Emergency help · Root servers
Your server has been hacked?
Then every hour counts. We preserve the evidence first, lock the attacker out and close the hole they came in through. The first call is free, the work that follows is a fixed price.
This requires root access to the server. If all you have is a shared hosting plan, your host is the one who can act — and we will tell you that in the first call rather than sell you something.
It is happening right now
Get in touch now.
Two sentences are enough: what happened, and what notice did you receive? Request a callback or use the form — both reach us directly.
- First call free, around 30 minutes
- Fixed price agreed before we start
- No night, weekend or holiday surcharge
We get back to you as fast as we can, usually the same day. We do not promise a response time to the minute — a guaranteed four hours only comes with the standby retainer further down, and that is exactly where it says so.
Before we even speak
The first thirty minutes decide the rest.
Most of the damage we see is not caused by the break-in but by the clean-up afterwards. Four things to do straight away — and four to leave well alone.
Do now
-
Take the server off the network, do not power it down
A firewall rule or your data centre’s rescue system locks the attacker out. A reboot or shutdown, by contrast, wipes everything that only exists in memory: running processes, open connections, decrypted credentials.
-
Copy the logs away immediately
Server logs rotate daily and are deleted after a few weeks. If the break-in happened before the last rotation, the decisive line already sits in a different file. Copy the entire log directory somewhere safe before anything else happens.
-
Freeze your backups
Most backups rotate and overwrite themselves after seven or fourteen days. The snapshot from just before the break-in is the most valuable thing you have. Take it out of rotation while it still exists.
-
Write down what you saw
Time of the first anomaly, the exact wording of the data centre notice, and what you have done since. Those five lines save us an hour of searching later — an hour you would otherwise pay for.
Leave alone
-
Do not rebuild yet
A freshly installed server feels clean but answers no question at all: how did they get in, what did they take, will the same hole be in the next system? Rebuilding without an answer often earns you a second visit.
-
Do not delete anything
Suspicious files are evidence. Their timestamps, owner and contents point the way to the entry point. Once deleted, the search starts from zero.
-
Do not change passwords yet
While the attacker is still inside, they read the new password too — and you have warned them. Credentials get rotated once they are out, and then all at once.
-
Do not work from the affected machine
No email through that server, no credentials typed into it, no remote session opened on the suspect machine. Use a different device and a different account.
Already rebuilt or deleted something? Not a disaster, but tell us. It changes where we look — and it changes our assessment of what can still be proven and what cannot.
The one requirement
Without root access we are the wrong people.
A break-in happens below the website: in system processes, cron jobs, services, user permissions and logs. Only someone with administrative rights on the server can reach any of that. On an ordinary shared hosting plan nobody has those rights except your host — and then your host is the right address. Calling them costs you nothing. Charging you to do what you could do yourself over FTP would not be honest.
| What you have | Who can help |
|---|---|
| Root server, VPS or dedicated server — with or without Plesk, cPanel or similar | Us. This is exactly our case. |
| Managed server where you hold root rights | Us — after a quick word with your provider so nobody gets in the way. |
| Shared hosting without system access (FTP and database only) | Your host for the server. We can still clean the affected website. |
| Site builder or hosted CMS (Wix, Squarespace, Shopify, WordPress.com) | The provider. There is no server to reach in the first place. |
Not sure which of these applies to you? We settle that in five minutes in the first call, and we do not charge for it — not even when the answer is “not us”.
How it runs
Our sequence
Always in this order. Cleaning up before the evidence is secured is the single most common mistake — after that, nothing can be proven any more.
First call
Around 30 minutes, free. What did you notice, what notice arrived, what have you already done? It ends with an honest assessment — including the version where you do not need us.
Preserve evidence
Logs including the already rotated ones, running processes, open network connections, file timestamps, scheduled tasks. Everything gets copied and set aside before anything is changed.
Lock the attacker out
Kill malicious processes, remove every foothold — cron jobs, system services, autostart entries — block addresses, take affected applications offline. From here on nothing new gets in.
Close the entry point
The most important step and the one budget providers skip: how did they get in? Outdated application, guessed password, exposed service, stolen key? Only once that is answered do we clean, update and harden.
Report & follow-up
A report in plain language: what happened, how they got in, what demonstrably left the server and what we changed. Then four weeks of automated follow-up checks so a missed remnant does not quietly restart.
A case from our own practice · August 2026
A client server, eight hours unnoticed.
The trigger was a load alert from the data centre: CPU above 75 per cent. On twelve cores the load stood at 17.7. What looked like a performance problem was a break-in that was, by then, already seven hours old. The sequence, with the timestamps from the logs:
-
02:07:19
Entry
A CRM application on a client domain accepts requests at its login page. One gets through, everything after that errors out. The installation was two minor versions behind the update that had closed exactly this hole in March.
-
02:07:38
Back door
Nineteen seconds later two PHP files sit on the server, named like a harmless data export. Both execute whatever is handed to them through the address bar.
-
02:07:50
Function test
A single command that does nothing but print the current user id. The attacker checks whether the back door holds. Then seven hours of silence.
-
09:15:24
Payload
A script from a foreign server pulls in a crypto miner and anchors it three times over: as a cron job every three minutes, at system start, and as a user service of its own. Killing the process buys you three minutes.
-
10:13:28
Data access
First a sweep for credentials across every website on the server, then one targeted database export: 138 kilobytes of configuration values. The query itself was in the logs — which is why we could prove, not merely hope, that no customer records were included.
-
from 11:00
Handover
Evidence preserved, miner stopped, all three footholds removed, four addresses blocked, the affected application taken offline. By that afternoon the server was clean and the cause documented.
Three things that decided this case
The decisive line was in the rotated log
The logs rotated at 06:47; the break-in was at 02:07. Read only the current file and you never find the entry point — you clean the symptom instead. Which is why we secure first and read afterwards.
The file date was a trap
The miner carried 17 June as its modification date, the loader scripts carried the day of the break-in. An unpacked archive keeps the attacker’s timestamps — the date on the malware is its build date, not the moment of intrusion. That trail leads two months in the wrong direction.
Permission separation held
The miner ran as the website user, not as the system administrator. The attacker’s sweep across the other sites on the server yielded five kilobytes. That is precisely what separating permissions is for — beforehand, not afterwards.
The part that also belongs in the story
A commercial malware scanner was running on that server. It neither prevented nor reported the attack. Anyone telling you a product alone stops this is selling you a feeling. The break-in surfaced because somebody followed up on a load alert.
What was built afterwards
A watcher for new files — with judgement
The first version flagged every new PHP file and produced fifteen false alarms in a single night; one plugin update is enough. Today it only fires when user input and an execution call appear in the same file. Tested against the real back door (caught) and against 400 plugin files (not one false alarm).
Miner detection via nice load
Crypto miners run at lowered priority to stay inconspicuous. The alert measures exactly that share across all cores, averaged over ten minutes. One process on one of twelve cores stays below it; a real miner occupies them all.
Hourly follow-up checks
A check on the hour, mail only when something looks off. It runs on the server itself and therefore does not depend on anyone watching.
These watchers are not a one-off; they are part of our server monitoring.
What it costs
The fixed price is agreed before we start. No meter running in the background while you already have enough to worry about.
The incident is live and has to be stopped first. Everything after that you decide with a clear picture in hand.
- Evidence preserved before anything is changed
- Malicious processes stopped, footholds removed
- Attacker locked out, addresses blocked
- Damage picture: what is affected, what is not
- Situation report with a recommendation
Clean the system and shut the door they came in through. This is the part that stops it happening again.
- Everything from the emergency response (up to 4 hrs)
- Malicious code fully removed, not just the miner
- Entry point identified and closed
- Hardening: accounts, permissions, services, updates
- All credentials and keys rotated
- Removal from Google and other blocklists
- Final report and four weeks of follow-up checks
If the attacker held system rights or was inside for too long, patching is the more expensive option. Then we build fresh alongside.
- Emergency response included (up to 4 hrs)
- New server, cleanly installed and hardened
- Data migrated after inspection, not copied blindly
- Websites and mailboxes moved across
- Old server archived as evidence
- Three months of monitoring included
All prices net, excl. VAT. Anything beyond the fixed price is billed in 15-minute increments at the emergency rate — and we say so beforehand, not on the invoice.
Hourly rate and standby
Two numbers no emergency page should hide — and which, in our experience, take three clicks to find anywhere else.
For anything beyond the fixed price, billed in 15-minute increments. The going market rate is €200 to €324 — plus surcharges on top. With us it is one rate, including nights, weekends and public holidays. A break-in at three in the morning is not a special request from the client.
Beforehand rather than afterwards: we know your server, hold the credentials and guarantee a response within four hours, seven days a week. The hourly rate drops to €140 during a call-out. Included if you host with us or are on a monitoring plan.
By the way: no price here is set in stone.
Budget and package don't quite match? Talk to us and we'll find a fair deal. We especially like supporting founders and young businesses, for example with a lower project price combined with hosting or ongoing care.
What this costs elsewhere
Researched on 27 Aug 2026. The market splits into three segments that have little to do with one another — lump them together and you are comparing hourly rates with total loss figures.
Cleaning a single website
€145 – €500 per incident
WordPress specialists, fixed price, usually without server access. That is enough when only one installation is affected — and not enough when the server itself stands open.
Surveyed at: tortuga-security.de, wpfuchs.de, forge12.com, sixhop.net
Server call-out with root access
€200 – €324 per hour
Hourly rates from €100 at small providers to well over €250 at large consultancies, clustering around €200. Night and weekend surcharges are the norm. This is where we sit.
Our rate €170 per hour
Surveyed at: notdienst.seo-manager.info, terruhn.it, cybairbag.de
Enterprise incident response
€5,000 – €60,000 per incident
Forensics firms with retainers, court-admissible evidence handling and regulatory support. A single incident runs into five figures and up.
Surveyed at: cybairbag.de, it-forensik.de, aroundsec.com
The figures come from publicly listed prices and published articles by the providers named. We deliberately do not link them — some are competitors, and the name is enough to check.
What you need somebody else for
We are a small agency with server experience, not a forensics institute. We would rather draw that line now than halfway through a call-out.
Court-admissible evidence
If your insurer or a prosecutor needs an expert report that stands up in court, the case belongs with a certified forensic examiner. We preserve the evidence so that work stays possible — and hand over cleanly.
Encrypted systems (ransomware)
Live extortion with encrypted data is about negotiation, decryption and reporting obligations. That is a profession of its own. We help contain and rebuild, not with the rest.
Reporting duties and legal advice
Whether an incident has to be reported to the data protection authority within 72 hours, or falls under NIS-2, is for your data protection officer and your lawyer to decide. We supply the technical facts, not legal advice.
Questions that come up in an emergency
How do I even tell that my server has been hacked?
The most common signs are an abuse or load notice from the data centre, sudden high CPU usage with no obvious cause, outgoing spam, a Google blocklist warning in the browser, unknown user accounts or cron jobs, and files with modification dates you cannot account for. A crypto miner is the most common case because it shows up immediately on the data centre bill.
Should I simply rebuild the server?
Not as the first move. A freshly installed server is clean, but you will not know how the attacker got in. If it was an outdated application, a weak password or a stolen key, the hole is usually right back after the rebuild. Establish the cause first, then decide — and rebuilding is often the right answer afterwards, just with knowledge instead of guesswork.
What does help with a hacked server cost?
The emergency response is €690 net as a fixed price for up to four hours: preserve evidence, lock the attacker out, damage picture, situation report. A full clean-up with hardening starts at €1,590 net, a rebuild with migration at €2,990 net. Anything beyond that is billed at €190 net per hour, with no night or weekend surcharge. The first call is free.
How quickly can you start?
We get back to you as fast as we can, usually the same day, and start once you give the go-ahead. A guaranteed response within four hours comes with the emergency standby at €49 a month — which you take out beforehand, not in the middle of an incident.
I do not have root access. Can you still help?
Not for the server itself — only your host can reach processes, services and system logs there. We can still clean the affected website without root if you have FTP and database access. Tell us in the first call what you booked and we will place it for you.
What do you need from me to start?
Root access or an account that can be raised to it, the contact details of your data centre, the notice you received, and a short account of what you have done yourself since the discovery. That last point matters more than it sounds.
Can you guarantee it will not happen again?
No, and anyone who promises that should make you suspicious. We can close the entry point we proved, harden the system and put monitoring in place that flags the next attempt early. Absolute security does not exist for a server connected to the internet.
Do I have to report the incident?
Possibly. If personal data is affected and there is a risk to the people concerned, the GDPR requires notification of the supervisory authority within 72 hours. Whether that applies in your case is for your data protection officer or your lawyer to decide. We supply the technical basis: what demonstrably left the server and what did not.
The sooner we look, the less there is to repair.
Tell us briefly what happened. The first call costs nothing and may well end with us telling you who to call instead.