The short answer: clean it first, then move it. Migrating an infected copy moves the infection with it, because malicious code lives inside the site’s files and database, not only on the old server. A clean, stable host is the right destination, but it is step four, not step one: full backup, complete cleanup, migration of the clean copy, then new passwords and keys everywhere.
In 40 seconds
Related: Domain & Hosting — or see every industry we serve in B2B marketing.
- Wanting a new environment is sound, and asking for a full security scan is exactly the right question. Only the order needs fixing.
- “Treated initially” usually means the visible symptom, the injected ads, was removed. The way the attacker got in is often still open.
- Safe order: offline backup, scan and clean, update, migrate the clean copy, rotate credentials, check search warnings, monitor for 30 days, then tune performance.
- Before you pay, get in writing who cleans, what happens if it reinfects, where backups live, and whose name the accounts are in.
“Move it first, or clean it first?” What you are really asking
The question came from a company owner whose website had been hit by ad injection: unrelated ads and strange links showing to some visitors. In his words: “Our website was hacked and treated initially, and we want to move it to a clean host: move first, or clean first?” Then the practical questions: is the migration complete, files and database, with a full scan for leftover code? Which server versions? Is there specialised support after the move for errors and cache tuning? Are SSL and a CDN included? What does it cost?
Three things in that message are exactly right:
- A new environment is a good idea. The old server may hide weak settings or forgotten accounts.
- Asking for a full scan is the heart of the matter. Leftover code decides whether the hack is actually over.
- Asking about post-move support is sensible. A compromised site rarely comes back perfect on day one.
The only problem is the sequence: moving first means paying for a clean environment, then placing the same infection inside it.
Why migration carries the infection, and what “treated initially” usually means
Ad injection is rarely one file you delete and forget. Attackers usually leave several footholds:
- Code in theme or plugin files that adds the ads to every page.
- Rows in the database, in content or settings, which a file scan alone misses.
- A disguised file in the uploads folder with an innocent name.
- An extra administrator account for coming back at will.
- A scheduled task that rewrites the code periodically, so the site looks clean for two days and then the ads return.
“Treated initially” most likely means someone removed what visitors could see. That stops the immediate damage, but it treats the symptom. The entry point, whether an outdated plugin, a theme from an unofficial source, a weak password or an exposed file-transfer account, may still be open.
A migration is a copy. If it contains the malicious code, the rogue admin and the scheduled task, all of them travel. And if the old passwords stay, whoever holds them logs in to the new host as easily as the old one.
The safe order, step by step
- 1. Full backup, kept offline. Files and database as they are now, as a reference if anything is lost.
- 2. Scan and clean everything: files against original versions, the database, users, plugins and themes, scheduled tasks, and any admin account your team does not recognise.
- 3. Update and remove. Update the core, plugins and themes, and delete everything unused. A deactivated plugin that is still installed is still a door.
- 4. Move the clean copy and test it in the new environment before switching the domain.
- 5. Rotate every password and key: hosting, database, admin users, email, and API keys for connected services.
- 6. Check search-engine warnings and blacklists, and request a review if the site was flagged.
- 7. Monitor for 30 days, with regular file scans and alerts on unexpected changes.
- 8. Only then, tune performance. A cache can store an infected page and keep serving it, so caching and CDN work come after stability is proven.
Move first vs clean first vs rebuild
| Route | When it fits | Risk | What you keep |
|---|---|---|---|
| Move first | The current host has suspended the site or is closing the account, so you need an isolated place to work | High if it goes live straight away; acceptable only in an isolated, unpublished environment | Everything, infection included, until cleanup is complete |
| Clean first | The usual case: the site runs, the infection is contained, the system can be updated | Low, if the scan covers files, database, users and scheduled tasks | Content, URLs, rankings and design as they are |
| Rebuild | The site is too old to update, uses an unofficial theme, or reinfects after every cleanup | Lowest security risk, but URLs and rankings need protecting | Written content, original images and URL structure, if carried over carefully |
“Move first” is legitimate only if the new environment stays hidden until cleanup is finished. If a rebuild is the answer, the real risk is lost rankings, which is why a B2B company website rebuild should map every old URL before launch.
What a hacked website costs a B2B company
For a company selling to other businesses, the website is how a buyer verifies you before calling. Your sales cycle may run 3 to 9 months on contracts worth hundreds of thousands or millions, and one warning at the wrong moment is enough:
- Buyers’ browsers warn them away. A flagged site shows a red warning page first. Most procurement managers do not call to ask; they move to the next supplier.
- Your emails land in spam. A compromised server can send spam, damaging the domain’s reputation, so your quotations reach the client’s junk folder.
- Forms stop delivering leads. Injected code can break the contact form or its mail, which hurts most if buyers use your site to request RFQs and confidential datasheets.
- Search shows spam pages under your name. Some infections create pages that get indexed beside your company name.
The damage rarely shows in a report as a loss. It shows as silence: fewer inquiries, and buyers you never knew had visited.
What to get in writing before you pay
All five of his questions were right. Proper answers look like this:
- Migration and scan: files, database and mailboxes moved, plus a written scan scope: what is checked, how, and what report you receive. “We’ll scan the site” is not a scope.
- Server versions: you need a commitment more than a number: current, security-supported versions of the language and database, compatible with your plugins, tested on a staging copy first.
- Post-move support: who fixes errors, who tunes the cache, the response time, and whether it covers the site’s code or only the server.
- SSL and CDN: included in the service, not sold later as add-ons.
- Cost: our website hosting and security service starts from $160 per year (about 8,000 EGP · 600 SAR), including SSL, daily backups, monitoring, a CDN, the domain and business email. Cleanup is priced after the scan, because its size cannot be known before.
After cleanup, a technical SEO audit from $300 confirms spam pages have left the index. A rebuilt B2B company website starts from $600 (about 30,000 EGP · 2,250 SAR), and you can compare our hosting options. Above all, the domain and hosting should be registered for your company and documented in one handover file, with clear access for your team rather than only for the contractor.
Six questions before you sign with a host or agency
- Who does the cleanup, and what exactly gets checked: files, database, users, plugins, themes, scheduled tasks?
- If the infection returns within 30 days, is cleanup repeated within the service or quoted again?
- How often are backups taken, where are they stored, and when was a restore last tested?
- Are the hosting, domain and email registered in my company’s name, with full access held by us?
- What does post-migration support cover, who answers, and how fast?
- Are SSL, the CDN and monitoring included, and what do I receive when monitoring finds something?
When we’re the right fit — and when we’re not
VadeCom is the right fit for a B2B company whose website is part of how it sells, that wants hosting in its own name, a scan before the move rather than after, and one accountable party for protection, backups and monitoring. We start with the scan, price the cleanup once we know its size, and tell you plainly whether cleaning is enough or a rebuild is cheaper over time. We are not the right fit if you want the site moved as-is with no scan, the cheapest space with no support, or a large consumer store needing a dedicated infrastructure team.
Related reading
- Website hosting and security for company sites
- Technical SEO audit
- Best marketing agency for factories in Egypt
- B2B websites for RFQs and confidential datasheets
- VadeCom — B2B marketing agency, Egypt and the Gulf
FAQ
Is changing hosts enough to get rid of a hack?
No. Malicious code lives inside the site’s files and database, so it travels to any new host. A new host helps after cleanup and password rotation, not instead of them.
How long does cleaning a hacked website take?
It depends on what the scan finds. More important than cleanup time is the 30-day monitoring afterwards, because that proves the entry point is closed.
Does a hack affect search visibility?
Yes, if the site is flagged as dangerous or spam pages are indexed under its name. After cleanup, request a review and check the index to confirm those pages are gone.
Does an SSL certificate protect a site from being hacked?
No. SSL encrypts the connection, but it does not stop an outdated plugin or a weak password being exploited. It is necessary, but only a small part of protection.
When is rebuilding better than cleaning?
When the system is too old to update, uses an unofficial theme, or reinfects after every cleanup. Then a clean build on documented code handed over to your team costs less than repeated cleanups.
