Is your server working for someone else?
Attacks on a newly published flaw can start within hours, and a hijacked server ends up mining cryptocurrency or sending spam for someone else. We check whether your Linux server is already compromised and what to fix first. If it is, we clean it up and explain in plain language how they got in.
Exposure report for €9.99: no access to your server needed · AI-driven, supervised by an operator · Ubuntu and Debian, at any provider · WordPress, PHP, Node.js, Python, Docker
ALERT CPU 96% for 18 min (normal: 7%) evidence process .ld-linux.so xmrig miner, renamed folder plugins/site-cache-helper not a real WordPress plugin network mining pool on port 443 disguised as web traffic cron */2 * * * * .run.sh added by the web server user inventory WordPress 6.9.1 fix in 6.9.9 verdict cryptominer installed through a WordPress backdoor proposed 1 block traffic to the pool 2 stop miner, remove cron entry 3 remove fake plugin and backdoors 4 reset admin logins, update WordPress status waiting for your approval of the plan
Illustrative example of an investigation report
Attackers don't wait for your next update.
Nobody picks your server by hand. Programs scan the whole Internet for every newly published flaw and arrive within hours. Someone checking for updates once a week cannot keep up. A Health Check tells you where your server stands today.
Sources: Patchstack, State of WordPress Security in 2026; VulnCheck, State of Exploitation 2026.
Sources: php.net, 20 Oct 2026 · php.net, 21 Oct 2026 · nodejs.org, October 2026 security releases.
Two services you can order today.
Priced per server. Continuous protection (Watch and Managed) opens soon: you can join the waiting list below.
Health Check
Is your server already compromised, and what is exposed? A one-time review with a written answer.
€290 one time
- One server, up to 5 websites included
- Full software inventory
- Vulnerability and end-of-support report
- Compromise check: miners, backdoors, rogue users, keys and tasks
- Exposure check from the Internet
- Plain-language report with the fixes in order of priority
Emergency clean-up
Hacked right now? Slow server, unknown processes, spam pages or a warning from your host.
€690 one server
Need it sooner? Message us: we tell you when we can start, and we confirm we can take it before you pay.
- We stop the attack and remove what the attacker left: miners, backdoors, rogue users, keys and scheduled tasks
- We close the way they got in
- Plain-language report: how they got in, what they touched and what we changed
- Follow your order step by step, and stop our work with one click
- A backup before every change
Continuous protection · opening soon
Watch and Managed begin with a Health Check of the server. Join the waiting list: no payment and no commitment, and we email you when they open.
Watch
Automated inventory, vulnerability matching, patching and monitoring.
€49 per server / month
- Starts after a Health Check of the server, then keeps it up to date
- Same-day alerts for vulnerabilities in your software
- Security updates applied with automatic rollback
- Automated 24/7 monitoring of resources, files, users and network
- AI investigation of every anomaly, supervised by an operator
- Monthly report
Managed
We run the server for you, including the upgrades nobody wants to do.
€149 per server / month
- Everything in Watch
- Major upgrades: operating system, PHP, databases
- Daily off-site backups, restore tested monthly
- Hardening: firewall, SSH, web server, WordPress
Agencies and hosting resellers with 10 or more servers: Watch €35 and Managed €119 per server per month.
Ask about agency pricingPrices in euros, taxes not included. For businesses and professionals only.
All prices are billed in euros; dollar amounts are approximate.
Every signal a hijacked server gives off.
A cryptominer can hide its CPU use. It cannot hide everything at once: a new process, a new outbound connection, a new file in your website and a new scheduled task all show up somewhere. The Health Check looks for all of them once; Watch, when it opens, will look for them around the clock.
AI-driven, with a backup before every change.
AI makes us fast: it reads logs, correlates signals and drafts a clear report, which a second AI model checks against the evidence. During diagnosis the AI only reads: logs on a compromised server are written partly by the attacker, so it is told never to follow what they say. During a repair the AI carries out the plan you have accepted, after a backup of what it is going to touch, and the process is supervised by our operators.
- Read-only diagnosisWhile diagnosing, the AI only runs commands that read. Every repair follows a plan you accept, starts with a backup, is supervised by an operator and every command is listed in your report.
- Access you controlFor a Health Check or a clean-up we use SSH access created only for you. When we finish we delete our key, so that access stops working, and you remove it from your server with a single command. With Watch and Managed, our Watcher (a lightweight program installed on your server) connects out to us and our SSH access stays on the server: a key used only for your server, which only works from our own addresses. You can see it and remove it at any time. We never ask for a root password.
- Each customer isolatedEvery investigation runs with access to one customer only, and the system is designed so that a problem on one server cannot reach another.
- Everything recordedEvery command and every change is logged. Your report summarises them, and you can ask for the full record at any time.
- Your data stays yoursYour logs and files are never used to train AI models.
Know what runs. Hear about every flaw. Patch. Watch.
When Watch opens, four steps will run on their own, on every server, every day: fixes applied as soon as they exist, and flaws without a fix contained until there is one.
Exact inventory
Our Watcher, a lightweight program installed on each server, records what runs on it: system packages, PHP, Node.js and Python versions, WordPress core, plugins and themes, containers, open ports, users, SSH keys and scheduled tasks. Refreshed every few hours.
Vulnerability matching
Every new vulnerability and end-of-support date is checked against that inventory the day it is published, using distribution security trackers, OSV, WordPress vulnerability feeds and the U.S. government's list of flaws known to be under active attack.
Safe patching
Urgent fixes go in first, the rest in your maintenance window. We snapshot first and check your sites afterwards; if a site stops responding, the update is rolled back automatically. No fix yet? We disable the vulnerable plugin or block the attacked path until there is one.
Watch & investigate
We monitor resources, network, logins and file changes against each server's normal behaviour. When something is off, an AI investigator gathers the evidence and the process is supervised by an operator.
Runs automatically, 24/7
- Software inventory of every server, refreshed every few hours
- Matching against every new vulnerability, the day it is published
- Security updates, with a snapshot first and automatic rollback
- Temporary protection when a flaw has no fix yet
- Monitoring of resources, files, users and network traffic
- AI investigation of every anomaly, with a written report
Done by a person
- Supervises the process
- Plans major upgrades with you, never automatically
- Answers your questions and explains what happened
Before you ask.
I think my server has been hacked. What should I do right now?
Don't delete anything and don't reinstall yet: the traces of how they got in are still on the server, and we need them to close the way in. If your provider lets you, take a snapshot. Then message us on WhatsApp or use the form, with your provider and what you have noticed. We explain step by step how to give us temporary access.
What do I get from a Health Check?
A written report in plain language with: everything installed on the server; which versions have known vulnerabilities or no longer receive security fixes; any sign that someone else is using the server (miners, backdoors, unknown users, keys or scheduled tasks); what your domain shows to anyone on the Internet and which services are listening on the server; and the fixes in order of priority. Your team can apply them, or we can.
What do you need from me to start?
For a Health Check or a clean-up, temporary access to the server: SSH access we give you; when we finish we delete our key and you remove the access with a single command. For Watch and Managed, when they open, you install our Watcher with one command and keep our SSH access active: the Watcher reports the state of the server continuously, and we connect regularly to run deeper checks that the Watcher cannot do on its own.
Is an AI really looking at my server?
Yes. Server Watch is an AI-driven service: the AI reads your server (metrics, logs, processes and files) and writes up what it finds. During diagnosis it only reads. During a repair it carries out the plan you have accepted, after a backup of what it is going to touch and the process is supervised by our operators. Every command is listed in your report.
Which systems do you support?
Ubuntu and Debian servers at any provider (Hetzner, OVH, DigitalOcean, AWS, Contabo and others) running WordPress, PHP, Node.js, Python or Docker. Other Linux distributions on request.
Do you work with shared hosting?
We work on servers you control: a VPS, a dedicated server or a cloud server, at any provider. On shared hosting we cannot get the access we need. Order the exposure report (€9.99) and we will tell you what we can see from outside.
Why not just use a security plugin or my host's protection?
A WordPress security plugin protects WordPress. Your server also runs the operating system, PHP, a database and often other applications, and attackers use those too: the PHP flaws of October 2026 can affect any site that runs PHP, not only WordPress. On a VPS, your provider looks after its own infrastructure; the software you install on the server is yours to keep safe. We check the whole server and tell you in writing what we found.
My operating system or PHP version is old. Can you still help?
Yes. We will tell you exactly what is out of support and what it exposes you to, protect it as far as possible in the meantime, and plan the upgrade with you. On the Managed plan the upgrade is included.
Is this automated?
Today the Health Check and the clean-up are carried out by AI that reads the whole server and correlates what it finds, and a second AI model checks the report against the evidence. Watch and Managed, opening soon, add the automated part: inventory, vulnerability matching, security updates with rollback and 24/7 monitoring. In every case, repairs follow a plan you accept and the process is supervised by our operators.
With Watch, will automatic updates break my website?
Security updates rarely change behaviour, but Watch is designed for the day one does: it takes a snapshot before updating, checks your sites afterwards and rolls back automatically if they stop responding. Big upgrades, such as a new PHP version, are never automatic: we test them first and agree a date with you.
Is there a long-term contract?
No. Watch and Managed will be monthly and you can cancel any month: you remove our Watcher and our SSH access with a single command, and we send you your full inventory and history. The Health Check and the clean-up are one-time payments.
Get your exposure report for €9.99.
Tell us the domain of one of your websites. Without touching your server, we check from outside what it shows to the Internet and which of it has published vulnerabilities, and we email you the result. Hacked right now? WhatsApp is the quickest way to reach us.