Effective date & who these terms apply to

These Terms apply to all PHP2Shell services sold via www.wordaloud.com (WordAloud, UK). Effective date: 8 November 2026 (version 1).

What each product is

Emergency PHP Patch — £300 one-off. A read-only Detect pass of the attack trail, a stopgap mitigation within the first hour, root-cause patching (PHP upgrade or configuration), a restore-verified backup before any change is applied, and a plain-English fix report with an IOC evidence pack.

Managed Shield — £79/month. Monthly patch-status checks against the live fix tracker, a 48-hour post-patch watch on every change, IOC sweeps for known PHP exploit families, and human-approved changes only — never silent upgrades. Cancel any time, no lock-in.

Forensic Sweep — add-on, quoted per engagement. A forensic timeline of the incident, an IOC sweep proving every trace found is dead at sweep time, and a claim-ready documentation pack (incident summary, timeline, IOC evidence list, log-excerpt index, remedial actions, SHA-256 manifest, PII note) written to the standard insurers and banks request. Preliminary findings within 24 hours of instruction to proceed; the full pack within five working days.

Claims & recovery

WordAloud documents findings and remedial actions. Claim acceptance rests entirely with your insurer or bank. We make no promise that any insurer will pay any claim, and nothing on this site or in our reports is a claim guarantee.

Sweep scope boundaries

Sweeps are advisory. They do not include memory forensics, expert-witness or court testimony, or litigation support. A sweep verdict is accurate at sweep time only; later re-compromise or cleanup is quoted and delivered as separate work.

Charges, VAT & refunds

Prices are shown exclusive of VAT. Where VAT applies, it is added at checkout based on your billing location; receipts show the VAT breakdown. One-off services are non-refundable once work has started. Shield subscriptions cancel at the end of the billing period with no lock-in.

Engagement & response

We acknowledge intake contact within the hour during UK office hours. Sweep turnarounds are governed by the Forensic Sweep clause above. Work requires your written authorisation to access the named server; each access is per-domain and logged.

Privacy & data

We process only the data necessary to the service. Forensic artifacts containing personal data are redacted from your copies and retained per the documented schedule, then erased on schedule — or earlier, on your written request. "Processor" is used in its UK GDPR sense.

Governing law

These Terms are governed by the laws of England and Wales, and the courts of England and Wales have jurisdiction over any dispute.