So Outside Technology Security CMS
AnQiCMS
Online Demonstration

After the site is hacked, should the cleaning costs and loss of business be calculated together?

📅 2026-11-01 👁️ 0

After the website is hacked, should the cleaning costs and business losses be calculated together? Yes. The cleaning costs are a one-time technical expenditure, and the business losses are the cumulative operating losses from the time of the event to the time the website becomes accessible again. Reporting only the former would systematically underestimate the cost because the recovery of search visibility, the loss of orders and inquiries, and the time required for subsequent reinforcement are not included in the cleaning quote.

The two costs belong to different categories

The cleaning fee corresponds to the work of 'removing malicious content': virus scanning, replacing modified programs, cleaning the injected content in the database, and repairing entry points. Its pricing method is per event, with a quote for each event, with clear scope and endpoint.

The business interruption loss corresponds to the period when the site is not in normal status: access cannot be completed, the order entry is unavailable, and search traffic drops and recovers late. It has no endpoint quote and can only be estimated on a daily basis, and the actual impact often extends after the recovery because the stabilization of inclusion and ranking is much slower than file cleaning.

The difference between the two is most easily confused during event debriefing: when you get the cleaning quote and say 'This loss is not big', you skip the losses during the shutdown and recovery period, and this kind of statement often leads to misjudgment in budget discussions.

Why can't we only report the cleaning fee?

Reporting only the cleaning fee will omit four items.

The first item is the loss of traffic during the recovery period. After the website is hacked and the search engine de-weights or removes some pages, even though the files have been cleaned up, it takes time for visibility to stabilize, and the natural traffic gap during this period does not belong to the scope of cleaning work.

The second item is about inquiry and order loss. When forms are hijacked and redirects are rewritten, users' submissions do not fall into the database, and this part of the loss can only be estimated by comparing the amount of submissions before and after the event, which cannot be recovered afterwards. Robot traffic already accounts for 45% of global internet traffic, and once the entry is exposed, the speed of bulk probing is very fast.

The third item is about comprehensive rectification. The event often leads to weak passwords, outdated operating environments, and redundant backend entries, with the scope of rectification being larger than the scope of cleaning.

The fourth item is the preparation for repeated events. Conducting a recovery exercise, establishing a backup and monitoring system, belongs to the fixed costs that must be supplemented after the event, rather than a one-time expenditure.

The table lists the five costs according to the口径, making it convenient to explain to non-technical parties.

Cost items Pricing criteria Who estimates Common omissions
Malicious content cleaning Per occurrence Handler Intrusion content within the database
Loss during the shutdown period Accumulated per day Business party The part of inquiry that has not fallen into the library
Search visibility recovery Flow gap during recovery period Operation party Close the case as soon as the file recovery is seen
Concurrent rectification By working hours Technology and security Unupgraded operating environment
Prevent duplicate events Long-term fixed investment Both parties Backup and recovery drills were not done

The four-step order of emergency response

If the order is wrong, it will amplify the loss. The four steps are isolation, cleaning, patching the entry point, and verification.

Isolation refers to bringing the site back from the publicly accessible state, avoiding visitors from being redirected to malicious pages, while keeping a scene of the event, do not restart or overwrite files before isolation. Cleaning refers to removing malicious content and files that have been tampered with, this step should be coordinated with file source verification, only delete the visible mount points, which are easy to residue.

The entry repair refers to finding the exploited path and patching it up: all un-upgraded programs, open registration entries, and forms without verification need to be handled together. AnQiCMS forms can be connected to reCAPTCHA for robot verification, and after the event, the registration and comment entry should be checked together, not just the page that caused the incident.

Verification means confirming a return to a clean state, involving two steps: comparing the cleaned site with the backup before the event; checking from an external access perspective whether the homepage and several inner pages still have abnormal jumps.

Three things to check after the recovery

The first is the availability of backup. The most common unexpected event is that the backup exists but cannot be restored, or the backup time point is later than the infection time, and the restored data still contains malicious content. AnQiCMS supports the backup and recovery of data and static files, and the recovery should be verified once in the exercise mode, rather than just on the day of the event.

The second is the recycle bin and historical content. During the cleaning process, the deleted text and attachments may only be moved to the recycle bin, and after the event, it is necessary to confirm which are malicious files and which are mistakenly deleted normal content to avoid turning the cleaning action into a secondary data loss.

The third is to check if the monitoring is supplemented. At least there should be an alarm for abnormal jump, file change record, and a prompt for a sudden change in submission volume. If any of the three are missing, the discovery time of the next similar event will be delayed until the user complains.

After these three items are checked, merge the cleaning fee and the loss of business into one event cost as the basis for subsequent budgeting and scheduling reinforcement.

Common questions

Should we clean the files first or back up the scene first?First, keep the scene and then make a backup. Only then should we start cleaning. Overwriting files before cleaning will make it impossible to trace the entry and method, and it is easy to leave unpatched loopholes.

To which day should the loss of business be calculated?At least calculate it to the level of access and submission before the event is restored, not on the day the files are cleaned up, the search visibility usually lags behind.

What should I do if there is no backup?First make a backup of the current state and then clean up, keep the version that can be rolled back, and then establish regular backup and recovery drills, this is an item that must be supplemented after the event.

Related articles

Which type of spam submissions do the honeytrap field and captcha each block, can only one be left

The honey pot field blocks script submissions that do not parse styles, there is no visible challenge for real visitors; the scoring captcha is scored according to the possibility of robots, at the cost of mistakenly harming some real users. The two methods do not face each other, and whether only one can stand depends on the composition of garbage: when the amount of scripts is mainly used, the honey pot is enough, but when there are submissions with changed addresses and natural content, only the honey pot is not enough.

2026-11-01

The training crawler was blocked in robots, why can't the content still be retrieved

There are tests from more than 2,300 sites showing that only 3.6% of the sites block training crawlers in robots, but when accessing the homepage directly by real identity, 18.8% cannot access usable content. There is a gap between declarations and actual usability: writing rules does not mean they take effect, and there are also cases where the side that grants access cannot access the text. Self-inspection should be in order of four types of signals, not just whether that line of rules is in the text.

2026-11-01

The adoption rate statistics of the two llms.txt files are very different, which decision口径 should be adopted?

Two studies that were checked on the same day are very different: The adoption rate is 8.3% when statistics are taken from the top ten thousand domain names, and it reaches 49.2% when statistics are taken from more than two thousand sites. The difference does not come from who made a mistake in the calculation, but from the denominator range and the method of judgment. When making decisions, do not take the average of the two numbers, but first see which category your site falls into among the samples, and then confirm whether the口径 can be used by checking the three-step verification method.

2026-11-01

Most llms.txt files have never been requested, and is it still worth maintaining them?

The analysis of logs from more than 100,000 sites shows that 97% of the llms.txt files have never been requested, with reading concentrated in a few sites. This result does not mean that the file is useless, but rather that it does not solve the two issues of being discovered and intercepted. Whether to continue maintaining it should be judged by looking at whether there are corresponding requests in the access logs of your own site, rather than by looking at whether the file has been uploaded.

2026-11-01

The domestic website building system announced the repair of remote screenshot risks, what should the site without an upgrade do first.

PbootCMS has strengthened the server-side request forgery protection for the remote capture feature of the editor in V3.2.25, added connection timeout, size limit, re-binding protection, and internal network address blocking, and supplemented the configuration of trusted proxies. For sites that cannot be upgraded temporarily, they should first collect background permissions and server out-of-network, then make a backup, clean up the cache after the upgrade, and check the pseudo-static rules, rather than just wait for automatic updates.

2026-11-01

Most of the plugin vulnerability weekly reports can be triggered without logging in, how to filter out the ones in use.

The plugin vulnerability weekly report adds hundreds of new items in a week, among which a considerable number can be triggered without login. To filter out the components in use, the sequence is to first establish a component ledger, then filter by whether in use and whether login-free, which can reach two levels of filtering, and finally sort by severity. This article provides the screening method and disposal steps from the weekly report to the personal list.

2026-11-01

The competitors have also added new functions related to AI. Should we change the system when selecting?

Competitor update logs show new AI features, which do not constitute a reason to replace the content management system. The selection should be based on whether this capability can be integrated into the existing editing and publishing process, rather than the names of the features listed. This article provides a four-step verification method and uses already implemented capabilities such as AI automatic tagging and automatic title image matching as a reference.

2026-11-01

How much is the long-term difference between self-built content and hosted website construction, and how is it calculated on an annual basis?

The annual cost of self-built content management and hosting construction should be calculated over the same time span: hosting is a continuous subscription, and self-built is server plus operation and maintenance personnel. This article gives a reusable annual algorithm and potential items that are easy to overlook for three types of websites: construction, marketing websites, and cross-border or multilingual websites.

2026-11-01