Security incidents.
ESTABLISH FIRST
What did they notice? When? What have they already done?
WHAT TO CHECK
Whether the site redirects or shows unexpected content Whether files were recently modified Whether unknown administrator accounts exist Whether spam is being sent Malware scan results
WHAT TO DO IMMEDIATELY
Take a backup of the current state Change credentials Consider taking the site offline if it is harming visitors
WHAT TO TELL US
If spam is being sent from the account, immediately.
Server blacklisting affects other clients.
WHAT TO EXPLAIN TO THE CLIENT
What appears to have happened What you are doing
What they must do: change passwords from a clean computer
Whether cleanup is included or chargeable
THAT LAST POINT
Establish it before doing hours of work.
WHAT TO EMPHASISE
That the entry point must be found, or it recurs.
WHAT TO CHECK BEFORE CLOSING
Cron jobs, for persistence That the site is clean from outside That updates are applied
WHEN TO ESCALATE
Anything affecting other accounts, or that you cannot resolve.
