1
Do not delete anything
The strange files are evidence of how they got in. Deleting them first destroys the trail and usually misses the backdoor they left behind.
Your site was hacked. First, stop the harm. Then recover properly.
Strange pages you never wrote. A warning from Google. Customers seeing redirects to somewhere else. If that is your morning, this page is the order of operations: what to do in the first hour, what real recovery involves, what it costs in writing, and the refund that stands behind it.
Run by a named operator: Valentin Iosif, KOLLAZ, in Ottawa, Ontario, Canada. Do not send us any passwords; use the report form and describe what you are seeing.
The full Rescue funnel, with the free evidence check form, lives at rescue.kollaztoolz.com. This page is the same offer in the KOLLAZ Software ledger, with the prices and the guarantee mechanics in full.
The first hour: what you can do right now
2
Change passwords from a clean device
Change your hosting and site passwords from a device you trust, not from a computer you suspect. Turn on two-factor sign-in where it is offered.
3
Tell your host
Most hosts can put the site into a holding state, and many keep clean backups from before the break-in. Ask what backups exist and their dates; do not restore one yet.
4
Warn anyone whose data may be involved
If your site takes payments or holds customer accounts, your obligations may include telling people. A short honest note beats silence.
5
Write down what you noticed, and when
Screenshots of the strange pages, the exact warning text, and the first date a customer reported trouble. This becomes the starting point of the recovery scope.
What recovery includes, and what it excludes
Included: evidence first
A free evidence check before any talk of cleaning: we look at your site the way your visitors and Google see it and write down what we find. The report is yours to keep whatever you decide. If the evidence shows your site is not hacked, the report says that too, and you owe nothing.
Included: the cleanup
A full backup before anything is touched. The malware, the spam pages and links, the fake accounts, and the hidden back doors all come out. The way in, usually an outdated plugin, a weak password, or exposed files, gets shut. Updates and settings are put right.
Included: the filings and the proof
If your domain landed on a public blocklist or carries a Google warning, we submit the reviews that get it cleared. You receive a proof report: what was found, what was removed, what was closed, in plain words, with a clean backup of your site.
Excluded, named plainly
A compromised database is a rebuild, not a cleanup; its exact price is named in the written scope before any work. Redesign, content work, and pre-existing breakage are not part of a cleanup. A big or complex site, such as a large store, is quoted flat in writing before any work; the quote is the price.
What it costs
Evidence check
The outside look, written in plain words.
Free
Full audit
The deeper look inside the site, once you give access. The full fee is credited toward your cleanup if you go ahead.
CA$75, credited
Founders Fifty cleanup
One hacked WordPress site, for the first 50 businesses. Paid in full before work begins.
CA$299 flat
Standard cleanup
The same cleanup after the first 50 are claimed.
CA$399 flat
The guarantee, mechanics in full
The refund trigger
If we cannot clean your site, your payment is refunded in full, automatically. No claim form, no argument about effort spent. You keep the evidence report, the backup, and a plain written note of what we found.
Who decides "cannot clean"
The proof standard decides: a site is clean when the injected material and back doors are removed, the way in is closed, and the verification checks pass. If we cannot reach that state, the refund fires; most standard sites are verified clean within 24 to 48 hours of access, and you judge the job by the proof report, not by the clock.
Hacked again within 90 days
If your site is hacked again within 90 days of a successful cleanup, we clean it again free.
The sequence protects you
Free evidence check first. Then you pay in full before we start. We clean, close, and file. You receive the proof report. Payment runs through the Rescue funnel; card details never pass through this site or email.
We reply within 1 business day. If your host offers an emergency holding state, use it while you wait.