WooCommerce is compromised. The usual goal is that checkout keeps taking orders.

What this usually is

WooCommerce compromises look like brochure hacks plus money: injected checkout scripts, spam products, malware in wp_posts, or a plugin that skims cards. The homepage can look fine while a hidden script runs on the pay page.

What you are probably seeing

• Customers report a weird extra field on checkout
• Spam products or orders you did not create
• Google or the host flagged the pay page
• A “security” or “payment” plugin you never installed

What not to do

• Do not put the whole store in maintenance mode because one category page is spam.
• Do not update every plugin in one click on a live cart.
• Do not restore last night’s backup until someone checks whether the skimmer is in that backup too.

What we actually do

Same published packages as any other WordPress IR job: backup first, find the injector, remove it, leave checkout taking orders unless the cart itself is the compromise. Phase A from $2,500. If card data may have left the building, say that on the call — that is a bigger incident than a spam title.

Published rates live on the WordPress incident-response packages page: Phase A from $2,500, Phase B from $2,000, combined from $4,200. Remote nationwide. Onsite in the Tri-Cities and Western North Carolina if you want someone in the room. If the WordPress site is the front door to a larger business compromise, start at emergency incident response instead.