Rocon Security Pledge for WordPress Sites
Our security pledge is designed to help safeguard your WordPress site if it becomes compromised while hosted on Rocon. Please note that this service applies only to WordPress sites hosted by Rocon and excludes Application, Database, or Static Site Hosting.
Security Pledge Coverage
Our security pledge applies only to WordPress sites that do not use nulled plugins or themes. If any nulled plugins or themes are in use, we cannot proceed with malware removal until they are removed.
Our security pledge includes the following services:
- Comprehensive Site Inspection: We conduct a deep scan of your site files to identify any malware.
- Core File Repair: We’ll replace compromised WordPress core files with a clean version.
- Plugin and Theme Cleaning: Any infected plugins or themes identified will be removed.
Note: If an active plugin or theme is removed during malware removal, you will be responsible for installing and configuring a new, clean copy once the process is complete.
Our pledge does not cover non-WordPress software or custom scripts.
While we strive to fully remove malware, certain infections, especially those embedded in the database, may require multiple rounds of remediation. If unexpected issues arise post-remediation, please contact us with details to allow our specialists to make further attempts to eliminate the malware.
This pledge is subject to our Terms of Service.
Common WordPress Site Vulnerabilities
Our secure infrastructure greatly reduces the risk of server-level compromises. However, sites may still be infected due to:
- Outdated Plugins/Themes: Poorly coded or outdated plugins, themes, or WordPress core.
- Compromised Credentials: Attackers gaining access to admin, SSH, or database credentials.
- Nulled Plugins and Themes: Using unlicensed versions with malicious code.
Malware Removal Process
Our standard inspection and malware removal process generally takes up to one full business day, with particularly persistent infections possibly requiring additional rounds. If a site is extensively corrupted, restoring from a backup may be necessary.
During the process, infected plugins/themes are often removed, which may impact site functionality. We recommend using a maintenance mode plugin while malware is being removed.
If you discover malicious behavior, please reach out to our team.
Rocon Support Team Actions
Our Support team will take the following steps for every site we repair:
- Reinstall the WordPress core.
- Change all SFTP, SSH, and database passwords.
- Remove infected plugins and themes.
Post-Removal Steps for Site Owners
After malware removal, we’ll ask you to take additional steps within one business day to secure your site, including:
- Updating all plugins, themes, and WordPress core.
- Replacing any compromised plugins/themes with fresh copies from the developer.
- Reviewing and updating all admin users and passwords.
Failure to complete these steps may limit our ability to address future infections.
Scanning Additional Sites
With Rocon’s container-based infrastructure, cross-contamination between sites is not possible. If only one site shows infection evidence, we recommend using a security plugin, like Sucuri, to scan any additional sites.
Infections Found During Migration
During migration, if malware is detected, we will pause the migration and notify you, providing the following options:
- Proceed with migration, with our team removing the infection.
- Cancel migration, repair the site on the previous host, and reschedule the migration.