Malware removal & hardening
Hacked? We’ll take it from here.
A WordPress engineer starts on your site within 4 hours, removes every backdoor by hand, closes the way in and requests your blacklist reviews.
Work starts within 4 hours
Manual cleanup
30-day reinfection guarantee
- OK
wp-includes/Core files match WordPress.org checksums - FOUND
wp-content/uploads/2024/07/cache.phpPHP backdoor hidden in uploads - FOUND
wp_options › siteurlMalicious redirect injected into settings - WARN
wp_users › “wp_support”Unknown administrator account - FOUND
wp_posts › 1,284 rowsHidden SEO spam links in posts - WARN
plugins/slider-pro 2.1Outdated plugin with a known vulnerability - OK
cleanupFiles restored, users reset, plugin patched
3 threats found · 3 removed
Site down or showing a red warning right now? Don’t delete files or restore an old backup yet — it can destroy the evidence of how they got in.
Am I hacked?
Tick what you’ve noticed. Get an honest answer.
Some infections are loud; most are quiet and built to hide from the site owner. This check takes 20 seconds and needs no email.
Why it happens
Attackers don’t pick you. Bots pick outdated plugins.
Almost every WordPress hack starts with a known flaw in a plugin or theme, found by automated scanners within hours of being published. WordPress core itself had only six vulnerabilities in 2025, all low priority.
11,334
new WordPress ecosystem vulnerabilities disclosed in 2025 — up 42%
5 h
median time to mass exploitation of a heavily targeted flaw
What we remove
The infections we find most — and where they hide.
Sucuri found a backdoor on 49% of the hacked sites it cleaned — the reason “cleaned” sites get reinfected. Scanners catch the obvious files; we check files and the database by hand. Tap a card to see how.
Who does the work
One engineer owns your cleanup — and talks to you.
No hand-offs between departments. The person cleaning your site answers your messages, from the first scan to the final report.
- Live updates in one threadWhat we found, what we removed and what’s next — as it happens.
- Work starts within 4 hoursEvery cleanup includes emergency response, day or night.
- A written report at the endHow they got in, what changed and what to watch for.
The cleanup
Four phases, start to clean.
You get an update at every step. We work from a full backup, so nothing you need is ever lost.
-
Stop the damage, keep the evidence
We take a full backup, put up a maintenance page if visitors are at risk and lock down admin access.
- Full backup of files and database
- All admin sessions logged out
- Maintenance mode if visitors are at risk
-
Remove every infected file and record
Core, theme and plugin files are replaced from clean sources; the database is cleaned row by row.
- Backdoors and injected code removed
- Spam posts, links and redirects deleted
- Rogue users and cron jobs removed
-
Close the door they came in through
We patch or replace the vulnerable software and change every credential that could have leaked.
- Vulnerable plugin patched or replaced
- Passwords, salts and API keys rotated
- Firewall, login protection, safer file permissions
-
Get your reputation back, watch for return visits
We request blacklist reviews and check the site daily for 30 days under the reinfection guarantee.
- Google security review requested
- Spam URLs cleaned from Search Console
- Daily integrity checks for 30 days
Hardening
Cleaning is half the job. Closing the door is the other half.
Patchstack found that typical hosting defences stopped only 12% of attacks on known, actively exploited WordPress flaws. So we layer protection where it counts.
- The entry point, patchedThe vulnerable plugin or theme is updated, replaced or removed — not just cleaned around.
- A WordPress-aware firewallVirtual patching blocks attacks on flaws that have no official fix yet.
- Locked-down adminTwo-factor login, no dashboard file editing, least-privilege roles and safer file permissions.
Stay clean
How hardened is your site today?
Based on the official WordPress hardening guide. Tick what you already have — we can put every item in place as part of your cleanup.
Access
Software
Protection
The red warning
Getting Google’s warning taken down.
Google lifts a security warning only after it has reviewed the cleaned site. Asking too early can get a site flagged as a repeat offender — so we request it once, properly.
01
Clean every page first
Google expects the problem fixed across the whole site, not just the homepage. We verify every flagged URL before asking.
02
Request the review in Search Console
We document what was wrong, what we fixed and the result — the three things Google asks for in a review request.
03
Wait days, sometimes weeks
Google says a review “can take from a few days to a few weeks”. We monitor the site daily while it runs.
After the cleanup
Clean once. Stay clean.
Heavily targeted flaws are mass-exploited in a median of five hours. Ongoing care closes that gap before bots find your site again.
- Firewall and malware scanningKnown attack patterns blocked before they reach WordPress.
- Updates the same weekPlugins patched quickly — exploitation often starts within hours of disclosure.
- Tested daily backupsOff-site copies you can restore from in minutes.
Questions, answered
Can’t I just restore a backup?
Sometimes, but the hole they used is still open, and backdoors are often older than your last backup. We clean the current site and patch the cause, so you keep recent orders and posts.
How long does Google take to remove the warning?
Google says a security review can take from a few days to a few weeks. We request it once the whole site is clean and keep monitoring while it runs.
Do you need my hosting or FTP login?
Ideally both WordPress admin and hosting (or SFTP) access. We work from a backup and you can revoke our access the moment we finish.
How do I know if my site is hacked?
Common signs are browser or Google warnings, strange redirects, spam pages in search results, unknown admin users or a sudden drop in traffic.
Will I lose any content?
No. We back up the whole site before we start and only remove code and data that is malicious.
What does the reinfection guarantee cover?
If the same infection comes back within 30 days, we clean it again free. It does not cover new attacks through software you add later.
How do I prevent this from happening again?
Keep everything updated and backed up. Our care plans include updates, daily backups and security scans.
Get a free quote
Let’s build something great.
Tell us about your project and goals. A WordPress engineer — not a salesperson — will reply within one business day with a plan and a fixed price.
- Free, no-obligation quote within 24 hours
- NDA available on request
- Fixed price — you approve the scope before work starts
