Three questions. Then the clock starts.

Site defaced or replacedSomeone else's content on your pages Google warning"This site may be hacked" or a red warning screen Redirecting visitorsSite sends people to spam or scam pages Spam pages in search resultsPharma, casino or foreign-language results for your domain Customers report fraud or strange emailsPhishing sent from your domain, fake invoices Ransom or threat receivedA demand from someone claiming to have your data Locked out of adminPasswords changed, accounts missing Something is wrong, not sure whatSlow, strange files, hosting warnings

Hosting + admin accessControl panel, SFTP/SSH, or CMS admin Some accessAdmin but not hosting, or vice versa No access at allLocked out — we'll recover it through your host with you

Standard Rescue — $4,450 AUDResponse < 1 hour · verified clean < 24 hours Enterprise Incident — scopedMulti-server, e-commerce or card-data — we scope in writing first