outdated WordPress plugins, weak admin passwords and known flaws, then compromise whatever they find. A hacked small business site is typically used to host phishing pages, send spam, redirect visitors to scams or skim card data from checkout pages.
A web application firewall (WAF) sits in front of your website and inspects incoming requests, blocking common attacks such as SQL injection, cross-site scripting, malicious bots and brute force login attempts. Many are delivered through a content delivery network, which can also absorb DDoS traffic. A WAF reduces risk but does not replace patching and secure code.
If you accept card payments, your payment processor or acquiring bank will expect PCI DSS compliance, usually validated through a self-assessment questionnaire for smaller merchants. Using a hosted payment page reduces your scope considerably, but current requirements still expect you to protect the pages that load the payment form against script tampering. Your processor can confirm which questionnaire applies.
It can be. If the attacker accessed personal information such as customer accounts, order details or contact form submissions, and there is a real risk of significant harm, PIPEDA requires reporting to the Office of the Privacy Commissioner and notifying affected people. Quebec and Alberta have their own rules. This is general information, not legal advice.
Get started
A free scoping call with a certified specialist. We look at what you run and tell you plainly what it needs, including when that is less than you expected.