The fastest way to get a useful answer out of me is a short message with four things in it. Everything below exists to save you a round trip.
What to put in a first message
What changed, and the date it changed. Not "traffic is down lately" — the day the line moved. Almost every diagnosis on this subject begins by dating the drop precisely, because the first question is whether that date lines up with a confirmed Google update, and the second is whether it lines up with something you did. If the change was gradual rather than sudden, say that too: gradual and sudden have completely different explanations.
What you have already checked. In particular: does the manual actions report in Search Console show anything, and does the security issues report show anything? Those two reports answer questions no third-party tool can answer, they take a minute to read, and knowing they are clean changes what I would look at next. If you have not looked, say so — that is fine, and it is better than a guess.
What made you think it was an attack. A spike in referring domains, an email demanding money, copies of your pages turning up elsewhere, a run of one-star reviews, a listing that changed without you touching it. The symptom points at which of the vectors on this site is worth ruling out first, and they are ruled out in very different ways.
What the site is. The domain, roughly how many pages, what it runs on, and whether anything about it changed in the same period — a migration, a redesign, a plugin update, a hosting move, a new consent banner. A surprising share of suspected attacks turn out to be a change the owner made and forgot, and none of us are immune to that.
What happens next
I read the message and tell you what the evidence supports. Sometimes that is a piece of work worth doing. Often it is that nothing was done to you and the honest answer is to fix something else, or to wait. I would rather send that second reply than take an engagement that cannot help you, and you can check that claim against the rest of this site — a good deal of it exists to talk people out of buying things.
If your situation is urgent — a live compromise, a browser warning on your domain, an extortion demand — say so in the subject line. Those have clocks on them, and the first hours matter in a way they do not for a ranking question. If you have received a demand for money, do not reply to it, do not pay it, and do not delete anything before you have preserved it.
Before you write, preserve what you have
Evidence on this subject decays on its own, and it decays fastest in the first days — which are also the days people spend deciding whether to ask anyone. Server and CDN logs roll off on whatever retention your host sets, often thirty days and sometimes seven. Search Console holds performance data for a limited window and then it is gone. Third-party backlink indexes recrawl and quietly drop rows, so a link that is visible today may not be visible in a month, and an export taken today with the date on it is worth more than a much better export taken later.
So before you do anything else: export what you can see now, screenshot what you can see now, and keep the original of any message you have received with its full headers intact. Do not clean anything up first. A remediation performed before the evidence is captured destroys the record of what was there, and that record is the thing any later complaint, insurance claim or legal step would have to rest on. If you take one piece of advice from this page before you write to me, take that one.
Some things I do not do
I do not perform, sell, broker or advise on attacks against anyone, at any price, for any reason, and messages asking for that get one line back. I do not guarantee a ranking, a recovery or a timeline, because nobody honestly can. And I do not publish client names or work, so if you are looking for a reference list you will not find one here; what I can do is describe the kind of situation and what it took to resolve it.
The form below opens a message in your own mail app. Nothing is submitted to this website and nothing is stored here.