Fixed price, agreed before work starts
From intake to a human reply
Detect before anything is touched
No silent changes, ever
Detect → Instant Shield → Patch → Shield
A fixed playbook, executed in order. Nothing moves without a human approving the change — and everything is reversible.
Find the attacker's trail
Read-only audit of the server: unpatched PHP versions, suspicious entries, unexpected cron jobs, renamed shells and upstream blocklists. Report only — no changes, no downtime, no scope creep.
Stop the bleeding within the hour
Stopgap mitigation while the trail is confirmed: block the malicious path, revoke compromised credentials, freeze at-risk entry points. A shield buys the hour for a safe patch — it is never a patch itself.
Fix the root cause
Pinned sury/ESM PHP upgrades staged one at a time, each smoke-tested against your app before the cut, with rollback staged before anything is applied.
Prove it, then keep it proved
Immutable off-site backups, IOC evidence pack and a plain-English fix report — so you can show your bank, insurer or auditor exactly what changed. Optional monthly Shield keeps the watch running.
Fixed scope. Fixed price. No "care plan".
Pay by card through the plan you choose. Every patch leaves an evidence pack and a restore-verified backup behind.
Emergency PHP Patch
£300 / one-off
Active incident remediation
- Detect: read-only audit of the attacker's trail
- Instant Shield: stopgap mitigation within the first hour
- Root cause patched: pinned sury/ESM PHP upgrade, staged and smoke-tested
- Restore-verified backup before any change is applied
- Plain-English fix report + IOC evidence pack
Managed Shield
£79 / month
Ongoing PHP watch
- Monthly patch-status check against the live fix tracker
- 48-hour post-patch watch on every change
- IOC sweeps for known PHP exploit families
- Human-approved changes only — never silent upgrades
- Cancel any time; no lock-in
IOC forensic triage is available as an add-on where the trail supports it — raise it on the intake.
Straight answers, before you send anything
How fast can you actually start?
Intake gets a human reply within the hour, 24/7. The first move is always read-only Detect work, so nothing about the response itself puts your traffic at risk.
Do you need my passwords or full root access?
Scoped, least-privilege SSH — and never a shared password. Temporary credentials are created for the engagement, used only by a human operator, and revoked right after the patch lands.
What if the patch breaks my application?
Every change is staged one step at a time and smoke-tested against your app before it's committed. Rollbacks are planned before the first change is applied — reversing is always cheaper than being clever.
Was anything backed up first?
A restore-verified backup is taken and proven restorable before any change is applied. If we can't prove the restore, we don't touch the server.
Am I locked into anything monthly?
No. Emergency PHP Patch is £300 one-off and Protected Shield (£79/month) is optional — it just keeps the watch running. Cancel any time; you keep every report, backup and evidence pack.
My site is already defaced or down — is that still your thing?
Yes. The intake covers it: containment first, then cleanup and root-cause patching. IOC forensic triage is available as an add-on where the attacker's trail supports it.
Describe what you're seeing. We reply within the hour.
Your report goes to a signed intake that pages the on-call engineer directly — it is not stored or resold anywhere.
Address
66 Hatton Garden, London EC1N 8LE, UK
Phone
+44 2082010490
info@wordaloud.com