The first 48 hours
Her site was down the day we started. We had it back that day, and clean the next.
On 2026-07-16, the day the contract was signed, her site was returning an error on every page. We fixed it that day. On 2026-07-17 we cleaned a live compromise: a rogue admin account, a gambling post, two malicious cron jobs and 498 dropper files, with eight security keys rotated and 7,763 PHP files swept. The report reached her the same day. Two more compromises followed on 2026-07-20, and we cleaned both.