Proudly Canadian 
A compromised website on Canadian hosting has consequences beyond the immediate disruption. Under PIPEDA, if the breach exposed personal information about identifiable individuals, you may have notification obligations. Under Law 25, the same applies with additional reporting requirements to the Commission d'accès à l'information. Search engines flag malware-infected sites with warnings that hurt rankings for weeks after cleanup. Getting the recovery right the first time matters more than doing it quickly.
Confirming the compromise and understanding what happened
Before cleaning anything, understand what you are dealing with. Google Search Console sends alerts when Googlebot detects malware. Run your domain through Google's Safe Browsing checker at transparencyreport.google.com/safe-browsing/search and through Sucuri SiteCheck at sitecheck.sucuri.net. Review your server access logs for the period immediately before the problem. Most compromises leave a clear trail: a series of requests to a vulnerable plugin file, a POST to a PHP file that should not accept POST data, or a flood from an IP that does not appear in normal traffic. Knowing the entry point tells you what to patch, which prevents reinfection after cleanup.
The correct recovery sequence
Step one: take the site offline or put it in maintenance mode. Step two: back up everything before touching anything, including infected files, for forensic analysis. Step three: identify all modified and injected files. Run a file integrity check against your theme and plugin files using WP-CLI or Wordfence's file scan. Files modified more recently than your last legitimate deployment are suspect. Look for PHP files in the uploads directory (there should be none), obfuscated PHP code (base64_decode, eval() constructs), and files with names designed to look like WordPress core files but are not.
Cleaning a WordPress site on Canadian hosting
Replace all core files, themes, and plugins with clean downloads from wordpress.org rather than trying to identify individual malicious files. Download a fresh copy of WordPress core and replace wp-admin and wp-includes entirely. Download fresh copies of each plugin and theme. Keep the uploads directory and wp-config.php from the compromised installation only after inspecting uploads for injected PHP files. After replacing files, change all credentials: WordPress admin passwords for every admin account, database password, FTP and SFTP credentials, and hosting control panel credentials. Check for unfamiliar admin accounts created by the attacker.
Patching the entry point
Identify the exploited vulnerability and patch it before bringing the site back online. If it was a known plugin vulnerability, update the plugin. If it was a brute-force compromise, implement login rate limiting and two-factor authentication. If it was a file upload vulnerability allowing PHP in uploads, add a server-level rule:
RewriteRule ^wp-content/uploads/.*\.php$ - [F,L]
Bringing a site back online before patching the entry point results in reinfection within hours in most cases.
PIPEDA and Law 25 obligations after a breach
Assess whether notification is required if the compromise involved unauthorized access to personal information. Under PIPEDA, report privacy breaches creating a real risk of significant harm to the Office of the Privacy Commissioner and notify affected individuals. Under Law 25, notify both the Commission d'accès à l'information and affected individuals when a privacy incident presents a risk of serious injury. Document the incident, cause, remediation steps, and your assessment of what personal information may have been exposed.
Gotekky
Need help deciding what to do next?
Tell us what you are seeing and what outcome you need. We will identify whether a managed service, scoped project or paid technical assessment is the right next step.