A customer tells you your store is redirecting to an unknown site. Or your advertising account has just been suspended for “malicious software”. What you do in the next hour weighs heavily on two things: how long you stay down, and how likely the problem is to return two weeks later.
The first mistake: cleaning immediately
The natural reflex is to delete whatever looks suspicious and reinstall a clean version. It is the most expensive mistake available to you. Cleaning before analysing erases the elements needed to identify how the attacker got in. Without that, the cleanup does not hold: the door stays open.
This explains something we see often — sites “already cleaned” by a previous team that get reinfected in under two days. The visible code had been removed; the way in was still there.
The second: powering the server off
Shutting down protects your visitors, but destroys part of the information needed for analysis. There are ways to make a site inaccessible to the public while preserving what will explain the incident. That is a trade-off to make deliberately, not in a panic.
What you can usefully do right now
Three actions carry no risk and save valuable time. First, gather the facts: since when has the problem been reported, by whom, on what kind of device, and what changed recently on the site — an update, a new module, an external intervention.
Then list everyone who holds access: staff, agency, occasional developer, maintenance provider, former employee. On stores that are a few years old, this list almost always holds surprises, and it is a serious lead.
Finally, check that you have a recent and above all verified backup — one you know actually restores. That factor, more than any other, determines how long the outage lasts.
Why WooCommerce is so heavily targeted
It is not a question of inherent fragility but of surface area: it is the most widespread e-commerce platform in the world, with a very large ecosystem of plugins and themes. Attacks are largely automated and hunt for known vulnerabilities in components that have not been updated. In other words, you were not personally targeted — which changes nothing about the consequences.
The damage that is not on the server
A compromise always spills beyond the technical. You need to handle in parallel the security warning appearing in browsers and search results, the possible suspension of your advertising campaigns, and the question of customer data — if personal data may have been exposed, notification obligations apply, with short deadlines.
Each of these follows its own rules and requires remediation evidence in a specific format. Handled poorly, they end in a refusal that stretches out the whole timeline.
When can a site be declared clean?
Not on the day of the cleanup. A site is clean when a full subsequent verification finds nothing, and when monitoring has run for several weeks without raising anything. Before that observation period, you have a hypothesis, not a certainty — and that is exactly where the difference lies between an incident that is closed and one that starts again.