Hacked? Banned by Google?
We find out what happened — and prove it.
Vidal Forensics investigates compromised WordPress sites the disciplined way: evidence sealed with hashes before anything is touched, a timeline rebuilt by rules + AI, and a plain-English report signed by a human. Then we clean it and help you get un-banned.
Two kinds of forensic work
One watches your site before anything happens. The other rescues you after it does. Both run on the same discipline: preserve first, conclude second.
🕵️ The Watchman
Our sensor lives inside your WordPress before any incident, recording a tamper-evident black box: file hashes, admin events, changes — sealed as they happen.
- If you're ever hit, the investigation is fast and complete — the entry point is already on record
- Priority case handling + incident report at half price
- Monthly watch summary in plain English
🚨 The Rescue
No subscription, site already down or banned? Our field kit works from outside — it never boots your infected WordPress — and our first-hours protocol rescues whatever evidence still exists.
- Scene sealed (full copy + hashes) before any cleanup
- Hosting logs rescued before they rotate away
- Full report, cleanup, and Google review request support
How an emergency case works
No chaos, no guessing. The same six steps, every case, each one logged in your chain-of-custody record.
Consent & case opened
You sign the authorization, we open your numbered case. Nothing runs without it — the kit literally requires your case code.
The golden hour
Full site copy sealed with hashes and hosting logs rescued before anything is cleaned. This copy is both the evidence and your safety net.
Investigation
Field kit + rule engine + AI rebuild the timeline: how they got in, what they touched, what they took — and what they didn't.
Signed report
Plain-English findings, signed by a human: entry vector, persistence, data exposure, and exactly what we recommend.
Cleanup & hardening
Rebuilt from clean sources, backdoors removed, every credential rotated — then double-scanned on the way out.
Un-ban & close
We support your Google review request with the report attached. Case closes, access destroyed, evidence retained 90 days, then deleted on record.
Pricing
Free detects. The Guardian protects. Alert watches and keeps the evidence ready. Emergency pays for the rescue only when disaster already struck.
🆓 Forensic Check
- Compromise verdict: Clean · Suspicious · Compromised
- Altered core files, rogue admins, injected files
- Black-box change watch
🛡️ AI Guardian
- Bruno, our AI guardian, on watch 24/7
- Smart blocking & daily rounds
- Urgent alerts
⭐ Forensics Alert
- Everything in AI Guardian
- Deep black box: continuous hash-sealed evidence
- Incident report at 50% off
- Priority incident investigation
- Monthly watch summary
🚨 Emergency
- Diagnosis paid up front, credited on cleanup
- Full investigation + signed report
- Cleanup & Google review support
Straight answers
Can you guarantee Google will un-ban my site?
No — and anyone who guarantees that is lying to you. Google decides, typically within 1–3 days of a review request. What we guarantee is a genuinely clean site and a serious, documented case for the review: what was found, what was removed, what was hardened.
Was my customers' data stolen?
That's exactly what the investigation determines: whether attackers only got in, or also got data out — and precisely which tables they touched. One calming fact: payment cards are almost never stored in WordPress; your processor (Stripe, Square) holds those.
My site was hacked weeks ago. Is it too late?
Not necessarily — but hosting logs usually survive only 7–14 days, so every day reduces what can be proven. Start the case now; the first thing we do is rescue whatever logs remain.
Do you need my passwords?
Only through the secure form tied to your signed case, only for the duration of the work, and they are destroyed at close. After any hack, all credentials must rotate — that's part of our cleanup checklist, not an upsell.
I don't have your plugin. Can you still investigate?
Yes — that's what Emergency is for. The field kit works from outside without your plugin. Sites with Forensics Alert simply start with a complete black box already recorded, which makes their investigation faster and more certain.