Website and app security: scan, fix and monitor for PHP, WordPress, Node.js and Java
Find out what is exposed in your website or app, get it fixed, and keep it protected. I scan your PHP, WordPress, Node.js or Java application and its server for weak spots and for what hackers leave behind, such as backdoors, malware and trojans. I fix what I find, prove it with a retest and give you a plain-English report.
- Free first check
- Plain-English report
- Only sites you own
- NDA on request
How websites and apps usually get in trouble
Most break-ins use known weaknesses that were never patched, not clever new tricks. These are the four I check first.
Outdated runtimes
PHP, Node.js and Java versions that no longer receive security fixes, or fixes that were never installed. PHP 8.2 security support ends on 31 December 2026.
Vulnerable plugins and packages
WordPress plugins, Composer, npm and Maven packages with known flaws, including poisoned packages in the npm supply chain.
Misconfiguration
Exposed .env and .git files, open database ports, admin tools left public, debug mode switched on and no firewall.
Weak access
Password guessing on logins and SSH, no lockout, no two-step sign-in, and one shared account running every site.
What happens when a website is hacked
Most hacks follow the same six steps, and for the first few you cannot see anything wrong. Here is the story from the hacker's side and from yours.
Finds your site
A bot scans the internet, finds your site and reads your PHP, WordPress and plugin versions.Breaks in
Uses a known flaw in an outdated plugin or PHP version, or guesses a weak password.Plants a backdoor
Uploads a hidden file (a webshell) so it can come back even after you patch the flaw.Takes over
Adds a secret admin user, schedules hidden jobs and reads your config and database passwords.Cashes in
Steals customer data, injects spam links, mines coins, sends phishing emails or locks your files.You find out
Google warns your visitors, your host suspends the site, or a customer complains.For the first steps there is nothing to see, which is why hacks often go unnoticed for days or weeks. Scanning early finds the backdoor before the damage in step 5.
Threats I look for and remove
A plain-English guide to what actually happens to websites and servers, and what I do about each one.
| Threat | What it means | How I find it and deal with it |
|---|---|---|
| Backdoors and webshells | A hidden file or login that lets a hacker walk back in after you thought the problem was fixed, and run commands on your server. | I look for unknown or recently changed code files, compare WordPress and framework files with clean copies, check upload folders for scripts, and review users, scheduled jobs and SSH keys. Then I remove them and close the way in. |
| Malware and trojans | Harmful code disguised as something harmless, such as a fake plugin, theme or package, that steals data or takes control of your site. | Malware scan plus an audit of plugins and packages against known bad ones. Infected files are removed or replaced with clean originals. |
| Spam and hidden link injection | Hackers add hidden links, fake pages or redirects that get your site flagged by Google or send visitors elsewhere. | I scan files and the database for injected links, pages and redirects, clean them out and help you ask Google to review the site. |
| SQL injection and cross-site scripting | Attackers type code into your forms or web addresses to read your database or attack your visitors. | Review of key forms and queries, fixes for vulnerable packages and plugins, safer input handling and firewall rules. |
| Cryptominers and botnets | Your server is used to mine coins or attack other sites, which slows everything down and can get your hosting suspended. | I check running processes, scheduled jobs and unusual load, remove the intruders and block their return. |
| Ransomware | Your files are locked or deleted and you are asked to pay to get them back. | Prevention: tested off-site backups, tight file permissions and separate accounts, so one weak spot cannot reach everything. |
| Fake login and phishing pages | A copy of a bank or login page planted on your domain to trick people into typing their passwords. | I scan for pages and forms that do not belong to your site, remove them and find out how they were uploaded. |
| Password guessing (brute force) | Bots try thousands of passwords against your website login, admin area and server. | Login lockout, automatic blocking of repeat offenders, two-step sign-in and rate limits. |
Signs your site may already be hacked
If you notice any of these, run the free check or ask for an emergency cleanup.
- Google or your browser shows a "this site may be hacked" or "deceptive site" warning.
- Visitors are sent to strange websites, or you see pages and links you did not create.
- There are admin users you do not recognise, or files you did not upload.
- The site suddenly became slow, or your hosting company suspended it for high usage.
- Spam emails are being sent from your domain, or your emails land in spam.
- Your search results show odd titles, foreign-language text or pharmacy and casino keywords.
How I clean and secure a hacked site
Five steps from "something is wrong" to "it is fixed, and it cannot happen the same way again".
Contain
Block the attacker, take a safe copy of everything as evidence, and put the site in safe mode if needed.
The attack stops spreadingHunt
Search files, the database, users, scheduled jobs and SSH keys for backdoors, webshells and malware.
A list of everything plantedClean
Remove it, restore clean core files from trusted copies, and change every password, key and token.
A clean siteClose the hole
Patch or upgrade the outdated PHP, plugin or package that let them in. Add login lockout and automatic banning.
The same attack cannot work againProve and watch
Retest, write the plain-English report, then keep patching and monitoring every month.
A report and ongoing protectionThe order matters. Cleaning without closing the hole just means the same hacker walks back in, which is why every cleanup ends with a fix and a retest.
What one small business server really faces
Real numbers, not scare stories. This is what bots throw at an ordinary small server every day, which is why an unpatched site is found so quickly.
Real counts from one small server hosting ten websites, names withheld, measured 25 October 2026. Bar lengths use a square-root scale so the smaller numbers stay visible, so read the printed numbers for the real size. This is normal background noise on the internet, not an attack aimed at this server. The last three tiles show what automatic blocking did after it was switched on.
What I check, by technology
The checks follow your stack, so you get findings that matter for your app, not a generic scanner printout.
| Stack | Typical risks | What I check and fix |
|---|---|---|
| PHP and WordPress | End-of-life PHP, vulnerable plugins and themes, exposed admin tools, weak logins. | PHP version and patch level, plugin and theme audit, file permissions, login protection, firewall rules. |
| Laravel and PHP frameworks | Debug mode on, exposed .env, outdated Composer packages, weak sessions. | Composer audit, environment and debug exposure, authentication and session settings, key flows reviewed for XSS and CSRF. |
| Node.js | Vulnerable or poisoned npm packages, install scripts, leaked secrets, old Node versions. | npm and OSV scan, lockfile and install-script policy, secret scan, upgrade to a supported Node LTS, security headers. |
| Java and Spring | Old Spring Boot or libraries, exposed actuator endpoints, old JDK, unsafe deserialization. | Dependency-Check scan, Spring version and actuator review, JDK and TLS settings, access rules. |
Works on the platform you already use
Your app does not have to move first. I secure and rescue apps where they already run, on the major clouds and on everyday hosting.
Amazon Web Services
- EC2 servers, security groups and IAM permissions
- Public S3 buckets and leaked access keys
- Firewall (WAF), logging and backup checks
Google Cloud
- Compute Engine VMs and VPC firewall rules
- IAM roles and service-account keys
- Cloud Armor, logging and backup checks
Microsoft Azure
- Virtual machines and network security groups
- Entra ID accounts, roles and access
- App Service and storage exposure
DigitalOcean
- Droplets, cloud firewalls and SSH access
- Spaces storage and managed databases
- Backups and snapshots
GoDaddy
- VPS, dedicated servers, cPanel and WordPress hosting
- File permissions and old PHP versions
- Exposed backup folders and admin tools
Hostinger
- VPS and shared hosting (hPanel)
- WordPress and PHP version settings
- Malware scan, firewall and backups
Rescuing apps on any of these platforms
Not on this list? I also work on any cPanel, Webuzo or Plesk host and on plain Linux VPS and dedicated servers. If your app is in trouble, I can step in.
- Hacked or infected server
- Suspended or expired hosting
- Lost access, or the developer left
- Old server or end-of-life operating system
- Move to a safer host or cloud
AWS, Google Cloud, Microsoft Azure, DigitalOcean, GoDaddy and Hostinger are trademarks of their respective owners. They are named here only to show which platforms I work on. Pinakin Soni is not affiliated with, sponsored by or endorsed by any of them.
If your cloud account or server is compromised
A hacked server or cloud account is more serious than a hacked website, because the attacker may control everything on it. Here is how I recover it, and what to do in the meantime.
- Servers or instances you did not create
- A cloud bill that suddenly jumped
- CPU stuck at 100% (cryptominer)
- Unknown users, keys or admin roles
- A ransom note or locked files
- An abuse notice or suspension from your provider
- Access keys leaked on GitHub
- A storage bucket or database open to the public
Stop the bleeding
Cut the attacker off by restricting network access and disabling exposed keys, and take a safe copy of the disk for evidence. I do not wipe or reboot yet, because that destroys clues.
Find how they got in
Review the server and cloud logs, new users, keys, instances, scheduled jobs and SSH keys, and check which files and programs were changed.
Take back control
Change every password, access key, API token, database login and SSH key, turn on two-step sign-in, and remove rogue users, roles and instances.
Rebuild clean
Rebuild the server from a trusted image and restore only code and data that I have scanned. Cleaning in place is safe only when the damage is clearly limited.
Close the hole and harden
Patch or upgrade what let them in, tighten firewall rules and permissions, add automatic banning, test backups, and set up alerts and cloud budget warnings.
Prove and report
Retest everything and give you a timeline of what happened, what data may have been affected, and what to tell customers or regulators.
While you wait for help, do this and nothing more
- Do not wipe, delete or rebuild the server yourself yet. You would lose the evidence of how they got in.
- Do not switch it off if you can avoid it. Restrict its network access instead, for example with a firewall or security group rule.
- Change your cloud and hosting passwords from a clean computer, and turn on two-step sign-in.
- Disable or delete any access key that may have leaked, and write down what you noticed and when.
Timings are typical for one server or one cloud account and depend on size. A large estate takes longer, and I will tell you straight after a quick look.
What I can recover
On Amazon Web Services, Google Cloud, Microsoft Azure, DigitalOcean, GoDaddy, Hostinger and any other server.
| What happened | What I do |
|---|---|
| A hacked Linux or Windows server | Contain it, find how they got in, rebuild it clean from a trusted image, restore scanned data, then harden it. |
| A cloud account takeover | Lock the account, remove rogue users, roles, keys and instances, review the activity logs, and set up alerts and budget warnings. |
| A cryptominer and a huge cloud bill | Find and stop the runaway servers, close the hole, and help you ask the provider about the charges. |
| Ransomware on a server | Isolate it, check what is recoverable from backups, rebuild clean and fix how it got in. I never advise paying without a quick look first. |
| An open database or storage bucket | Close it, find out what was exposed and for how long, and give you the facts you need to decide who to notify. |
| Leaked keys or passwords | Rotate everything that was exposed, check whether the keys were used, and remove secrets from your code and history. |
How it works
A short, clear path. You always know what was checked, what was found and what was changed.
Scan
After a quick ownership check, I run safe, non-intrusive tests and review your configuration. Nothing that could disturb your site.
Day 1 to 2Fix
Upgrade runtimes, patch plugins and packages, close exposed ports and files, and add a firewall, login protection and backups checks.
Week 1 to 2Prove
I retest every fix and give you the report: each finding, how serious it is, the fix and the before and after result.
End of fixMonitor
Monthly patching, alerts and a one-page report, so new flaws are handled while they are still easy to fix.
OngoingPackages and starting prices
Start with the free check. Every other price is a starting point in US dollars, and you get a fixed quote after the free check. Clients in India are quoted in rupees.
| Package | What you get | Starting price |
|---|---|---|
| Free security check | Safe external check of versions, HTTPS, headers, exposed files and known-vulnerable components. A 2-page score and top issues. | Free |
| Security check-up | Full scan with manual verification, a report of about 8 to 10 pages and a 30-minute walkthrough. One site or app. | from $349 |
| Audit and fix sprint | The check-up, plus the fixes, a retest and the final report. Priced per app. | from $1,200 |
| Managed protection | Monthly patching, monitoring, firewall and backup checks, and a one-page report. One site. | from $99 per month |
| Emergency cleanup | Find and remove backdoors, malware and trojans from a hacked site, close the way in, then harden it and report what happened. Quoted before work starts. | from $400 |
| Server or cloud recovery | Contain, investigate, rebuild and harden a compromised server or cloud account, with a timeline report. Quoted after a quick look. | Quoted after a quick look |
| Upgrade project | Move to a supported PHP, Node.js, Laravel or Java version, tested and rolled out safely. | Quoted per project |
What your report contains
- A plain-English summary you can share with your team or your customers
- Every finding ranked Critical, High, Medium or Low, with the evidence
- The exact fix for each finding, and who should do it
- Before and after results from the retest
- A 90-day action plan and what to watch next
- Notes mapped to the OWASP Top 10 and to PCI DSS patching rules where they apply
Tools I use
Trusted open-source and industry tools, combined with manual checks, because a scanner alone misses things.
Checked only with your permission
I only scan websites and apps that you own or have written permission to test, and I confirm ownership before I start. Your findings are confidential and an NDA is available on request. Security is about reducing risk, so I never promise that a site cannot be hacked. Every report states what was checked and what was not.
Frequently asked questions
Straight answers to what clients ask before they start.
Is the first check really free?
Yes. The free check is a safe, external look at your site with a short report and no obligation. If you want the issues fixed, I give you a fixed quote.
Will the scan slow down or break my site?
No. The free check and the standard scan are non-intrusive. If a deeper test could affect your site, we agree the time and scope first, usually outside business hours.
Do you scan sites you do not own?
No. I only check websites and apps that you own or have written permission to test, and I confirm ownership first.
What is the difference between a scan and a penetration test?
A scan finds known weaknesses quickly. A penetration test is a manual attack simulation by a specialist. I focus on scanning, fixing and monitoring. If you need a formal penetration test or a certificate for a regulator, I can fix the findings from the report of the auditor you choose.
What about the PHP flaws in the news?
In October 2026 two critical PHP flaws (CVE-2026-109618 and CVE-2026-109619, called PHP2Shell) were fixed in PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12. I check which PHP branch you run and plan the safest upgrade or backport for your site.
My site is already hacked. Can you clean it?
Yes, that is the emergency cleanup. I contain the problem, find the backdoors, webshells and malware, remove them or restore clean files, change all passwords and keys, close the way in, then retest and send you a report. If your site holds customer or card data, you may also have legal duties to notify people, and the report gives you the technical facts for that.
What is the difference between a virus, malware, a trojan and a backdoor?
Malware is the general word for harmful code. A trojan is malware disguised as something harmless, such as a fake plugin. A backdoor is a hidden way for a hacker to get back in later, and a webshell is a backdoor that gives them a control panel on your server. I look for all of them.
Should a hacked server be cleaned or rebuilt?
Usually rebuilt. If an attacker had full control, you cannot be sure every backdoor was found, so the safest route is a fresh server from a trusted image, with only scanned code and data restored. Cleaning in place is reasonable when the damage is clearly limited, and I will tell you which case yours is.
My cloud bill suddenly exploded. What happened?
The usual cause is stolen access keys or a hacked server used to mine cryptocurrency or send spam. I find the servers and keys responsible, stop them, close the hole, and help you prepare the request to your provider about the charges. Whether they refund is up to the provider.
Can you provide evidence for court or insurance?
I keep a safe copy of the disk, the logs and a clear timeline. If you need evidence that stands up in court or an insurance claim, a certified digital forensics firm may be required, and I can work alongside them.
Can you fix what you find?
Yes. The audit and fix sprint covers the fixes and a retest. For WordPress, PHP, Laravel, Node.js and Java apps I make the changes myself, with a backup first.
Do you offer ongoing protection?
Yes. Managed protection covers monthly patching, monitoring, firewall and backup checks, and a one-page report, so new flaws are handled as they appear.
Which technologies do you cover?
PHP, WordPress, Laravel, Node.js and Next.js, and Java with Spring, along with the Linux servers and cloud hosting they run on. If yours is not listed, ask me.
Which cloud and hosting platforms do you work on?
Amazon Web Services, Google Cloud, Microsoft Azure and DigitalOcean, plus everyday hosting such as GoDaddy and Hostinger, cPanel, Webuzo and Plesk servers, and plain Linux VPS or dedicated servers. You do not need to move first.
Can you rescue an app on a server I cannot get into?
Often yes. If you still control the hosting account or the domain, I can usually regain access, secure the server and recover the app. If the host or the developer has disappeared, I will tell you honestly after a quick look what can and cannot be saved.
Do you work with clients outside India?
Yes. I have delivered projects for clients in the USA, UK, Europe, the Middle East and Asia, and I work across time zones.
Not sure if your site is exposed?
Start with the free security check. You get a short, plain-English report within one business day.