We return each file to the state its publisher releases.
An attacker modified thirty files across the core, your extensions and your theme. His thirty modifications vanish at once — including those no signature would have seen, since we are not looking for them.
A refit, as it unfolds
round of 14 August · wordpress 7.0.4
restoredwp-includes/class-wp-query.php
altered since our last pass · restored identical to the publisher's, re-checked afterwards
leftwp-includes/class-wp-error.php
already diverged when you arrived · we have never seen it in its published state
Both outcomes occur in the same passage: a tool that restored both would erase the fix you had applied by hand.
Its strength lies in its restraint.
Writing to a merchant's server is the most dangerous act this product knows how to perform. Five rules govern it, and none of them is an intention: they are proven on a real disk, with real files.
It rewrites only what the publisher releases
The content comes from the CMS vendor or the plugin's official package, and its fingerprint is verified BEFORE writing. Without an official original, nothing is written: the file is left in place and named. We never guess any content.
Any file set aside remains recoverable
A file whose only purpose is malicious is moved to quarantine, not deleted. It can be put back in one click. And a file missing from the vendor's package is not removed: we restore, we never tidy up on your behalf.
Every action can be undone
The original is backed up before being replaced, and the written file is re-read afterwards. Three outcomes are reported, never flattened into "done or not done": proven, rolled back, or unproven — because the effect could not be observed.
At the first sign of breakage, the whole batch is rolled back
Your site's health is re-checked at every batch. If it stops responding, the original state is restored automatically and the operation stops there. We don't move forward on a site that has just gone down.
A graft in YOUR code is removed on its own
A backdoor appended to the end of your custom theme is excised precisely, and the rest of the file remains intact. The excision is refused as soon as its boundary leaves the slightest doubt: a graft in the middle of the code, a missing block closure, content in between, a file too large to be read in one piece. Surgery whose limits can't be defined isn't surgery.
What belongs to you stays intact
Configuration, content, media, caches, your child theme's files: they are never rewritten, even when they diverge. They are yours, and the vendor publishes no official version of them.
We restore what we've seen change
With Watch, the first comparison against your vendors' files flags what was already diverging already the day you sign up. We name it for you, and we don't touch it: one of those files may carry a fix you applied by hand.
From then on, everything that changes is restored. You can ask us to handle the original divergences too — once, after reading the list. We don't offer it at sign-up: on that day, neither you nor we yet know which files are involved.
A site that is already compromised when it arrives calls for a full analysis. It is the analysis, not the monitoring, that produces the signed finding a host demands before restoring a suspended site.
Restore is added to a product
It can't run on its own: the list of files to restore is derived from an analysis, and without it we wouldn't know what to replace them with. This isn't a business rule — it's what the analysis does, and it refuses to write without a report signed by us.
Record + Restore
"Fix it."
199 €
The full analysis, then the fix, then the new analysis that turns the finding into a certificate of recovery. One purchase, one operation.
Watch + Restore
"And bring it back into compliance on its own."
199 €
one year — one-time payment, no auto-renewal
Every night, whatever has changed under our watch is restored without you — and you receive the report on it, successes, rollbacks and uncertainties included.
How many files on your site can justify their presence?
You'll get the exact number, every file named, and the means to prove it to someone else.