WordPress specialist in Istanbul: Who handles errors, hacks, and maintenance, and in what order?

In what order are multiple problems resolved?

Security comes first, then access, then restoring functionality; speed and appearance come last. This sequence prevents work performed at one step from being undone at the next.

1. Security: If there are hack symptoms, address them first. Speed or design work performed while malware remains must be revisited during cleanup.
2. Access and ownership: Clarify who holds hosting, domain, WordPress administrator, and Search Console access.
3. Functionality: Resolve critical errors, database errors, or white screens.
4. Backups and updates: Back up the working state and perform updates in a controlled way.
5. Speed: Measure first, then begin improvements.
6. Migration, content, and design: Planned work proceeds on a website with a sound foundation.

Official documents also show the reasoning for this sequence. WordPress.org’s “my site was hacked” FAQrecommends upgrading WordPress to the current version after cleaning and changing passwords again after cleanup, even if changed when the hack was first noticed. The WordPress updating documentation also requires a backup before starting. If hosting will change after hack cleanup, migration follows completed recovery; otherwise infected files are transferred to the new server too.

Working arrangements in Istanbul: Gülsuyu, Maltepe, both sides, in person or remotely

Technical WordPress work is performed remotely using administration and hosting access; Istanbul businesses can meet in person if desired. The working base is in Gülsuyu Mahallesi, Maltepe, with meetings by appointment.

Gülsuyu is accessible for businesses on the Anatolian Side: the M4 Kadıköy–Sabiha Gökçen Havalimanı line has a station sharing the neighborhood’s name. Businesses on both sides of Istanbul can meet in person by appointment, while those in other cities and abroad work online. An office meeting is an option for businesses seeking a WordPress specialist around Maltepe who want to demonstrate the problem on screen.

Situations where an in-person meeting truly makes a difference are limited; since technical intervention is performed online, being on site does not speed up repair. The main useful situations are:

• When ownership of hosting, domain, and administrator accounts is unclear and an access list will be prepared together
• When employees need a demonstration of daily administration panel use
• When several tasks, such as the website, maintenance, SEO, and advertising, will be planned together

WhatsApp and phone lines are open daily from 09:00 to 21:00; messages left outside these hours are answered in order when working hours begin. Address: Gülsuyu Mah. Güleken Sk. No:6 D:1, 34848 Maltepe/İstanbul. The SEO side of the same local working arrangement, including district- and side-based searches, is explained on the Istanbul SEO agency page.

Emergency WordPress support: The first 30 minutes before reaching a specialist

In an emergency requiring WordPress support, the first half-hour aims to record the situation, prevent further damage, and collect information allowing a specialist to start quickly, rather than repair it. None of these steps requires coding knowledge.

1. Write down the symptom: Note what appeared, when it was noticed, and the last change (new plugin, theme setting, update). WordPress.org describes this record as the basis of an incident report, whether the business or a specialist intervenes.
2. Avoid rushed changes: Deleting plugins, reinstalling the website, or restoring an old backup without testing can erase evidence.
3. Check email for critical error messages: According to WordPress’s common errors documentation, when this message appears, first check the website administrator’s inbox for error details.
4. Notify the hosting company: Ask about backup availability and server-side outages. WordPress.org says the host can confirm whether the problem is a genuine attack or a service outage.
5. Do not repeatedly open suspicious pages: Google’s Security Issues report documentationwarns that opening a malware-containing page in a browser can harm the computer.
6. Prepare an access list: Record who holds hosting panel, domain provider, WordPress administrator, and Search Console access.
7. Copy website information: If administration is accessible, the Site Health screen’s Info tab export feature copies website information, including themes, plugins, and media, to the clipboard; this text can be sent to the specialist.

If hacking is suspected, add a backup of the infected state, administrator password resets, and a scan of the computer used to access the website. These steps are also explained in the first-30-minutes list on the hacked WordPress website recovery page.

If the website is hacked: A brief roadmap

Work on a hacked WordPress website proceeds in three stages: limit damage, find the entry point and clean up, then renew access credentials and request a Google review. The recovery guide contains the detailed process; only decision points appear here.

Google’s hacked-sites series “quarantine your site” guiderecommends closing the website to visitors during cleanup, preferably with a 503 response served outside the infected server. It also notes that robots.txt blocks only search engine crawlers while visitors can still reach harmful content; it states that temporarily taking the website offline during recovery is unlikely to affect search rankings. After cleanup, request a review through Search Console’s Security Issues report; Google says reviews can take from a few days to a few weeks.

Guides to consult by symptom:

• If unsure whether there is a hack: How can you tell whether a WordPress website is hacked?
• If visitors go to spam websites: WordPress hack redirects
• If malware or virus warnings appear: WordPress virus removal
• For the full process, Google warnings, and lasting protection: hacked website recovery

Safe access for specialists: Temporary accounts and revoking permissions

Do not share the main administrator password with a WordPress specialist; create a personalized temporary user account and delete it when the work ends. The same principle applies to hosting, domains, and Search Console: everyone uses their own account with only the permissions needed.

WordPress administration panel

According to WordPress’s roles and capabilities documentation, an Administrator accesses all administration features on a single site, while an Editor can publish and manage posts, including those of other users. Troubleshooting and hack cleanup generally require Administrator access because they involve plugin and theme management; Editor is sufficient for content entry only. The Profile screen has a button to end account sessions on other devices such as phones or shared computers; use it to close sessions left open on a shared account.

After work, delete the temporary account from the Users screen. According to the Users screen documentation, WordPress asks whether to delete that user’s posts and links or attribute them to someone else; choose attribution if the specialist created content.

Hosting, domain, and Search Console

On hosting, create a separate FTP or SFTP account for the specialist if the provider allows it. WordPress’s hardening documentationrecommends SFTP, which encrypts passwords and data in transit, if the host offers it. In Search Console, the specialist can receive user permissions rather than ownership; according to Google’s managing users and permissions documentation, owners can add and remove users, full users see all data and perform some actions, and restricted users mainly view most data.

Revoking permissions after completion

1. Delete the temporary WordPress account, assigning any content to another user.
2. Close the specialist’s FTP/SFTP account or change its password.
3. Remove the added Search Console user.
4. After hack cleanup, follow WordPress.org’s advice and change FTP, hosting panel, database, and WordPress passwords once more.
5. Enable two-step verification for administrator accounts; the hardening documentation recommends this in addition to strong passwords.

Questions to ask when choosing a WordPress specialist

Process questions matter more than technical terms when choosing a specialist in Istanbul: how the issue will be diagnosed, whether backups precede work, how access is requested, and what is delivered afterward. Google’s building a support team guidesays resolving the problem yourself requires reading code, command-line tools, and server configuration knowledge, and recommends qualified professional help without those skills.

• Are files and databases backed up before any changes, and where are backups stored?
• How is access requested: Through a temporary account or the main administrator password?
• Does hack cleanup investigate the entry point, or merely delete visible files?
• Are updates tried on a test copy before the live website?
• Is there a written completion report: What changed, and which risks remain?
• In whose name are hosting and domain accounts opened?
• Will licensed themes and plugins come from official sources?
• Is the fee stated before inspection, or documented after scope is assessed?
• Can a real address and listings on independent profiles be verified externally?

There are also warning signs: promising results without seeing the website, requesting the main password in the first message, and failing to document the work. Onur Freelance is listed under the same name and address on Google Maps, Clutch, Sortlist, TechBehemoths, and LinkedIn. Founder Onur Ertem has over 8 years of experience in this field, and the team has three people; details appear on the about us page.

Maintenance or one-time intervention? Decision table

One-time intervention resolves an existing problem; monthly maintenance reduces the likelihood of problems. The choice depends on how critical the website is, how often it changes, and when the last sound backup was taken.

Backup frequency is central to the decision. WordPress’s backup documentationrecommends weekly backups for websites with little content, daily backups for busy websites, and at least 3–5 current backups stored in different locations. The hardening documentation’s example reaches the same conclusion: with weekly full backups, copies predating an attack on the 1st, discovered only on the 12th, remain available.

At Onur Freelance, WordPress maintenance is optional and costs 500–2,000 TL per month; the amount depends on website size and scope. It includes pre-update backups, core, theme, and plugin updates, security and functionality checks, form tests, and monthly reports. Maintenance can also be added to websites built by another company after technical review; details appear on the website management and WordPress maintenance and updates pages.

The difference between common practice and planned WordPress support

In common practice, WordPress support is called when a problem occurs, closes the issue, and leaves. Planned support documents every intervention and makes the next task easier. Common mistakes and the correct approach are as follows:

• Hiding the symptom: Find the conflict’s source rather than simply disabling the failing plugin and moving on.
• Intervening without backups: Take a backup before every change and test that it can be restored.
• Sending the main password by message: Create a personalized temporary account and delete it afterward.
• Only installing a security plugin after a hack: Close the entry point and change passwords again after cleanup.
• Keeping unused plugins disabled: The hardening documentation recommends deleting unused plugins from the system.
• Editing theme and plugin files through administration: The same document says the dashboard file editor is often the first tool used by an attacker who can log in; disable it using DISALLOW_FILE_EDIT.
• Displaying errors on the live website: Use the settings in WordPress’s debugging documentation to write errors to debug.log without showing them to visitors.

Documentation is another benefit of planned support: knowing when each plugin was updated and why settings changed makes tracing faults appearing months later much faster.

What determines WordPress support fees?

Hack cleanup costs 3,000–10,000 TL depending on the situation; troubleshooting fees depend on the issue’s scope. Preliminary review is free, and the exact fee is shared in a written quote afterward. Optional monthly maintenance is the only item with a fixed defined range.

WordPress troubleshooting uses the same method inside and outside Istanbul; the main factors determining the quote are:

• Whether the source is the server or application
• Whether a current clean backup exists
• For hacks, whether infection reached the database, how many files are affected, and whether there is a Google warning
• Whether the website has sensitive functions such as WooCommerce, memberships, or appointments
• Number of plugins and themes, and their licensing
• Whether required access is ready

Hosting and domain accounts are opened in the business’s name, and primary credentials remain with it. An unclear fee at the first meeting may seem uncertain, but a fixed figure given without seeing the website is often unnecessarily high or leads to a scope dispute halfway through.