Website security

Website security audit

We don't do everything: we look at what's visible from the outside on your online shop, and tell you before Google does.

Security assessment, incident investigation and monthly monitoring for WordPress and WooCommerce shops.

Request a quick diagnosis How we work

HUF 60,000, credited towards the full assessment.

Three services, one team

  • Assessment

    We look for the weak spots in your website or online shop.

  • Incident response

    If something's already wrong, we find out what happened and restore the site.

  • Ongoing monitoring

    If you like, we keep watching over your site afterwards.

How we work

The external review

Twelve steps, each from a public source. The website's source code and response headers. The content indexed by search engines. DNS and email settings, including whether email can be spoofed in your domain's name. The state of the certificate and encryption. Forgotten subdomains from public certificate transparency logs. And publicly disclosed vulnerabilities for the version numbers we detect.

One rule governs everything: the server's response decides. Whatever it serves without authentication is public. Whatever it refuses, we don't touch.

What we never do without permission

  • Login attempts
  • Downloading files
  • Guessing paths
  • Port scanning
  • Active vulnerability scanning
  • “Proving” any flaw by exploiting it

With permission, these are legitimate professional tools: with a written engagement, a precise scope and a time window, we do carry them out. Without permission, we don't.

What you can see from the outside is the surface. What's inside the server can only be told by an internal review, and that requires your written engagement.

This is how we start working together

  1. Get in touch

    Write to us and tell us which website or online shop it's about, and what the problem is, if there already is one.

  2. Access without passwords

    We do the work through our in-house Claude Code Bridge: you don't have to hand over an FTP, database or admin password, and you can revoke access at any time.

  3. Results and monitoring

    We show you what we found, restore whatever needs restoring and, if you like, keep watching over your site afterwards.

You'll find the technical details of the access setup at claudecodebridge.com.

The eight steps of the internal work

  1. I compare the core system against the official checksums. In one case, this alone was what revealed the entire infection.

  2. I trace the point of entry back through the logs, to the second. Without it, you don't know what you're cleaning up, or when it will be over.

  3. Every pattern runs dry first, and a human reviews the list, file by file.

  4. Cleanup involves no deletion: everything goes into quarantine, reversibly.

  5. I close the way in: passwords, sessions, keys, hosting access.

  6. Without this, all the cleanup buys you is the chance to start over the next day.

  7. After the work, I measure again, using the same method.

  8. The report contains the measurements, not my opinion.

What you get at the end

  • A written report with timestamps and measurements, one that another professional can verify.
  • A plain-language summary: what happened, what didn't, what needs to be done, and what's urgent.
  • An itemised list of what didn't happen. This is the part that's usually missing elsewhere.
  • A list of indicators you can use to check your other sites against the same pattern.

Cases

Twenty-one cases, no client names

From real investigations. Every number is backed by a measurement.

99 sec
That's how long it took from one successful login to a complete takeover, without a single irregular action. The attacker didn't hack anything: they simply logged in.
51 days
That's how long an attack ran unnoticed before someone outside raised the alarm.
23,073
Fake product pages appeared in search results under a Hungarian domain. Human visitors saw none of it.
100+
Scans, zero findings. The malware scanner ran on the server every night, it was just watching the wrong directory.

Five things all twenty-one cases have in common

  1. In most of the serious infections, the way in wasn't a software bug but a valid password. Updates alone don't protect against that.

  2. An infected site usually works perfectly. If you wait for symptoms, you start too late.

  3. Existing protection often only works on paper: it looks in the wrong place, it's switched off, or it doesn't match because of a single character.

  4. The log is the most important thing you can have in an incident, and it can't be recovered after the fact.

  5. The order of the recovery matters just as much as the cleanup itself. In the wrong order, all the work is wasted, and you can't tell from the outside.

The sentence we hear most often: “There's nothing to steal from me anyway.” The attacker doesn't want the data, they want a working website with a good reputation as a launch pad. That has a price, and it isn't zero.

Send me the full material, all 21 cases

Twenty-one, not twenty-eight. The case library is bigger, but only 21 are written up. We don't publish a number we can't back up on request.

Prices

We publish them because there's nothing to hide. All prices are net, excluding VAT.

Quick diagnosis

3 hours and a short written status report: is there a problem, and if so, how big. The price is credited towards the full assessment if you order it.

HUF 60,000Request a quick diagnosis

One-off work

  • Security assessmentFull file and database audit, documentation, remediation planHUF 280,000
  • Incident investigationEvidence preservation, point of entry, timeline, complete list of findingsfrom HUF 550,000
  • Repair and cleanupDaily rate, with an upfront estimateHUF 200,000 / day
  • HardeningStrengthening without an infectionHUF 150,000
  • Blacklist removalCleaning up search spamHUF 120,000
  • Emergency serviceWithin 24–48 hours+80%

We don't give a fixed price for repairs before the review. Until then, the scope can't be seen, and anyone who quotes a fixed price up front is either guessing or has priced the risk into your bill.

Monitoring

  • Basic

    HUF 45,000 / month

    Monthly check, monthly report

  • Recommended

    Standard

    HUF 90,000 / month

    Weekly check, 48-hour response time, quarterly deep audit

  • Critical

    HUF 180,000 / month

    24-hour response time, 2 hours of incident time per month

Cleanup is a snapshot, not protection. What happens today is that when something's wrong, an outside party notices it: Google, the hosting provider or a customer. All a monitoring contract does is make sure we tell you first.

Who carries out the investigation?

Gábor Vidovics, website security incident responder

Gábor Vidovics

website security incident responder

I've worked in IT for almost thirty years, more than twenty of them as a developer and technical lead. Today I investigate and restore hacked, slowed-down or suspiciously behaving websites, and make sure nothing goes wrong on them again once they're back in order.

I don't break into the system, I understand it: using logs, files and the database, I trace what happened, where the attacker got in, and what needs to be closed so they don't come back. I measure, I don't guess; I quarantine, I don't delete: your data stays intact during the investigation, too.

I've worked on all kinds of code, from native PHP to the big frameworks, so I also take on the custom sites that “nobody dares to touch anymore”. I put the same care into planned maintenance as when the house is on fire, and even then I see the case through to the end.

Wednesday Agency, a brand of 30km.hu Kft., is an online marketing agency that has been operating for eight years, with a presence in Budapest and London. Company registration no.: 07-09-029835 · Tax no.: 24382315-2-07.

About the whole agency (wednesday.agency)(opens in a new tab)

Let's talk

If the situation is acute right now (Google flagged it, your hosting provider got in touch, or you're seeing something strange on the site), write to us and put the word “URGENT” in the subject line. We look at these out of turn.

info@30km.hu Request an audit

On working days we reply within 6 hours. Tell us your domain and what you're seeing: that's all we need for the first reply.

We don't promise 24/7, because we couldn't keep that promise. What we commit to, we deliver.

Email Write to us