Bringing someone in.
WHEN TO CONSIDER IT
You cannot find the entry point The compromise returns after cleaning Customer or payment data was involved The site is complex or business-critical You do not have the time or confidence
WHAT A PROFESSIONAL SHOULD DO
Identify the entry point Clean thoroughly Verify Advise on prevention
WHAT TO ASK BEFORE ENGAGING
What their process is Whether they identify the cause or only clean What they guarantee What happens if it returns
THAT SECOND POINT
A service that cleans without identifying the cause is selling you a repeat problem.
WHAT TO PROVIDE
Access What you know Your backups
WHAT TO BE WARY OF
Very cheap services that only run a scanner Anyone promising immediate results without investigation Unsolicited contact claiming your site is hacked
THAT LAST ONE
A common approach. Verify independently before responding.
WHAT TO DO AFTERWARDS
Change credentials again, including any you gave them.
