Website security for the data you hold.

Scope first, then the rebuild. The opening hours go on establishing what was reachable and when it changed, because restoring a backup overwrites the evidence that question is answered from, and it is a question you may have to answer to somebody else. In parallel we take a forensic copy, put the site behind a firewall or off public view, and look for the entry point. Only then is it rebuilt from a copy taken before the intrusion and the way in closed. The blocklist review with Google and with the host is filed on the day the site is clean.

Clean the site properly, then request a review in Search Console, and the warning usually clears within a day or two of the review passing. Asking for the review before the site is genuinely clean is the common mistake: a failed review costs you another cycle while the warning stays up in front of every buyer searching your name. The host may have a suspension to lift separately, and some browsers and mail providers keep their own lists. We file all of them and tell you which one is still showing while it is.

It is website work, and the quote you were sent is for a different problem. Search this term in the UAE and the results are enterprise consultancies, appliance resellers and managed operations centres, because the local security industry grew up around regimes written for government entities and critical infrastructure, such as the Dubai Electronic Security Center standards and the federal information assurance standards. Those do not attach to a marketing site with an enquiry form on it. What that site needs is a firewall in front of it, patched software, closed entry points, monitoring and a recovery path, which is a job for whoever understands the site rather than the network. Where you genuinely do need the other thing, we say so on the call.

How it was built, in almost every case we are called to. WordPress runs more of the web than anything else, so it is attacked more than anything else, and that is a fact about scale rather than about the software. What actually lets somebody in is the layer around it: a plugin nobody updated, a theme bought once from a marketplace that stopped shipping fixes, an administrator password reused somewhere that has since leaked, an upload path accepting a file type it should not. None of those is a WordPress decision. Each is a decision somebody made during the build and nobody revisited afterwards. Changing platform to solve it usually moves the same habits onto a smaller target and buys a year. A Deira trading house on a DET mainland licence that hardens the install and names who applies updates is in a better position than the same company on a platform nobody is watching.

The duty sits with the controller, which is your company, and it starts as soon as you become aware of a breach that could harm the data. The UAE personal data protection law, Federal Decree-Law No. 45 of 2021, requires the notification to the federal data protection regulator (the UAE Data Office, whose functions moved to the Artificial Intelligence and Data Authority in June 2026) to describe the nature and cause of the breach and its scope, and a processor has to tell the controller immediately in turn. The timing detail is left to executive regulations that had not been issued as of September 2026, and the precise wording of what you file is a matter for your counsel rather than for us. One fact changes the answer entirely: DIFC and ADGM companies sit under their own separate data-protection regimes rather than the federal one, so where the entity is registered decides who is told. Our part is the establishing, because you cannot describe a scope you have not determined.

Because the entry point was never closed. A reinfection is the most diagnostic thing that happens in this category: it tells you the files were replaced and the way in was left exactly where it was. In practice that is an outdated plugin or theme, a password reused somewhere that has since leaked, an upload path accepting what it should not, or a second administrator account nobody knew existed. A cleanup that never names the cause has fixed the symptom and sold you the same job twice. On WordPress specifically, who applies updates and on what schedule is a build decision, and it is set out on WordPress development.

Yes, and it is usually faster than it looks. Most supplier questionnaires ask the same handful of things about a website: how traffic is encrypted, who holds administrative access and how it is protected, whether the software is patched on a schedule, whether the site has been tested for known vulnerabilities, where backups are held, and what happens if there is an incident. We answer the technical sections from the site as it actually is, fix whatever the questions surface rather than writing around it, and hand you a vulnerability scan report you can attach as evidence. Anything about your data-protection position as a company belongs with your counsel, and we will tell you which sections those are.

Both, and which one you need depends on whether something has already happened. A compromise is project work: scope, cleanup, closing the entry point, and the record. Keeping a site defended is standing work and is priced monthly, because the attack surface changes every time a plugin updates. What moves the figure is the platform and size of the site, whether it takes payments or holds client logins, whether it is compromised right now, and whether monitoring and backups already exist or have to be built. We price against those after the assessment and put the number in writing. There is no standard published rate in this market, and a number quoted before anyone has opened the site tells you nothing about what you are buying. Where the assessment finds the site is past defending, a first build is scoped on web design in Dubai.