Hacked WordPress site, cleaned properly
Manual cleanup, not a plugin scan and a restored backup. We find the backdoors, close the hole that let them in, clear the blacklist warnings, and harden the site so it does not happen again next month.
-
The entry point, not just the symptoms Restoring a backup without closing the hole means being reinfected within days.
-
Blacklist warnings cleared Google Safe Browsing and the browser warnings that are costing you every visitor.
-
Written report What was found, what was changed, and every credential you need to rotate.
Get emergency help
Send your site and what you are seeing. We reply fast, and tell you honestly how bad it is.
Request received!
Thanks! We have your request. Check your inbox within 48 hours for your written proposal. Nothing else needed from you.
What a compromised site is doing to you
Every hour of this is costing traffic, trust and sometimes the hosting account itself.
What the cleanup involves
In this order, because cleaning without closing the entry point simply resets the clock.
Triage and scope
What is infected, how far it reaches, and whether the database is affected too.
Manual removal
Files and database cleaned by hand, including injected code, spam pages and users.
Backdoors
The shells and hidden admin accounts left for re-entry, which automated scans routinely miss.
Close the entry point
The outdated plugin, weak credential or exposed file that allowed it, patched.
Blacklist removal
Google Safe Browsing and browser warnings, plus the Search Console review request.
Hardening
Permissions, logins, updates and monitoring so the same route does not work twice.
Not sure whether your site is infected?
Send the URL and what you are seeing. We will tell you honestly whether it is a hack or something else.
How a cleanup runs
Fast, but not rushed, because a missed backdoor means doing it all again.
-
1
Triage
Scope the infection and take a forensic copy before anything is changed.
Hours 1 to 2 -
2
Clean
Manual removal across files and database, backdoors and rogue users included.
Same day -
3
Close and harden
Patch the entry point, rotate credentials, tighten permissions and logins.
Same day -
4
Clear and verify
Blacklist review requests, rescan, and a written report of everything changed.
Next 24 to 48 hours
What you get at the end
A clean site is the minimum. The report is what stops it recurring.
The site back
- Malware and backdoors removed
- Spam pages and users deleted
- Site loading normally
The warnings gone
- Blacklist review submitted
- Search Console clean
- Hosting suspension lifted
The hole closed
- Entry point patched
- Credentials rotated
- Hardening and monitoring in place
Other work we have done
Machinery & Garden Equipment Store
German WooCommerce store plus supplier data tooling
UAE Real Estate Portal
Areas, communities, off plan projects and floor plansWho does the cleanup
Bint E Hafsa
Hafsa handles hack recovery as development work: reading the files, tracing what was modified and when, and finding what the automated scanners missed. Recent work includes a full cleanup and recovery for a French client site.
Most hacks are not clever
Which is also the good news: they are preventable.
Proper cleanup vs a plugin scan
What cleanup costs
Quoted as a fixed price after triage, so you know before we start. Published market rates for manual cleanups run from around $100 for a light infection to $500 or more for a complex one, and fixed price specialists in Europe commonly start around 490 euros.
What you can count on
We scope after triage and quote a fixed price before cleaning. If the honest answer is that a clean rebuild is cheaper than the cleanup, we will tell you that instead.
Site hacked right now?
Send the URL and what you are seeing. We reply fast.
Why restoring a backup usually fails
A backup restores the files. It does not tell you how the attacker got in, and it does not remove an outdated plugin with a published vulnerability. If the entry point is still open, the same automated scan that found you last week finds you again, often within days. Cleanup has to end with the hole closed, or it is not cleanup.
Backdoors are the part that matters
The visible damage, spam pages, redirects, injected links, is what you notice. The backdoor is what lets them return: a small obfuscated file in an uploads folder, an extra admin user, a scheduled task that reinstalls the payload. Automated scanners match known signatures and routinely miss these, which is why manual review is the difference between cleaned and briefly quiet.
The hacks we see most
- Pharma and spam injections, which mostly damage your search listings
- Redirect hacks sending mobile visitors to casino or adult pages
- Japanese keyword hacks, which flood your index with pages you cannot see
- Credit card skimmers on WooCommerce checkouts, which are the serious ones
- Spam page generation, which usually triggers the hosting suspension
Clearing the warnings and the rankings
After cleaning, the browser warning and the search listing both need attention: a review request through Search Console, and often a period of watching the index as spam pages drop out. Rankings usually recover, but the longer the infection was live, the longer that takes, which is the strongest argument for dealing with it today rather than on Monday.
Preventing the next one
Almost every compromise we see used a published vulnerability in an outdated plugin, weeks or months after the fix was available. Updates applied on a schedule, unused plugins removed, strong unique credentials and monitoring prevent the overwhelming majority of it. That is ordinary maintenance, and it costs a fraction of a cleanup.
Most standard cleanups are done within 24 to 48 hours of getting access. Complex infections across a large site or a compromised database take longer, and we will tell you which one you have after triage.
Only if you know when the site was compromised and the backup predates it, and only if the entry point is closed afterwards. Otherwise you restore a clean site with the same open door and get reinfected within days.
Yes. Once the site is verifiably clean we submit the review request through Search Console. Google usually clears it within a day or two.
They match known signatures. Backdoors are often small, obfuscated and unique to the attack, and they hide in legitimate looking files. Finding them is a reading job, not a scanning job.
Almost always a known vulnerability in an outdated plugin or theme, sometimes weak or reused credentials. Very rarely anything sophisticated. Finding which one is part of the work.
Keep everything updated, remove what you do not use, use strong unique credentials, and monitor. That is what a <a href="/wordpress-development/maintenance/">maintenance plan</a> is for.
Tell us what you are seeing on the site
Send the URL and describe the symptoms: redirects, a warning screen, strange pages, a suspension notice. We reply fast with an honest assessment.
- Whether it is actually a hack, and how deep it goes
- What the cleanup would involve and cost
- What to do right now, before we even start
What happens next
- 1You send the form with the symptoms.
- 2We triage the site and scope the infection.
- 3You get a fixed price and a timeline, fast.
Get emergency help
Triaged quickly, with an honest assessment.
Request received!
Thanks! We have your request. Check your inbox within 48 hours for your written proposal. Nothing else needed from you.
