Security

Contain it, preserve evidence, find how they got in, then rebuild from clean sources and rotate every credential. The order matters, and skipping a step is how sites get reinfected.

Seeing “Sorry, you are not allowed to access this page”, lost your admin role, your password, your 2FA device or tripped a security lockout? Get back in from the server, safely.

The block editor says “Updating failed” or “Publishing failed” because the REST API returned something other than JSON. Find what answered instead: a firewall, a redirect, a 404 or a PHP notice.

Google shows Japanese, pharmacy or casino pages under your domain that you never wrote. Find the cloaked spam, remove it at the source, then get the junk URLs dropped from Google.

Visitors land on a scam, dating or fake prize site, often only on mobile, only from Google or only once. Reproduce the conditional redirect, then remove it from the database, files or CDN.

Browsers show a red warning before your site loads. Confirm which blocklist flagged you, find the phishing kit or malware behind it, then get reviewed by Google and the other vendors.

Your host suspended the account over malware, phishing or outgoing spam. Decode the abuse notice, find the mailer script or stolen mailbox, clean every site on the account and get reinstated.

You cleaned the site and the malware came back. Something survived: a backdoor, hidden admin, cron job, stolen password or unpatched plugin. Find it and prove the site is clean.

HSTS removes the “proceed anyway” link, so any certificate fault locks visitors out. Learn how the header works, how to clear it for testing, and how to roll it out safely.

CPU pegged and pages crawling, but no real traffic spike? Read your access logs to find the bots, verify fake Googlebots, and rate limit or block them at the right layer.

Bounces mention Spamhaus, Barracuda or “blocked using”? Learn how DNS blocklists work, how to check them by hand, and how to fix the cause before you request removal.

A 403 means something refused the request on purpose. Read the headers and body to find which layer sent it, then fix that layer without switching off security.