“Infection found” alert: what now?

Stay calm: visitors are usually protected already. With Edge Protect, the edge removes certain malicious code from the page before anyone sees it. The source is still on your web server, though, and it has to go.

How to deal with it

1. In your account, go to Edge › Security to see which pages are affected and what we found. If it says only shown to Google, you won't see it yourself when you open the page. That is exactly the hacker's trick.
2. Replace all passwords: site admin, FTP or SFTP, database and hosting. Turn on two-step verification.
3. Update WordPress, all plugins and your theme. Remove plugins you don't use.
4. Have your developer or us clean up the site. Restoring a backup from before the hack is also an option, if you know for sure when it started.
5. In Google Search Console, go to Security to check whether Google has seen anything. After the cleanup, request a review there.

How do I know it's gone?

Once the page is visited again, the edge checks it again. If it is clean, it disappears from the list. Do you want help? Send us a message from your account. If you've been hacked, you get priority.