Skip to content
Client area

Website hacked? Get it cleaned, off Google's warning list and protected

If your site shows a “Dangerous site” warning, redirects visitors or fills search results with pages you never wrote, every day costs you customers and reputation. Armor SOS triages it free the same working day, tells you what happened and what the fix costs, then cleans it, requests the delisting and puts a firewall in front of it.

Get my hacked site triaged freeWhat to do in the next ten minutes

Free triage, Monday to Friday, 08:00 to 17:00. Works on any host. Cleanup quoted before any work starts.

yourbusiness.co.zwArmor SOS incidentTriage
  • Report received on WhatsAppTriage started
  • 412 spam pages injected into /wp-contentFound
  • Backdoor in an old pluginFound
  • Google Safe BrowsingWarning
  • Cleanup quote sentSame day
  • Cleaned, patched, review requestedClear
Illustration with example findings, in the order a typical incident runs.
  • 4.6 out of 5 from Google Reviews
  • 13,000+ domains on Tremhost infrastructure
  • Cloudflare partner, signed 2026
  • Harare team, human support

Signs your website has been hacked

Any one of these is enough for a free triage. Attackers often hide the damage from logged-in owners, so if a customer reports it, believe them.

  • Google or the browser shows "Dangerous site" or "Deceptive site ahead"Visitors are being warned away before they reach you.
  • Search results show pages you never wrote: gambling, pharmacy, loansInjected spam pages, often thousands, ranking on your domain.
  • Visitors on phones get redirected somewhere elseA redirect that often hides from you when you are logged in.
  • Your host suspended the account or your email bouncesThe site or a mailbox has been sending spam or attacking others.
  • New admin users, files you didn't upload, or the site is defacedSomeone has a way in, and probably more than one.

What to do in the next ten minutes

These steps protect you whether or not you use us.

  1. Don't delete the site or restore a random backupYou can restore the infection with it, and you lose the evidence of how they got in.
  2. Change passwords from a clean deviceHosting or cPanel, WordPress admins, FTP, database and email. Start with the hosting login.
  3. Download a copy of the site as it isFiles and database. We work from it, and you have something if anything goes wrong.
  4. Message us with the domain and what you seeA screenshot of the warning or the strange page helps. Triage starts from there.
Send my domain for free triage

From a warning page to a clean, protected site

Cleaning the visible damage is the easy part. Sites get reinfected when the way in stays open and nobody asks Google to look again.

While it stays hacked

  • Visitors see a red warning and leave before they reach you
  • Search results fill with spam pages on your domain
  • Your host may suspend the account; email starts bouncing
  • The attacker can still reach your forms, files and users

After Armor SOS

  • A written finding: what was changed and how they got in
  • Files, database and users cleaned; the entry point closed
  • Review requested with Google and the blacklists that flagged you
  • A firewall in front of the site so the same attack is blocked

How Armor SOS works

You see the finding and the price before any paid work starts.

  1. Triage

    Free, the same working day

    We confirm whether it is hacked, find what was changed and check Google Safe Browsing and the main blacklists. You get a written finding and a cleanup quote.

  2. Clean

    After you accept the quote

    Malicious files, injected pages, rogue users and backdoors removed; the database checked; the hole they came in through patched or the plugin replaced.

  3. Delist

    Once the site is clean

    Review requests to Google and the blacklists that flagged you, so the warnings come off. Google decides the timing, not us.

  4. Protect

    So it doesn't come back

    Cloudflare in front of the site with rules set by us: Armor Guard for a brochure site, Armor Shield if the site takes payments.

What waiting costs you

If a warning page or a redirect stops enquiries reaching you, the loss adds up by the day. The starting values are only an example; put in your own.

Lost while it stays hacked
$1,400
Each day
$200
Compared with a cleanup
About 14 times a one-time cleanup at $98

Reference price: Sucuri's one-time cleanup for one site, $98, checked 1 November 2026 at sucuri.net. Our cleanup is quoted after the free triage.

What you get

Each line says what it changes for you.

  • Free triage with a written findingYou know what happened and what it costs to fix before you spend anything.
  • Cleanup of files, database and usersThe spam pages, redirects and rogue admins go, not just the symptom you noticed.
  • The entry point found and closedCleaning without patching the hole is how sites get reinfected within a week.
  • Google and blacklist review requestsThe red warning comes off once Google re-checks, and your email stops bouncing.
  • Works on any hostHosted with us, with another Zimbabwean host or overseas: we work through your cPanel, FTP or admin access.
  • Protection afterwards, if you want itArmor Shield includes future cleanups and delisting, so the next incident is not another invoice.

Trusted by businesses since 2016

4.6out of 5, from 30 Google reviews

Source: Tremhost's Google Business Profile. Read all reviews on Google

These guys have the best support and customer service, they are always available for support, I highly recommend.

Ed Chitambo, Google review

Tremhost provides excellent all-around service as well as speedy customer support. I strongly recommend them.

Russel Jhamba, Google review

Great company for sites. I have been working with these guys for years. Keep up

Promie, Google review

  • CILT Zimbabwe

    Professional institute, Harare

    Membership, events and the WiLAT community on one site that Tremhost has run since 2021.

    Read the story

  • Buildware

    Decorative panels and cabinet hardware, Harare

    A client since 2017: a product catalogue with WhatsApp quotation requests and SEO built around trade terms.

    Read the story

  • Specialist Junior School

    Private primary school, Ruwa

    A school website parents use and pupils publish on, with an events calendar for term dates and fixtures.

    Read the story

Questions people actually ask

Still unsure? Ask us on WhatsApp or book a call.

How much does it cost to clean a hacked website?

Triage is free. The cleanup is quoted after triage, because a single injected file and a site with backdoors in every plugin are very different jobs. For a reference point, Sucuri, a US security company, charges $98 for a one-time cleanup of one site. On Armor Shield, cleanup and delisting are included in the monthly price.

How fast can you start?

Triage starts the same working day: Monday to Friday, 08:00 to 17:00 in Harare. Outside those hours, open a support ticket marked urgent and it is the first thing picked up.

My site isn't hosted with Tremhost. Can you still help?

Yes. Armor SOS works on any host. We need access to the hosting control panel, FTP or the site admin, and we tell you exactly what access and why.

How do I know my website has been hacked?

The common signs are a browser or Google warning, search results showing pages you never wrote, visitors on phones being redirected, your host suspending the account, email bouncing, or admin users and files you didn't create. Any one of these is worth a free triage.

Will Google remove the "Dangerous site" warning?

Once the site is clean, we request a review. Google re-checks the site and removes the warning if it finds nothing; Google sets that timing, not us. We tell you when the request is in and when it clears.

Can I just restore a backup?

Sometimes, but backups are often taken after the attacker got in, so restoring brings the backdoor back. Triage tells you whether a clean backup exists and when it was taken.

Why did it happen, and will it happen again?

Most compromises we see come through outdated plugins and themes, reused or stolen passwords, and nulled (pirated) plugins. The cleanup closes the hole you were attacked through; keeping it closed means updates and a firewall in front of the site.

What happens to my data and my customers' data?

We tell you what the attacker could reach. If personal information was exposed, Zimbabwe's Cyber and Data Protection Act requires the data controller to notify POTRAZ within 24 hours of becoming aware of the breach. We help you document what happened, but this is not legal advice.

Keep it from happening again

A cleaned site with the same weak spots gets hit again. These close them.

Find out what happened, free, today

Send us the domain and what you are seeing. You get a written finding and a cleanup price before any paid work starts.

Get my hacked site triaged freeOut of hours? Open an urgent ticket
Get my hacked site triaged free