Authorization to Work on a Site

Before Laskyr logs into a site, you confirm that you own it or that you are authorized to hire this work and to grant access. We will not log in without that confirmation. A scan of a public URL is not a login. Credentials you send for a paid job are sealed and deleted when the job closes.

Who can give authorization?

The owner can. So can a person the owner has allowed to act for the site, including an employee or an agency, if that person is actually allowed to share hosting or WordPress access and to approve changes. You make that confirmation on the intake form for Emergency Cleanup. Do not send passwords by ordinary email. The form is the place they go.

If you are an agency, your confirmation has to cover the client site, not only your own company. The client must have allowed you to authorize cleanup and to hand over access. We may ask for a short written confirmation from the client when the relationship is unclear, when the domain and the payer do not match, or when someone else has already told us not to proceed. We would rather delay a job than log into a site on a disputed instruction.

What will we not do?

We will not log into wp-admin, SFTP, SSH, a hosting panel, or a registrar because a URL was typed into the free scanner. The scanner only fetches public pages. We will not guess passwords, and we will not bypass a login. We will not "take a quick look" inside a site you do not control, including a competitor, an ex-employer's site, or a customer's site where you lost the admin account and the owner has not approved the work.

We will not keep working after you withdraw authorization. Email daniel@daniellasek.com and say the job should stop. We stop using the credentials. Refund questions in that case are on the refund page. The cannot-clean refund and the 30-day guarantee are the remedies written there. This page does not add a separate one.

How are credentials handled?

Access you submit for the job is sealed. It is used to do that cleanup, including the re-scans on day 1, day 7, and day 30 when those re-scans need the same context, and to write the report. It is deleted when the job closes. Protection does not keep that password so we can log in later. Monitoring is an external read-only check.

Do not send credentials for systems that are outside the site you hired us to clean, such as a personal email inbox or an unrelated server. If a secret was shared by mistake, say so and we will delete it rather than use it. The privacy page is the deletion request path.

What changes are you authorizing?

You authorize the cleanup described on the terms page: removing the compromise we can reach, replacing core, plugins, and themes with vendor copies where that is how the junk comes out, removing accounts that are not yours, rotating secrets that were exposed, and the hardening that is part of closing the entry we find. You are responsible for having a backup. If you do not have one, say so on the form and we will copy files and the database first, where the host allows it.

You are not authorizing us to install a nulled theme, to leave a known-outdated plugin in place because it is convenient, or to skip the report. If a step would take the site down longer than a normal update, we will say so before we do it, using the email on the job.

False authorization is your responsibility. If you were not allowed to grant access, stop and tell us. We will stop the job.

This is a practical draft for launch review by a lawyer, not a substitute for legal advice.