Skip to content
Guides

Website security guides, step by step.

What I would do when something goes wrong with your website, written so you can follow it without being technical, with the commands for those who are. No fluff: if something is not a do-it-yourself fix, the guide tells you.

Last updated:

These guides come from the cases I see when I check and clean websites. Each one starts with what you can check yourself in a few minutes, goes on with what I would do in your place and ends by saying when it is worth asking for help, and from whom. They are grouped into five topics: the two platforms I work with most, online stores, the warnings that make you suspect a hack and the configuration that keeps you from getting there. If you do not know where to start, the free website security scan tells you in a few minutes which topic applies to you.

WordPress

Most of the hacked sites that reach me are WordPress, and almost always for the same reason: an outdated or abandoned plugin. Here are the signs to tell if your WordPress is hacked, what a security plugin really does, how to find plugins with published vulnerabilities even when the dashboard does not warn you, how to stop brute-force attacks and xmlrpc.php, how to set up backups that actually work and what to do about the Japanese keyword hack. The service is on WordPress security.

PrestaShop

In PrestaShop the way in is usually a third-party module with a published flaw, and what does the most damage is what you cannot see: a modified override or a script at checkout. I explain what to do if your PrestaShop is hacked, how to check your vulnerable modules, what to do about the critical ps_facetedsearch flaw, the filter module almost every store has, and how to upgrade PrestaShop without breaking the cart. The service is on PrestaShop security.

Online stores and payments

A store has two problems a business website does not: the checkout and customer data. The guides on credit card skimming, fake WooCommerce orders and data breaches and the GDPR explain how they are detected, what to do in the first hours and what to notify. If your store is on Shopify, what depends on you is in Shopify security.

Google and browser warnings

A hack is often discovered through a warning: Chrome's red screen, Google's «This site may be hacked», the «Not secure» label in the address bar or a domain on a blacklist. Each one means something different. Start with Google says my site is dangerous, Chrome «Not secure» warning, domain blacklisted and my website redirects to another site. If you already know someone got in, the order of work is in recover a hacked website.

Configuration, maintenance and AI

What prevents the scares: no exposed files (backups, .env, .git or logs that anyone can download), HTTP security headers, knowing how much website maintenance costs and what it should include, setting up SPF, DKIM and DMARC so your emails do not land in spam or get spoofed, and deciding what AI assistants do with your content, with llms.txt and robots.txt. And when a serious security advisory comes out, like PHP2Shell, the PHP vulnerability of October 2026, how to tell if it affects you and what to update.

If you have been hacked

  1. 01SymptomsMy website redirects to another site: what's going onWhy your website redirects visitors to spam or gambling sites but never you, how to reproduce it with curl and where to look: .htaccess, database, JavaScript.
  2. 02Hacked websiteMy website was hacked: how to recover it step by stepMy website was hacked, what do I do? The first hour, what to save before cleaning, passwords, backups, the Google review and when to get help.
  3. 03DiagnosisHow to tell if your website is hacked or has malwareHow to tell if your website is hacked or has malware, whatever the CMS: signs for visitors, in Google and in email, plus free checks you can run today.
  4. 04LiabilityMy website was hacked: is the web host, the agency or me responsible?Who is responsible when your website or store is hacked: you, your web host or your agency. What the GDPR says, what to check in contracts and what to ask.

Google and browser warnings

  1. 05GoogleHow to remove Google's “dangerous site” warning, step by step“This site may be hacked”, “Deceptive site ahead” or a malware warning: what each Google warning means and how to remove it in Search Console, step by step.
  2. 06HTTPSWebsite says “Not secure” in Chrome: causes and how to fix itWhy Chrome says your website is not secure (no HTTPS, expired certificate, mixed content) and how to check and fix it on WordPress and PrestaShop.
  3. 07BlacklistsMy domain is blacklisted: how to get it removedHow to check if your domain is blacklisted (Google Safe Browsing, Spamhaus and others), why it happens, how to request removal and how to protect your email.

WordPress

  1. 08WordPressHow to tell if your WordPress site is hackedTen signs your WordPress site is hacked, why the owner almost never sees them and how to check each one, with WP-CLI commands if you use the command line.
  2. 09WordPressWordfence, Sucuri or Solid Security: which to choose (and when it isn't enough)Wordfence vs Sucuri, Solid Security (Kadence Security), MalCare and Jetpack: what each does free and paid, which to choose and what none of them does.
  3. 10WordPressHow to back up WordPress (and restore it)How to back up WordPress with a plugin, from your hosting or with WP-CLI, where to store it, how to restore it and what to do if your backups are infected.
  4. 11WordPressJapanese keyword hack on WordPress: how to remove it from GoogleHow to spot the Japanese keyword hack on WordPress, clean it from your site and from Google with Search Console (removals, sitemap, review) and keep it away.
  5. 12WordPressVulnerable WordPress plugins: how to check yours for security flawsHow to check your WordPress plugins and themes for published vulnerabilities, why an updated site still gets hacked, and what to do with a plugin with no fix.
  6. 13WordPressWordPress brute-force attacks: wp-login.php, xmlrpc.php and how to stop themWhat brute-force attacks on wp-login.php and xmlrpc.php are, how to spot them in your logs, when to disable XML-RPC and how to protect logins with 2FA.

PrestaShop

  1. 14PrestaShopPrestaShop store hacked: what to do in the first hourWhat to do if your PrestaShop store is hacked: stop the skimmer, commands to find modified files, check ps_configuration and hooks, real CVEs and the GDPR.
  2. 15PrestaShopUpgrading PrestaShop (1.7 → 8 → 9) without breaking the storeHow to upgrade PrestaShop from 1.7 to 8 and from 8 to 9: PHP per version, modules and overrides, Update Assistant or manual, staging and a rollback plan.
  3. 16PrestaShopVulnerable PrestaShop modules: known CVEs and fixed versionsList of vulnerable PrestaShop modules: CVEs, affected and fixed versions, core security advisories and a step-by-step security audit of your own store.
  4. 17PrestaShop 1.7Is it safe to stay on PrestaShop 1.7 in 2026?PrestaShop 1.7 in 2026: since when it gets no patches, which published flaws affect it, the PHP 7.4 problem and what to do if your store is still on 1.7.
  5. 18PrestaShop security advisoryps_facetedsearch (CVE-2026-54159): how to tell if your PrestaShop store is affectedCVE-2026-54159 in ps_facetedsearch, PrestaShop's faceted search filters: affected versions, how to check yours, what to update to, and what to do on 1.7.

Online stores and payments

  1. 19Online storesCredit card skimmer on your website: how to detect itHow credit card skimmers work on WooCommerce and PrestaShop checkouts, where they hide, why owners miss them and what to do if you suspect one.
  2. 20GDPRData breach in your online store: what to do in 72 hoursCustomer data stolen from your online store? When to notify under GDPR Articles 33 and 34, what to tell customers and the technical report you need.
  3. 21WooCommerceWooCommerce fake orders: how to stop card testing attacksHow to spot a card testing attack on WooCommerce, what it risks with Stripe or your bank, and how to stop it: rate limiting, CAPTCHA and payment settings.
  4. 22ShopifyShopify security: what Shopify doesn't protect for youShopify store security: staff accounts and 2FA, apps and their permissions, theme code, third-party scripts and pixels. What to check and how to do it.

Configuration, maintenance and AI

  1. 23PricingHow much does website maintenance cost in 2026?How much website maintenance costs in 2026: typical monthly ranges for small business sites and stores, WordPress pricing, what raises the fee and what to ask.
  2. 24AI agentsllms.txt: what it is, what it's for and how to check yoursWhat llms.txt is, how it differs from robots.txt, how to write it on WordPress, PrestaShop or Shopify, and which AI bots to block in robots.txt or let in.
  3. 25ConfigurationHTTP security headers: what they are and how to check themWhat HSTS, Content Security Policy, X-Frame-Options, nosniff, Referrer-Policy and Permissions-Policy do, how to add them and run a security headers check.
  4. 26Domain emailSPF, DKIM and DMARC: how to set them up, step by stepWhat SPF, DKIM and DMARC do, how to check yours, how to set them up step by step, and how to go from p=none to p=reject without losing legitimate email.
  5. 27PHP security advisoryPHP2Shell (CVE-2026-109618 and CVE-2026-109619): what it is and how to tell if your website is affectedPHP2Shell (CVE-2026-109618 and CVE-2026-109619): affected versions, how to check yours and what to do if you can't update PHP on an older website.
  6. 28ConfigurationExposed files on your website: .env, .git, backups and logsWhich files on your website anyone can download (.env, .git, .sql backups, debug.log or PrestaShop var/logs), how to check for them and how to block them.

Is your website intact? Check it now.

Free external scan. No sign-up and nothing to install.

Get the PDF result and 30-day alerts (optional)

Data protection. Controller: Jose Soriano Castro. Purpose: to send you the diagnostic PDF, email you for 30 days if a security flaw affecting your site is published (with a follow-up scan on day 30) and reply in writing to your question; offers only if you tick that box. Legal basis: your consent. Recipients: nobody, unless required by law. You can unsubscribe at any time with the link in every email or by writing to me. Rights: access, rectification, erasure, objection, restriction and portability. Privacy policy.

  • No FTP access
  • Read-only
  • No customer data

Cookie preferences