Armor SOS
Armor SOS is emergency cleanup for hacked websites, run by Tremhost engineers who clean compromised Zimbabwean sites weekly. We contain the attack, take a forensic copy, remove the malicious code and the backdoors the attacker left behind, reset every credential, get you off Google’s and email blocklists, and write up exactly what happened — wherever your site is hosted.
What’s probably happening right now
Before you call anyone: don’t delete files, don’t restore an old backup, and don’t change passwords yet. Deleting destroys the evidence of how they got in, and restoring a backup usually restores the backdoor along with it. Leave it exactly as it is and message us.
If the attack exposed personal data, Zimbabwe’s data protection regulations require you to report it to POTRAZ within 24 hours of becoming aware of it. Our preserved logs and written report tell you what was accessed and when, which is what that report needs.
We clean these up across our own fleet every week, so nothing you’re about to describe will surprise us:
01 Gambling pages in your search results
02 Your mail is being blocked everywhere
03 The site is defaced or just gone
| What we do, in order | |
|---|---|
| Everything below is included at one price. No setup fee, no per-incident invoice, no surprise line items. | |
| Contain first - cut the attacker's access before anything else | hour one |
| Preserve the logs before they roll over and the evidence is gone | hour one |
| Remove injected pages, shells and backdoors; all of them, not the obvious ones | day one |
| Reset every credential the attacker could have taken | day one |
| Get you delisted from Google Safe Browsing and mail blacklists | day one to three |
| Written report: what happened, how they got in, what we changed | on completion |
| Hardening so the same route closes permanently | on completion |
| A follow-up scan two weeks later, at no charge | two weeks later |
| Included at no charge on Armor Shield | every time |
| It costs less than buying it direct | ||
|---|---|---|
| Emergency incident work is normally billed by the hour, negotiated while your site is down, and capped at whatever you'll agree to at 11pm. | ||
| What you want | Direct price | Tremhost |
| Emergency cleanup, one-off | hourly, negotiated in a crisis | quoted after free triage |
| Same site, on Armor Shield | — | $0, every time |
| Written incident report | usually extra | included |
| Follow-up scan | rarely offered | included |
| Hardening so it doesn't recur | separate engagement | included |
| Free on Shield | At $29 a month, Shield costs less than a single cleanup, which is why most clients who call us once end up on it afterwards. | |
| Cloudflare list prices from cloudflare.com/plans. We are a Cloudflare partner and buy at wholesale across thousands of accounts, that is the whole reason we can charge less than you would pay going direct. | ||
