PL EN
contact_

Emergency help for WordPress sites: we reply within 4 business hours, Mon–Fri 8:00–18:00 Polish time (CET/CEST), excluding Polish public holidays.

Hacked WordPress site? We remove the malware and close the hole.

We remove the malware and the hidden backdoors attackers leave behind, close the hole they came in through and ask Google to lift its warnings. For individuals and businesses — blogs, company websites and WooCommerce stores. A fixed price before we start, payment after the repair.

Report a hack by email

to:
krzysztof.hoffmann@increase.pl
subject:
[WP-SOS] Hacked WordPress site — request for help
report_a_hack

Your email app opens with a ready-made template — just add your website address. We'll reply with what we see and, if a repair is needed, a fixed price and a start date. Your inquiry and the diagnosis are free and non-binding. Don't send passwords — we'll arrange access securely.

Mon–Fri 8:00–18:00 Polish time (CET/CEST), excluding Polish public holidays; outside these hours, we reply by 12:00 CET/CEST on the next business day

what_to_do_now() pricing()
Repair start
by the next business day at the latest, once you have accepted the offer, given us access and we have confirmed the contract
with express, within 4 business hours
Repair price from
PLN 738
incl. VAT, PLN 600 net
Payment
after the repair
by bank transfer, no deposit
Guarantee
30 days
if the malware comes back, we remove it at no extra cost, subject to the guarantee terms

Malware on your WordPress site? How to spot a hack and what to do right away

One of these signs is enough to act on. You don't need to be sure — that's our job.

42.6% of respondents who had a security incident only found out about it when someone noticed the site behaving strangely.

Source: Melapress, “WordPress Security Survey 2026” (opens in a new tab), September 2026

  • Your site redirects to other sites

    Visitors arriving from Google results or on a phone end up on a casino, lottery or online pharmacy site. The redirect usually doesn't fire every time and skips logged-in users — which is why owners often miss it.

    check: open your site from Google results on your phone

  • Google: “This site may be hacked”

    This message appears next to your site in Google search results. If you use Google Search Console, you'll also see the problem in its “Security issues” report and get an email about it.

  • A red “Dangerous site” screen

    Instead of your site, Chrome — and other browsers that use Google Safe Browsing — shows a red warning and advises visitors not to continue.

  • Spam in Google results

    Hundreds of pages nobody created show up under your address: casinos, pills, counterfeit goods, or Japanese and Chinese characters. Sometimes only Google sees them, while the site itself looks normal.

    check: search Google for site:yourdomain.com

  • A fake “I'm not a robot” check

    Visitors see a pop-up telling them to copy and run a command on their computer, or a message about a “browser update”. It's an attack on them — nobody should run those commands or install that “update”.

  • Unknown admin accounts, or you can't log in

    Your password suddenly stops working, the WordPress dashboard lists accounts nobody created, or an unfamiliar plugin appears. Newer malware can hide an administrator account so that it doesn't show on the Users list.

  • Your host suspended the site, or your emails land in spam

    Your hosting provider reports malware, outgoing spam or unusual server load. If spam was sent from the server, your domain may be on blocklists, and emails you send from it may land in recipients' spam folders.

  • Customers report problems

    Pop-ups and antivirus warnings — and in an online store, a suspicious payment form or card fraud after purchases.

    store

First aid: what to do right away when your site has been hacked

You don't have to do anything on this list — if you're short on time, just write to us. These steps only limit the damage.

Do now, if you can

  1. Take screenshots of warnings, redirects and emails from your host, and note the date and time. It speeds up the diagnosis.
  2. From another, trusted device, change your passwords for WordPress, your hosting control panel and your email.
  3. Run an online store? Pause online payments or switch on maintenance mode — this protects your customers' card details.
  4. Write to us — your website address is enough to start with.

What not to do

  • Don't delete the site or its files yourself — the traces disappear, but the hole stays.
  • Don't restore an old backup before someone has found the hole — the backup has the same hole, and the bots will come back the same way.
  • Don't install random “cleaners” or plugins from unofficial sources (“nulled”).
  • Don't send passwords by plain email — not even to us. We'll suggest a secure way in our reply.

Business or store?

If the attackers could have reached customer data, the data controller must report the breach to the supervisory authority — in Poland, the President of UODO (the Personal Data Protection Office) — without undue delay and, where feasible, within 72 hours of becoming aware of it, unless the breach is unlikely to result in a risk to the people concerned. You assess the risk and decide whether to report; we send you the facts we establish in writing straight away, without waiting for the post-repair report.

paperwork for businesses

Recognize any of these signs?

report_a_hack Not sure? Send us just your website address — we'll check it from the outside, free of charge.

What happens after you email us

This is how we fix a hacked WordPress site: five steps, no surprises. You know the price before we start, and you pay after the repair.

  1. to begin, about 2 minutes

    You write to us

    Click “report a hack” and a ready-made message opens. Add your website address and a few sentences about what you see. No passwords.

    cost: your inquiry and the diagnosis are free and non-binding

  2. within 4 business hours

    Free diagnosis and a fixed price

    We check your site from the outside — the way visitors and Google see it — without logging in and without active scanning. We reply with what we see, which package fits, what it costs and when we can start. If something can't be judged from the outside, we say so plainly.

    you get: an offer by email — a fixed price, a start date and the terms, plus information on your right of withdrawal and a data processing agreement

    What we check in the free diagnosis

    The free initial diagnosis is a check of your site from the outside — the way visitors and Google see it. Without logging in or actively scanning, we look at Google and browser warnings, blocklists, spam in search results, redirects (including ones that only show on a phone or when arriving from Google), suspicious scripts in the page code, and visible versions of WordPress and plugins with known vulnerabilities. We reply within 4 business hours, Mon–Fri 8:00–18:00 Polish time (CET/CEST), excluding Polish public holidays. In our reply, we tell you what we see, which package fits, what it costs — a fixed price, incl. VAT and net — and when we can start. If something can't be judged from the outside, we say so plainly. The diagnosis is free and non-binding; paid work starts only after you accept the offer.

  3. after you accept

    Acceptance and secure access

    You accept the offer by email and authorize us to work on the site. Buying privately? If you want us to start before the 14-day withdrawal period ends, say so in the same reply and confirm that you acknowledge what this means for your right of withdrawal. Without that request, we start only after the 14 days have passed. We confirm the contract by email, and only then do we start.

    how the right of withdrawal works

    you get: a contract confirmation and instructions for giving us access without sending passwords

  4. start by the next business day at the latest; with express, within 4 business hours

    Repair and hardening

    First, a full backup of the files and database. Then we remove the malware and backdoors, find and close the hole the attackers came in through, change passwords and keys, and switch on protection.

    you get: a clean, updated site

  5. pay after handover

    Report, payment and guarantee

    You get a report in plain language and check the site. We ask Google to review the site again. Only then do you pay — by bank transfer, no deposit. A 30-day guarantee runs from the day you receive the report: if the malware comes back, we remove it at no extra cost, subject to its terms.

    guarantee terms

    you get: a report, an invoice (for businesses via KSeF, Poland's national e-invoicing system; for private customers on request) and a 30-day guarantee

Removing the warning is Google's decision. We request a review right after the repair; according to Google's help pages, the review can take from a few days to a few weeks. We follow it through to the end.

Hack repair: how much does WordPress malware removal cost?

The price depends on the type of site, not on the hours spent. We confirm it in the offer after the free diagnosis, before we start. You pay only after the repair.

Show prices for

  • Blog or simple site

    A blog, portfolio, hobby site, association website or simple brochure site — one WordPress installation with no store, online payments or customer accounts.

    PLN 738 incl. VAT incl. 23% VAT PLN 600 net + 23% VAT net

    with express — start within 4 business hours: PLN 1,107 incl. VAT PLN 900 net

    repair: usually on the start day

    Everything on the “in every package” list (below), including:

    • A full backup of the site before we change anything
    • Removal of malware and hidden backdoors
    • Finding and closing the hole the attackers came in through
    • A review request to Google
    • A plain-language report and a 30-day guarantee — subject to its terms
    • A short guide to looking after the site after the repair — even without a care plan
    • A store, online payments and customer accounts — that's the Online store package
    • Server log analysis and an incident report with a timeline — that's the Company website package
    ask_about_a_repair

  • Company website

    A company or organization site with forms, a page builder (e.g. Elementor) or several people with access — and any site for which you need an incident report with a timeline. A simple brochure site falls under the Blog or simple site package.

    PLN 1,476 incl. VAT incl. 23% VAT PLN 1,200 net + 23% VAT net

    with express — start within 4 business hours: PLN 2,214 incl. VAT PLN 1,800 net

    repair: usually 1 business day

    Everything in the Blog or simple site package, plus:

    • Server log analysis: when and how the attackers got in and what they did — a timeline as far as your host keeps logs
    • A review of accounts, permissions, API keys and integrations (forms, CRM, newsletter)
    • A check of your domain's email: SPF, DKIM, DMARC and blocklists
    • An incident report with dates and times — for your management, data protection officer (DPO) or insurer; it contains the facts for your assessment of whether to report the breach to UODO, the Polish data protection authority
    • Contact with your hosting provider or agency, if needed
    • A store, online payments and customer accounts — that's the Online store package
    ask_about_a_repair

  • Online store

    A WooCommerce store: orders, customer accounts and online payments.

    PLN 2,460 incl. VAT incl. 23% VAT PLN 2,000 net + 23% VAT net

    with express — start within 4 business hours: PLN 3,690 incl. VAT PLN 3,000 net

    repair: usually 1–2 business days

    Everything in the Company website package, plus:

    • A check of the cart, checkout page and order database for skimmers — scripts that steal card details
    • New keys for payment gateways and integrations (e.g. couriers) — together with you, in the providers' dashboards
    • Database cleanup without losing orders or customer accounts, and a test order after the repair
    • An assessment of whether customer data may have leaked — facts for your decision on reporting to UODO
    • Work on a staging copy to keep the break in sales short
    • A PCI DSS compliance audit
    • Dealing with your payment provider or bank on your behalf — we prepare the facts and a list of steps
    ask_about_a_repair

How we choose the package

The package depends on the type of site, not on whether you buy as a private person or as a business. We set it in the offer after the diagnosis, based on what is visible from the outside: a store, online payments or customer accounts — Online store; a company or organization site with forms, a page builder or several people with access, and any site for which you need an incident report with a timeline — Company website; any other site — Blog or simple site. If, after logging in, the site turns out to be different from how it looked from the outside (for example, it has a hidden store, is a WordPress Multisite network or runs on custom-built code), we pause the work and send a new offer — nothing is added without your acceptance. In every other case, the accepted price does not change.

In every package

  • A full backup of the files and database before we change anything — we keep it for 30 days, then delete it permanently; on request, we hand it over to you before deletion
  • Removal of malware (malicious code) and hidden backdoors from the files and database
  • A clean reinstall of WordPress, plugins and theme from official sources
  • Removal of unknown admin accounts, suspicious scheduled tasks (cron) and redirects
  • Finding and closing the hole the attackers came in through — otherwise they would come back the same way
  • Hardening: updates, new passwords and keys, two-factor authentication, and file editing from the dashboard switched off
  • Unused WordPress installations on the same hosting account: with your consent, we back them up and switch them off at no extra cost
  • Blocklist checks, a review request to Google and help getting the site unblocked by your host
  • A plain-language report after the repair: what happened and when (as far as it can be established), what we did, whether personal data may have been exposed and what we recommend
  • A 30-day guarantee: if the malware comes back, we remove it at no extra cost — subject to the guarantee terms
  • A data processing agreement (Art. 28 GDPR) — for private customers too

guarantee terms

Extra charges — only these, and only with your consent

  • Express runs during business hours — Mon–Fri 8:00–18:00 Polish time (CET/CEST), excluding Polish public holidays. We start within 4 business hours of your accepting the offer and giving us access. Only business hours count, so an acceptance late on a Friday means a start on Monday morning. We take on express jobs when our calendar allows — we confirm this in the offer, before you accept anything. The surcharge is 50% of the package price; with several sites on one account, we charge it only on the site with the most expensive package. We don't work nights, weekends or public holidays.

  • Each additional infected site on the same hosting account that you want to keep: 50% of its package price — blog or simple site PLN 369 incl. VAT (PLN 300 net), company website PLN 738 incl. VAT (PLN 600 net), online store PLN 1,230 incl. VAT (PLN 1,000 net) per site. You pay the full package price for one site only — the one with the most expensive package. Infections spread between sites on one account, so we clean them together.

  • Unused WordPress installations on that account: with your consent, we back them up and switch them off at no extra cost.

  • Work outside the package scope: PLN 369 incl. VAT (PLN 300 net) per hour. You get a quote first — a fixed amount in whole hours — and we start only after you accept it.

  • We add nothing else. If something outside the package comes up during the work, we hold off on it, tell you what we found and give you the cost — the decision is yours.

Not included in the price

  • Rebuilding the site, new features and design changes
  • Recreating content and orders that aren't in any backup
  • Replacements for removed plugins and themes — abandoned by their authors or from unofficial sources — at the hourly rate, after you accept the quote
  • Licenses for paid plugins and themes — if a new one has to be bought, we ask first
  • Moving the site to another host and upgrading an outdated PHP version — quoted separately, before we start
  • Fixing custom-built code and integrations (e.g. with an ERP) — we check it for infection, then quote fixes at the hourly rate and carry them out after you accept
  • A WordPress Multisite network — we give a fixed price, based on the hourly rate, in the offer before we start
  • Other infected sites on the same hosting account that you want to keep — 50% of each one's package price
  • Securing the computers and mailboxes from which passwords may have leaked — we'll tell you what to check
  • Legal advice, and reports to UODO, a CSIRT, your bank or payment provider on your behalf — we provide the facts; the decision is yours

Payment

  • You pay after the repair, with no deposit. When the work is done, you get the report, check the site and pay the amount in the offer.
  • By bank transfer only, to the account of INCREASE Sp. z o.o., with the offer number in the payment reference.
  • Private customers pay within 7 days of receiving the report; we issue an invoice if you ask for one within 3 months from the end of the month in which we performed the service or received payment.
  • Businesses get a VAT invoice via KSeF, Poland's national e-invoicing system, on the day we deliver the report, payable within 14 days.
  • Extra charges — express, additional sites, work outside the scope — only those you accept before we do the work; payable together with the repair.
  • If, as a consumer, you ask us to start before the 14-day withdrawal period ends and then withdraw before we finish, you pay only for the stages completed: (1) backup and analysis, (2) cleanup and closing the hole, (3) hardening, report and the review request to Google. Each stage is one third of the offer price.

Prices include 23% Polish VAT — INCREASE Sp. z o.o. is an active VAT payer. Business customers from other EU countries with a valid VAT ID are invoiced net (reverse charge). You pay after the repair, by bank transfer. Businesses get a VAT invoice via KSeF; private customers get one on request. For consumers in Poland the Polish version of our offer and terms prevails. paperwork for businesses

WordPress care and maintenance plans — to lower the risk of another hack

New plugin vulnerabilities appear all the time. On a care plan, we update your site, back it up, keep watch over it and respond for you — within the time set in your plan.

With mass-exploited vulnerabilities, hours count: the weighted median time from disclosure to the first exploitation attempt was 5 hours.

Source: Patchstack, “State of WordPress Security in 2026”, 2025 data (opens in a new tab), 25 February 2026

showing: prices incl. VAT, changeshowing: net prices + 23% VAT, change

  • Starter Care

    Blogs, personal sites and simple brochure sites — one site without a store.

    PLN 123 incl. VAT incl. 23% VAT per month PLN 100 net + 23% VAT net per month

    or yearly: PLN 1,230 incl. VAT per year PLN 1,000 net per year (you pay for 10 months)

    response: within 8 business hours

    • One site without a store; a full security scan to begin with — no setup fee
    • Weekly updates of WordPress, plugins and theme — always after a backup; if something stops working, we roll the change back
    • Daily off-server backups, kept for 30 days
    • Daily malware scan and Google warning check
    • Uptime checks every 5 minutes and SSL certificate expiry monitoring
    • A critical vulnerability in WordPress, a plugin or the theme on your site: we install the fix within 2 business days of its release
    • A short monthly report by email
    • hack repair — fixed price: PLN 369 incl. VAT PLN 300 net within the scope of the Blog or simple site package; free if the attackers got in through a hole we should already have patched
    Plan and repair terms

    Within 8 business hours of your report or a monitoring alert, we confirm the problem and start working on the site — in case of an outage, a hack or a critical vulnerability. Business hours: Mon–Fri 8:00–18:00 Polish time (CET/CEST), excluding Polish public holidays. This is the time to start work, not to complete the repair.

    If your site is hacked despite the plan, we clean it up for a fixed PLN 369 incl. VAT (PLN 300 net) — within the scope of the Blog or simple site package, with a report and a 30-day guarantee. We start within the plan's response time once you confirm by email, with no separate quote. If you're buying as a consumer and want us to start within the plan's response time, say in the same email that you ask us to start before the 14-day withdrawal period ends, and confirm that you acknowledge the consequences of that request. Without that request, we start only after the 14 days have passed. You pay nothing if the attackers got in through a hole we should already have patched under the plan. We clean other infected sites on the same hosting account for 50% of their package price, or switch them off at no extra cost; an infection that follows the installation of a plugin or theme from an unofficial source (“nulled”) is removed at repair prices — always after you accept.

    ask_about_a_care_plan

  • Business Care

    Company and organization sites without a store — with the response time written into the contract (SLA) and hack repair included.

    PLN 615 incl. VAT incl. 23% VAT per month PLN 500 net + 23% VAT net per month

    or yearly: PLN 6,150 incl. VAT per year PLN 5,000 net per year (you pay for 10 months)

    response: within 4 business hours, SLA in the contract

    Everything in Starter, plus:

    • Updates tested on a staging copy first
    • A web application firewall (WAF) with virtual patching, login protection and two-factor authentication
    • Backups kept for 90 days and a restore test every quarter
    • Monitoring of blocklists, domain email (SPF, DKIM, DMARC) and domain expiry
    • Critical vulnerability: we install the fix within 8 business hours of its release, and if there is no fix yet, we put temporary protection in place
    • 1 h of small tasks a month — unused time doesn't roll over to the next month
    • hack repair: included — with an incident report and timeline
    Plan and repair terms

    Within 4 business hours of your report or a monitoring alert, we confirm the problem and start working on the site — in case of an outage, a hack or a critical vulnerability. Business hours: Mon–Fri 8:00–18:00 Polish time (CET/CEST), excluding Polish public holidays. We write this time into the contract (SLA). It is the time to start work, not to complete the repair; small tasks are scheduled separately.

    Hack repair is included in the plan price — within the scope of the Company website package, with an incident report and timeline and a 30-day guarantee. We start within the plan's response time. This covers infections that appear after the plan starts; a site that is infected at sign-up first gets a repair at list price. We clean other infected sites on the same hosting account for 50% of their package price, or switch them off at no extra cost — otherwise the infection would come back from them. An infection that follows the installation of a plugin or theme from an unofficial source (“nulled”) is removed at repair prices, after you accept.

    ask_about_a_care_plan

  • Store Care

    WooCommerce stores — with cart and payment protection and hack repair included.

    PLN 1,230 incl. VAT incl. 23% VAT per month PLN 1,000 net + 23% VAT net per month

    or yearly: PLN 12,300 incl. VAT per year PLN 10,000 net per year (you pay for 10 months)

    response: within 2 business hours, SLA in the contract

    Everything in Business, plus:

    • Hourly database backups, including orders and customer accounts
    • Updates on a staging copy with a test order
    • A daily check of the cart and checkout pages: we detect new or changed scripts (skimmers)
    • Critical vulnerability: we install the fix within 4 business hours of its release, and if there is no fix yet, we put temporary protection in place
    • A security review every quarter, with a report
    • 2 h of small tasks a month — unused time doesn't roll over to the next month
    • hack repair: included — within the scope of the Online store package
    Plan and repair terms

    Within 2 business hours of your report or a monitoring alert, we confirm the problem and start working on the store — in case of an outage, a hack or a critical vulnerability. Business hours: Mon–Fri 8:00–18:00 Polish time (CET/CEST), excluding Polish public holidays. We write this time into the contract (SLA). It is the time to start work, not to complete the repair; small tasks are scheduled separately.

    Hack repair is included in the plan price — within the scope of the Online store package: with cart and payment checks, new payment gateway keys, an incident report and a 30-day guarantee. We start within the plan's response time. This covers infections that appear after the plan starts; the other rules — a site infected at sign-up, other sites on the same account, “nulled” plugins — are the same as on the Business plan.

    ask_about_a_care_plan
  • open-ended contract
  • paid in advance: monthly or yearly
  • cancel with one email — the plan ends with the paid month, no fees
  • price or scope changes announced by email at least 30 days ahead — you can cancel before they apply
  • no setup fee
  • data processing agreement (GDPR) with every plan
  • businesses: a VAT invoice via KSeF for each period

A critical vulnerability is one with a CVSS score of at least 9.0 according to the source, or one already exploited in attacks — in a component installed on your site. The deadline runs from the release of the fix. If there is no fix yet, or it fails testing, we put temporary protection in place within the same deadline: a firewall rule (on the Business and Store plans) or — with your consent — deactivating the plugin.

Response time is how soon we confirm the problem and start work — not how long the fix takes. It counts business hours only: Mon–Fri 8:00–18:00 Polish time (CET/CEST), excluding Polish public holidays. At night, on weekends and on public holidays, only automated monitoring and backups run — plus the firewall on the Business and Store plans. Is your site infected right now? We start with a repair from the price list above — the plan begins on a clean site. why_it_matters

Full care plan terms
  1. Open-ended contract, paid in advance — monthly or yearly. You pay for the first period before the plan starts; after that, private customers pay by bank transfer within 7 days of the start of each period, and businesses pay a KSeF VAT invoice within 14 days.
  2. You can cancel at any time with one email. The plan ends at the end of the last paid month, with no cancellation fees.
  3. Yearly payment is 10 monthly fees for 12 months of care. If you cancel during the year, we charge the months already started at the monthly price, up to the amount paid, and refund the rest within 14 days. The price of a paid year does not change.
  4. We change the price or scope only for valid reasons set out in the contract terms. We email you about a change at least 30 days in advance — you can then terminate the contract before the change takes effect.
  5. No setup fee: the plan begins with a full security scan (skipped after a repair by us). A site that is infected when you sign up first gets a paid repair at list price.
  6. One plan covers one site. A site with a store can only have the Store Care plan.
  7. Small tasks from the included hours on Business Care and Store Care are scheduled separately, at an agreed time — the response time applies to outages, hacks and critical vulnerabilities.
  8. Content changes, new features, licenses and hosting are outside every plan — we quote them at the hourly rate, always before starting work.
  9. A data processing agreement (GDPR) comes with every plan. On Business Care and Store Care, you also get a contract with the response time (SLA) and, on request, an NDA.
  10. As a consumer, you can withdraw from the plan contract within 14 days of concluding it. If we started earlier at your request, we refund the fee minus the part for the period in which we were already providing the service.

Prices include 23% Polish VAT — INCREASE Sp. z o.o. is an active VAT payer. Business customers from other EU countries with a valid VAT ID are invoiced net (reverse charge). You pay for the plan in advance, by bank transfer. Businesses get a VAT invoice via KSeF for each period; private customers get one on request.

For individuals and for businesses

The repair is the same — the paperwork differs. We match the package to the type of site, not to who runs it.

Individuals

blogs, hobby sites and portfolios run privately

Prices including VAT
We show prices including VAT — the amount you actually pay.
Fixed price
You know the price before we start: it's in the offer you get after the free diagnosis. Nothing changes without your consent.
Payment after the repair
You pay after the repair, by bank transfer, within 7 days of receiving the report. No deposit.
Invoice on request
We'll issue an invoice if you ask for one within 3 months from the end of the month in which we performed the service or received payment.
Right of withdrawal
The contract is concluded at a distance, so you have 14 days from its conclusion to withdraw without giving a reason. If you want us to start before that period ends, you say so in the email accepting the offer and confirm that you acknowledge the consequences: if you withdraw during the work, you pay only for the stages completed, and once the repair has been fully performed, the right of withdrawal expires. Without that request, we start only after the 14 days have passed. details in the FAQ
A report you can understand
After the repair, we explain in plain language what happened, what we did and how to look after the site from now on. Ask us anything.
Data protection
You get a data processing agreement (GDPR) as a private customer too — your site may hold your readers' data.
report_a_hack

Businesses and online stores

company websites, online stores, associations and other organizations

VAT invoice
A VAT invoice via KSeF, Poland's national e-invoicing system, on the day we deliver the report, payable within 14 days. Prices are net + 23% VAT; the amount incl. VAT is always shown alongside. Business customers from other EU countries with a valid VAT ID are invoiced net (reverse charge).
Contract, SLA and NDA
An order by email is enough; a contract and an NDA on request. On Business Care and Store Care, we write the response time into the contract (SLA), together with rules for when we're unavailable, e.g. due to leave or illness.
Data processing agreement
A data processing agreement (Art. 28 GDPR) — signed before we get access. Our template or yours.
Incident report
In the Company website and Online store packages: a written report with dates and times — when and how the attackers got in, what they did and what data may have been exposed. It supports your assessment of whether to report the breach to the President of UODO, the Polish data protection authority (without undue delay and, where feasible, within 72 hours of becoming aware of it). If data may have been exposed, we send you the facts we establish in writing straight away, without waiting for the full report. The decision is yours as the data controller; your DPO or lawyer can advise you on it. We don't provide legal advice.
National Cybersecurity System (NIS2)
For essential and important entities under the Polish National Cybersecurity System Act (KSC, which implements NIS2), we prepare technical incident documentation useful for reporting to the competent CSIRT. We don't assess whether your company falls under the Act.
Multiple sites
Several sites on one hosting account or in one company: one contract and one invoice; each site at list price.
Hosting and agency
We work with your hosting provider or agency: contact, getting the site unblocked, passing on our recommendations.
One contact
You write directly to the person who repairs the site — no helpdesk, no passing your case around.
ask_for_a_business_quote

For businesses: the post-incident report

sample, fictional data
incident
company website, detected 23 Sep 2026, 07:42 CEST
Entry point
vulnerability in a forms plugin, no login needed
since
22 Sep 2026, 23:14 CEST (server logs)
found
2 hidden backdoors, 1 unknown admin account, 412 spam pages
Personal data
no signs the customer database was read — facts for the DPO to assess
repair
removed, updated, new passwords and keys, 2FA
status
clean, Google warning removed 30 Sep 2026
Sample excerpt from a post-incident report (Company website package). Fictional data — it doesn't relate to any client.

Latest critical vulnerabilities (CVEs) in WordPress and plugins

Once a vulnerability is disclosed, bots soon start looking for sites running the vulnerable version — for the most prominent flaws, within the first few hours. Check whether you use any of these components, and update right away.

Vulnerability
a flaw in the code of WordPress, a plugin or a theme that lets someone break into the site or take control of it.
CVE
a vulnerability's ID in the worldwide registry, e.g. CVE-2026-87902. It makes the vendor's advisory and the fix easy to find.
CVSS
a severity score from 0 to 10. From 9.0 a vulnerability is critical; from 7.0, high. The list also includes vulnerabilities from 7.0 if they affect WordPress core itself or are already being exploited in attacks. The score is assigned by the organization that described the flaw, so we name the source for every entry.

In 2025, 11,334 new vulnerabilities were reported in the WordPress ecosystem — 42% more than a year earlier; 91% of them were in plugins.

Source: Patchstack, “State of WordPress Security in 2026”, 2025 data (opens in a new tab), 25 February 2026

In 2026, the US agency CISA added three vulnerabilities in WordPress core itself to its catalog of vulnerabilities exploited in attacks (KEV): two on 21 July and one on 25 September.

Source: CISA, Known Exploited Vulnerabilities Catalog (opens in a new tab), as of 8 October 2026

List last updated:

Entries on the list: 11. Actively exploited: 7. Without a fix: 0.

Critical vulnerabilities (CVSS 9.0 or higher) in WordPress, plugins and themes published in the NVD between 13 Sep 2026 and 13 Oct 2026: 169. The list picks the most important ones.

How to check your versions: Plugins → Installed Plugins (version below each plugin's description), Appearance → Themes, Dashboard → Updates (WordPress version)

  1. Bricksforge CVE-2026-85097

    CVSS 3.1 score: 9.8 — critical, per Wordfence

    plugin The attack doesn't require logging in. This vulnerability is already being exploited in attacks.

    Without logging in, an attacker can place their own PHP file on the server and run it, taking over the site. Affects the Bricksforge plugin, an add-on for the Bricks site builder.

    What to do: Update the Bricksforge plugin to version 4.0.1 or later, then check for unknown administrator accounts, new PHP files in wp-content/uploads and unfamiliar plugins (also in the mu-plugins folder), because updating alone does not remove an existing infection.

    Affected versions
    ≤ 3.1.8.9
    Fixed version
    4.0.1
    Publication date
    Active installations
    no data (paid component)
    Sources

  2. WordPress CVE-2026-87902

    CVSS 4.0 score: 9.2 — critical, per GitHub (WordPress)

    WordPress core The attack doesn't require logging in. This vulnerability is already being exploited in attacks.

    Without logging in, an attacker can abuse the way WordPress picks page templates to take over the site, if the theme and server setup meet certain conditions.

    What to do: Update WordPress to version 7.1.3 or later (if you stay on an older series such as 6.9.x, to that series' latest release), then check for unknown administrator accounts, new PHP files in wp-content/uploads and unfamiliar plugins (also in the mu-plugins folder), and ask your hosting provider to inspect the /tmp folder, because updating alone does not remove an existing infection.

    Affected versions
    4.7.0–7.1.1
    Fixed version
    7.1.2, 7.0.6, 6.9.9, 6.8.10, 6.7.9, 6.6.9 … 4.7.37
    Publication date
    In the CISA KEV catalog since
    Sources

  3. Ninja Forms CVE-2026-94504

    CVSS 3.1 score: 7.2 — high, per Wordfence

    plugin The attack doesn't require logging in. This vulnerability is already being exploited in attacks.

    Without logging in, an attacker can send a form entry with a hidden script that runs with the rights of any administrator who opens it for editing, for example to create a hidden administrator account.

    What to do: Update the Ninja Forms plugin to version 3.15.5 or later (3.15.4 fixes this flaw, 3.15.5 also a similar one), then check for unknown administrator accounts, new PHP files in wp-content/uploads and unfamiliar plugins (especially in the mu-plugins folder — in this campaign the attacker's account may be hidden from the Users list), because updating alone does not remove an existing infection.

    Affected versions
    ≤ 3.15.3
    Fixed version
    3.15.4
    Publication date
    Active installations
    500k+
    Sources

  4. Gravity Forms CVE-2026-84434

    CVSS 3.1 score: 9.8 — critical, per Wordfence

    plugin The attack doesn't require logging in.

    If a published Gravity Forms form has a File Upload field set to Hidden, an attacker who is not logged in can use it to upload a dangerous file and, on some server setups, take over the site.

    What to do: Update the Gravity Forms plugin to the latest version (this flaw was fixed in 3.1.1, but later releases contain further security fixes; moving from 2.x to 3.x has to be started manually) and, as a precaution, check wp-content/uploads for unfamiliar PHP files.

    Affected versions
    ≤ 3.1.0.4
    Fixed version
    3.1.1
    Publication date
    Active installations
    1M+, estimate by Wordfence
    Sources

  5. The Events Calendar CVE-2026-78006

    CVSS 3.1 score: 9.8 — critical, per Wordfence

    plugin The attack doesn't require logging in. This vulnerability is already being exploited in attacks.

    If visitors can comment on events, an attacker who is not logged in can use such a comment to run their own code on the server and take over the site. Comment moderation does not prevent this.

    What to do: Update The Events Calendar plugin to the latest version (this flaw was fixed in 6.17.4.1, but later releases contain further security fixes), then check for unknown administrator accounts, new PHP files in wp-content/uploads and unfamiliar plugins (also in the mu-plugins folder), because updating alone does not remove an existing infection.

    Affected versions
    ≤ 6.17.4
    Fixed version
    6.17.4.1
    Publication date
    Active installations
    600k+
    Sources

  6. Avada + Avada Builder (Fusion Builder) CVE-2026-18431

    CVSS 3.1 score: 9.8 — critical, per Wordfence

    theme The attack doesn't require logging in.

    Without logging in, an attacker can place their own PHP file on the server and run it, taking over a site that uses the Avada theme and Avada Builder plugin. Whether a site is exposed depends on its content.

    What to do: Update the Avada theme and the Avada Builder plugin together to versions 7.16.2 and 3.16.2 or later (7.16.1 and 3.16.1 already fix this flaw, but plugin version 3.16.1 has another critical one).

    Affected versions
    Avada ≤ 7.16 + Avada Builder ≤ 3.16
    Fixed version
    Avada 7.16.1 + Avada Builder 3.16.1
    Publication date
    Active installations
    no data (paid component)
    Sources
Show older entries (5)

  1. Elementor Pro CVE-2026-32475

    CVSS 3.1 score: 9.0 — critical, per Patchstack

    plugin The attack doesn't require logging in. This vulnerability is already being exploited in attacks.

    If a published Elementor Pro form has a file upload field, an attacker who is not logged in can use it to upload a malicious PHP file and take over the site.

    What to do: Update the Elementor Pro plugin to version 4.2.2 or later (this requires an active license), then check for unknown administrator accounts, new PHP files in wp-content/uploads (especially in elementor/forms) and unfamiliar plugins (also in the mu-plugins folder), because updating alone does not remove an existing infection.

    Affected versions
    ≤ 4.2.1
    Fixed version
    4.2.2
    Publication date
    Active installations
    6M+, estimate by Wordfence
    Sources

  2. W3 Total Cache CVE-2026-18051

    CVSS 3.1 score: 10.0 — critical, per CISA-ADP

    plugin The attack doesn't require logging in.

    If the page cache runs in “Disk: Enhanced” mode, an attacker who is not logged in can make the plugin write files into any folder on the server, which can take the site offline and disable some of its protections.

    What to do: Update the W3 Total Cache plugin to the latest version (this flaw was fixed in 2.10.5, but later releases contain further security fixes).

    Affected versions
    ≤ 2.10.4
    Fixed version
    2.10.5
    Publication date
    Active installations
    900k+
    Sources

  3. Forminator CVE-2026-15748

    CVSS 3.1 score: 9.8 — critical, per Wordfence

    plugin The attack doesn't require logging in.

    If a published Forminator form has both a file upload field and a dropdown (Select) field, an attacker who is not logged in can use it to upload a PHP file and, on some server setups, take over the site.

    What to do: Update the Forminator plugin to the latest version (this flaw was fixed in 1.56.2, but later releases fix further critical flaws) and, as a precaution, check wp-content/uploads for unfamiliar PHP files.

    Affected versions
    ≤ 1.56.1
    Fixed version
    1.56.2
    Publication date
    Active installations
    600k+
    Sources

  4. MonsterInsights Pro CVE-2026-11976

    CVSS 3.1 score: 10.0 — critical, per WPScan

    plugin The attack doesn't require logging in. This vulnerability is already being exploited in attacks.

    In June 2026 the update server of the paid MonsterInsights Pro plugin served tampered versions 10.2.0 and 10.2.2 with a backdoor that allows a site takeover without logging in, for example by adding an administrator account.

    What to do: Download the latest MonsterInsights Pro (11.0.0 or later) from your account on the vendor's website and install it manually (an infected copy may hijack updates from the WordPress dashboard), then check for unknown administrator accounts, new PHP files in wp-content/uploads and unfamiliar plugins (also in the mu-plugins folder), because updating alone does not remove a backdoor that is already on the site.

    Affected versions
    10.2.0–10.2.2
    Fixed version
    11.0.0
    Publication date
    Active installations
    no data (paid component)
    Sources

  5. WordPress CVE-2026-63030

    CVSS 3.1 score: 9.8 — critical, per WPScan

    WordPress core The attack doesn't require logging in. This vulnerability is already being exploited in attacks.

    Together with CVE-2026-60137, this flaw forms the “wp2shell” chain, which lets an attacker who is not logged in create an administrator account and run their own code, even on plain WordPress 6.9 or 7.0 with no plugins.

    What to do: Update WordPress to version 7.1.3 or later (if you stay on the 7.0.x or 6.9.x series, to at least 7.0.7 or 6.9.10), then check for unknown administrator accounts (especially any created since 17 July 2026), new PHP files in wp-content/uploads and unfamiliar plugins (also in the mu-plugins folder), because updating alone does not remove an existing infection.

    Affected versions
    6.9.0–6.9.4, 7.0.0–7.0.1
    Fixed version
    7.0.2, 6.9.5
    Publication date
    In the CISA KEV catalog since
    Sources

Running a vulnerable version of any of these — a plugin, a theme or WordPress itself? Update it now. Not sure how, or worried something will stop working? We'll check for free whether your site uses any of them.

check_my_site On a care plan, we patch critical vulnerabilities for you — on the Business plan within 8 business hours of the fix's release
How to read this list and how we choose entries

Labels

critical
CVSS score 9.0–10
high
CVSS score 7.0–8.9
actively_exploited
the vulnerability is in the CISA KEV catalog, or attacks have been confirmed by the vendor or a security research firm
no_login_needed
an attacker doesn't need an account on the site
new
entry added in the last 14 days
no fix yet
the vendor hasn't yet released a version that removes the flaw

Selection rules

We list vulnerabilities published in roughly the last 90 days if they meet at least one of these conditions:

  1. they affect WordPress core itself and have a CVSS score of at least 7.0;
  2. they are in the CISA KEV catalog, or their exploitation in attacks has been confirmed by the vendor or a security research firm — with a score of at least 7.0;
  3. they have a score of at least 9.0, need no login and affect a plugin or theme with at least 10,000 active installations, or a popular paid plugin.

The list has 6 to 12 entries, newest first. For each entry we give one CVSS score and who assigned it (e.g. Wordfence, Patchstack, WPScan or NVD) — different sources may score the same flaw differently.

Sources

We use the NVD (NIST), the CISA KEV catalog and the ENISA EUVD database, plus advisories from vendors and WordPress security research firms (including Wordfence, Patchstack and WPScan). Source links are given with each entry.

This list is for information only and is no substitute for an audit. We write the descriptions ourselves, in plain language, and don't publish attack details or exploit code. We check versions on the day the list is updated — read the vendor's advisory before changing anything on your site.

This product uses the NVD API but is not endorsed or certified by the NVD.

Frequently asked questions

Repair and care plans

How much does it cost to remove malware from a WordPress site?

The price depends on the type of site, not on the hours spent: blog or simple site — PLN 738 incl. VAT (PLN 600 net), company website — PLN 1,476 incl. VAT (PLN 1,200 net), online store — PLN 2,460 incl. VAT (PLN 2,000 net). We set the package in the offer after the free diagnosis.

You pay extra only for express, additional infected sites on the same hosting account or work outside the package — and only if you accept it in advance.

Can the price go up during the work?

Not without your consent. If, after logging in, the site turns out to be different from how it looked from the outside — for example, it has a hidden store, is a WordPress Multisite network or runs on custom-built code — we pause the work and send a new offer; nothing is added without your acceptance. In every other case, the accepted price does not change.

The same goes for work outside the package: you get a quote in whole hours first, and we start only after you accept it.

How long does the repair take?

The repair itself usually takes: blog or simple site — a few hours (we usually finish on the start day); company website — about one business day; online store — one to two business days.

Without express, we start by the next business day at the latest after you accept the offer, give us access and we confirm the contract. With express, we start within 4 business hours if our calendar allows — we confirm this in the offer. If you're buying privately and want us to start before the 14-day withdrawal period ends, say so in the email accepting the offer and confirm that you acknowledge what this means for your right of withdrawal. Without that request, we start only after the 14 days have passed.

We reply within 4 business hours, Mon–Fri 8:00–18:00 Polish time (CET/CEST), excluding Polish public holidays. Messages sent outside these hours — in the evening, at night, over the weekend or on a public holiday — are read at the start of the next business day and answered by 12:00 CET/CEST. We don't work nights, weekends or public holidays and have no on-call service then; only automated monitoring and backups run for sites on a care plan — plus the firewall on the Business and Store plans.

Will I lose posts, images or orders?

Before we change anything, we make a full backup of the files and database. We keep it for 30 days, then delete it permanently; on request, we hand it over to you before deletion.

We remove the malware and whatever the attackers added — your posts, images, orders and customer accounts stay. If a plugin or theme has to go because its author abandoned it or it came from an unofficial source, we'll tell you, and quote a replacement separately. If the attackers deleted something, we restore it from a backup made before the hack, if one exists. Content that isn't in any backup can't be recreated.

How do I give you access without sending passwords?

In our reply to your inquiry, we explain a secure way, step by step. Usually you create a temporary WordPress administrator account for us, and share hosting access through a separate account in your control panel or a one-time, expiring link.

Before we log in or run an active scan, we ask for written authorization and confirmation that the site is yours or that you act on the owner's behalf. Until then, we check only what is publicly visible — without logging in and without active scanning.

As part of the repair, we change the passwords and keys on the site. When we're done, we'll also ask you to change your hosting and email passwords and to remove our access.

What if the hack comes back?

A guarantee applies for 30 days from the day you receive the report: if malware comes back on a site we cleaned, we remove it at no extra cost and find the cause. Just email us — we start work on a guarantee claim within 4 business hours.

Conditions: the recommendations in the report have been implemented (updates, new passwords, two-factor authentication switched on), and there are no plugins or themes from unofficial sources (“nulled”) on the site.

The guarantee doesn't cover infections that get in: from other sites on the same hosting account that we didn't clean; through vulnerabilities in components installed after our work; through access you give to third parties after the repair. The guarantee does not limit your statutory rights.

Why do we search so thoroughly? The most common cause of reinfection is incomplete cleanup — missed backdoors (GoDaddy, “Annual Cybersecurity Report”, 2025 data).

How soon will the Google warning disappear?

We request a review in Google Search Console right after the repair; if you don't use Search Console yet, we'll help you add your site to it. According to Google's help pages, a review can take from a few days to a few weeks.

We can't speed Google up, but we follow it through to the end. We check other services' blocklists separately.

Do I have to buy a care plan after the repair?

No. Hack repair is a one-off service — it includes a short guide to looking after the site yourself. After a one-off repair, we don't monitor the site; we do that only on a care plan.

A care plan is an option for people who'd rather have someone update the site, make backups and respond to new vulnerabilities for them. Care plans start at PLN 123 a month incl. VAT (PLN 100 net). The contract is open-ended: you cancel with one email, and the plan ends with the paid month, with no fees.

Why did this happen — is it my fault?

Usually not. Hacks are largely the work of bots that search around the clock for sites with a known vulnerability. They don't pick their victims — they hit small blogs and large companies alike. WordPress runs 73.3% of .pl websites whose content management system can be identified (W3Techs, 12 October 2026), so it's a frequent target.

Typical causes are an outdated plugin or theme, a plugin from an unofficial source, a stolen password or an infected neighboring site on the same hosting. In the report, we'll tell you what caused it in your case — as far as it can be established.

Do you work with my hosting provider or agency?

Yes. In every package we help get the site unblocked by your host: we prepare a summary of what we removed and a request to unblock it. In the Company website and Online store packages, we contact your host or agency directly if needed — with your authorization.

You don't have to change hosts. Moving the site to another host is quoted separately — only if you want it.

My site doesn't run on WordPress. Can you help?

This offer and its fixed prices cover WordPress sites, including WooCommerce stores. If your site runs on another system — e.g. Joomla, Drupal or PrestaShop — or is custom-built, write to us anyway: we'll tell you honestly whether we can help and, if so, prepare a separate quote before we start.

Not sure what your site runs on? We'll find out in the free diagnosis.

Consumer rights, invoices and GDPR

I'm buying privately — can I withdraw from the contract?

Yes. The contract is concluded at a distance, by email, so as a consumer you have 14 days from its conclusion to withdraw without giving a reason. An email is enough; we attach a model withdrawal form to the offer.

A hack usually can't wait two weeks. If you want us to start sooner, you say so in the email accepting the offer and confirm that you acknowledge two things: once the repair has been fully performed, the right of withdrawal expires; and if you withdraw during the work, you pay only for the stages completed — (1) backup and analysis, (2) cleanup and closing the hole, (3) hardening, report and the review request to Google; each is one third of the offer price. Without that request, we start only after the 14 days have passed.

This request has nothing to do with the paid express option — it applies to every order placed by a consumer.

Care plans work in a similar way: if you withdraw within 14 days, we refund the fee minus the part for the period in which — at your request — we were already providing the service.

I'm a sole proprietor. What rights do I have?

Under Polish law, if the contract isn't professional in nature for you — say, you run a bakery, not an IT company — you have the right of withdrawal and protection against unfair contract terms on the same basis as a consumer. The right of withdrawal then works just as it does for private customers, including the request for an earlier start.

You may tell us whether the contract is professional in nature for you, but you don't have to — it doesn't affect whether we take on the job. We'll issue the invoice to your business, via KSeF.

How do payment and invoicing work?

You pay for the repair once it's finished, with no deposit, by bank transfer only, to the account of INCREASE Sp. z o.o. — with the offer number in the payment reference.

Businesses get a VAT invoice via KSeF on the day we deliver the report, payable within 14 days. Private customers pay within 7 days of receiving the report; we issue an invoice if you ask for one within 3 months from the end of the month in which we performed the service or received payment.

Care plans are paid in advance — monthly or yearly. Businesses get a VAT invoice via KSeF for each period. Business customers from other EU countries with a valid VAT ID are invoiced net (reverse charge).

Will you help with a data breach notification to UODO?

Yes, with the technical part. If the attackers could have reached personal data, we promptly send you written information with dates and times: what we've established about when and how the break-in happened, what data may have been exposed and what we did. A full incident report with a timeline is included in the Company website and Online store packages.

Assessing whether the breach must be reported to the President of UODO, the Polish data protection authority — without undue delay and, where feasible, within 72 hours of becoming aware of it — and whether to inform the people whose data is affected is up to the data controller, which means you; your DPO or lawyer can advise you on it. We don't provide legal advice or file notifications on your behalf.

This can apply to a private blog too, if it collects other people's data — e.g. through a contact form or a newsletter.

Will you sign a data processing agreement and an NDA?

Yes. During a repair or a care plan we may have access to personal data on your site — user accounts, orders, form messages. We process it only on your behalf, under a data processing agreement (Art. 28 GDPR). We attach one to every offer, for private customers too, and sign it before we get access — on our template or yours.

We sign an NDA on request. We keep the backup of your site made before the repair for 30 days, then delete it permanently.

Tell us what's happening. We'll take care of the rest.

Send us an email — your website address and a few sentences are enough. Your inquiry and the initial diagnosis are free and non-binding. We send a binding offer by email, and paid work starts only after you accept it.

Report a hack by email

to:
krzysztof.hoffmann@increase.pl
subject:
[WP-SOS] Hacked WordPress site — request for help
report_a_hack

Your email app opens with a ready-made template — just add your website address. We'll reply with what we see and, if a repair is needed, a fixed price and a start date. Your inquiry and the diagnosis are free and non-binding. Don't send passwords — we'll arrange access securely.

Mon–Fri 8:00–18:00 Polish time (CET/CEST), excluding Polish public holidays; outside these hours, we reply by 12:00 CET/CEST on the next business day

Email app didn't open? Copy the ready-made text

Copy the address and text into your email (e.g. Gmail, Outlook.com, Yahoo Mail).

open in Gmail

What to include in your message

  • your website address
  • what you see and since when — screenshots help a lot
  • who hosts your site, if you know
  • whether the site has a store or customer data
  • whether you're buying privately or as a business (company name and tax ID)
  • phone number — optional

Don't include passwords — we'll arrange access securely.

When we reply

We reply within 4 business hours, Mon–Fri 8:00–18:00 Polish time (CET/CEST), excluding Polish public holidays. Messages sent outside these hours — in the evening, at night, over the weekend or on a public holiday — are read at the start of the next business day and answered by 12:00 CET/CEST. We don't work nights, weekends or public holidays and have no on-call service then; only automated monitoring and backups run for sites on a care plan — plus the firewall on the Business and Store plans. Before we reply, you can limit the damage with the steps in the “first aid” list — but you don't have to.

first aid

Not about a hack — interested in a care plan or a business quote?

Who replies

Krzysztof Hoffmann

INCREASE Sp. z o.o., WordPress site repair and care

Answers your message and handles your case through to the final report.

INCREASE — an engineering-grade digital studio from Wrocław (design, code, AI, social media), 10+ years of experience.

reply
We reply within 4 business hours, Mon–Fri 8:00–18:00 Polish time (CET/CEST), excluding Polish public holidays.
Outside business hours
by 12:00 CET/CEST on the next business day
Repair start
next business day, express: within 4 business hours
Care plans
response within 8 / 4 / 2 business hours (Starter / Business / Store)
languages
Polish, English
coverage
remotely across Poland; abroad on request

Company details

name
INCREASE Sp. z o.o.
address
ul. Klecińska 182, 54-412 Wrocław, Poland
Registry court
Sąd Rejonowy dla Wrocławia-Fabrycznej we Wrocławiu, VI Wydział Gospodarczy KRS (District Court for Wrocław-Fabryczna in Wrocław, 6th Commercial Division of the National Court Register)
KRS (National Court Register) number
0000417210
NIP tax ID
8992734872
Statistical ID (REGON)
021858005 (REGON)
Share capital
PLN 50,000.00
VAT
active VAT payer (Poland)
email
krzysztof.hoffmann@increase.pl

Complaints and disputes

We accept complaints and statements of withdrawal by email at krzysztof.hoffmann@increase.pl or by post at our registered office address. We reply to complaints by email within 14 days. Information on out-of-court resolution of consumer disputes is available (in Polish) at polubowne.uokik.gov.pl (opens in a new tab). For consumers in Poland the Polish version of our offer and terms prevails.

Your personal data

The controller of the personal data in your message is INCREASE Sp. z o.o., ul. Klecińska 182, 54-412 Wrocław, Poland, email: krzysztof.hoffmann@increase.pl. We process it to answer your inquiry, prepare an offer and perform the contract (Art. 6(1)(b) GDPR); to issue invoices and keep accounting records, as tax law requires (Art. 6(1)(c) GDPR); and in our legitimate interest, to contact you about your inquiry and to establish, exercise or defend legal claims (Art. 6(1)(f) GDPR). We keep data from an inquiry that did not lead to a contract for as long as we need to handle it; client data until claims become time-barred and for as long as tax law requires. Recipients may include the IT and email service providers we use and, for clients, also our accounting provider and the tax authorities (invoices in KSeF, Poland's national e-invoicing system). Some providers, including our email provider, may process data outside the European Economic Area, e.g. in the USA — on the basis of a European Commission adequacy decision or standard contractual clauses; you can ask us by email for a copy of these safeguards. You have the right to access your data, to have it rectified or erased, to restrict its processing and to data portability, as well as the right to lodge a complaint with the President of the Personal Data Protection Office (UODO). You also have the right to object at any time — on grounds relating to your particular situation — to processing based on our legitimate interest. Providing your data is voluntary, but without it we can't answer your inquiry or conclude a contract.

We reply within 4 business hours, Mon–Fri 8:00–18:00 Polish time (CET/CEST), excluding Polish public holidays.

report_a_hack