How to Monitor Administrator and Plugin Changes After a Hack
Monitor privileged users, application passwords, plugin/theme installs and update events after WordPress recovery with actionable alerts.
Incident assessments openYour WordPress site has been hacked.
HACKED SITE RESCUE
Your WordPress site has been hacked.
Regain control before rebuilding trust.
Jordi Ensenyat assesses unknown administrators, stolen access, backdoors, malicious changes and websites no longer under trusted control. He defines the impact and likely cause first, provides a quote, and only intervenes after your approval.
Your request goes directly toJordi EnsenyatFounder of Code Barcelona · 15+ years with WordPress
- 15+
- years working
with WordPress - 01
- accountable specialist
from start to finish - ✓
- manual, documented
intervention
01 Preserve first02 Then diagnose03 Only then repair04 Always verify
THE SYMPTOM IS NOT THE DIAGNOSIS
Regaining control means understanding the whole journey.
The goal is not to make an error disappear for five minutes. It is to contain the incident, recover authorised access and remove persistence without erasing useful evidence.
Every case stays with one accountable specialist, with evidence before changes and real verification at close-out.
RESCUE SERVICES
Specialist work focused on the point of failure.
This is not a generic maintenance package. We examine the affected journey, its dependencies and the outcome that must work again.
01
↘
Incident containment
Focused diagnosis, the smallest supported change and verification of the affected journey.
Assess the case ↗02⌁
Access and account recovery
Focused diagnosis, the smallest supported change and verification of the affected journey.
Assess the case ↗03◎
Hacked WordPress restoration
Focused diagnosis, the smallest supported change and verification of the affected journey.
Assess the case ↗WP REPAIR PROTOCOL
Diagnosis, repair and evidence. In that order.
Urgency is not a reason to change a website without preserving a recovery route. This order protects your data and makes the result verifiable.
See the complete process ↗- 01
Safe assessment
You send the URL, visible symptom, recent changes and urgency. We do not ask for passwords in public.
DELIVERABLE · Initial scope and missing information - 02
Quote and approval
We review the case and explain the proposed intervention, dependencies, price and limits before starting.
DELIVERABLE · Clear quote before access - 03
Preservation and diagnosis
With secure access, we verify ownership, preserve a backup or rollback route and identify the real cause.
DELIVERABLE · Recovery point and diagnosis - 04
Repair, testing and report
We apply the smallest necessary change, test the affected journey and document the work and follow-up points.
DELIVERABLE · Verified website and close-out report
WHAT WE DO NOT DO
Trust also comes from being clear about the limits.
- We do not request passwords in public forms.
- We do not claim a diagnosis without reviewing evidence.
- We do not make risky changes without a backup or rollback route.
- We do not call a repair complete until it has been checked.
ACCOUNTABLE SPECIALISTJordi EnsenyatFounder of Code Barcelona
DIRECT RESPONSIBILITY
The person assessing the case remains accountable for the intervention.
No hand-offs between sales, support and development. The same technical responsibility follows the case from assessment to the final report.
Experience15+ years with WordPress
ModelManual service, case by case
FIND YOUR SYMPTOM
Guides and solutions by problem.
Content designed to help you make a safe decision, not to turn every keyword variation into an empty page.
QUESTIONS BEFORE YOU START
Clarity from the first contact.
How quickly will you respond?+
A person reviews every request according to its real urgency and current availability. While the green “Available now” status is shown, the first human response is sent quickly and you always receive a realistic timeframe for your specific case. We do not claim 24/7 coverage we cannot genuinely honour.
Do you need my passwords to assess the problem?+
No. The URL, visible symptoms, recent changes and exact error messages are usually enough for the initial assessment. Access is requested through a secure channel only after you approve the quote.
Do you start work before I approve the price?+
No. We first define the scope and present the quote. Technical work starts only after approval and once the necessary access is available.
What if the problem is larger than expected?+
We stop, explain the new evidence and agree any change in scope before continuing. An emergency never becomes open-ended hours without your approval.
Do you make a backup before repairing the site?+
Before any risky change we require a viable backup or an explicit recovery route. If the hosting setup or the site condition prevents this, we explain the risk before acting.
How will I know what was repaired?+
The close-out includes the cause found, changes applied, checks performed and relevant recommendations to reduce the chance of the same incident returning.
RESCUE JOURNAL
Diagnosis explained with judgement.
Read guide ↗
File-Change Alerts After Recovery: What Should Be Investigated?
Triage WordPress file-change alerts after recovery by path, owner, deployment, executable risk, recurrence and trusted package comparison.
Google Safe Browsing Review After Hacked-Site Recovery
Prepare a Google Safe Browsing security review after WordPress recovery by proving malicious content is removed and access paths are closed.
FIRST STEP
Describe the failure.
Jordi will review the journey.
Do not send passwords. The URL, visible symptom and recent changes are enough to begin the assessment.
Request an assessment ↗