Is your site hacked right now?
Do not delete anything yet, and do not restore an old backup on top of it. Both can destroy the evidence we need to find how they got in, which is the difference between a cleanup that holds and one that gets re-infected next week.
Call us, or book the earliest slot, and we will take it from there.
Our WordPress malware removal service cleans the infection, closes the way in, and gets the Google warnings lifted and your rankings back. Founder led, and you deal with a person who has done this many times before.
A hacked website is a horrible feeling. Your site is redirecting customers somewhere else, Google is showing a red warning next to your name, your host has suspended the account, or somebody has emailed to ask why your homepage is selling something you have never heard of.
It is fixable. It is usually more routine than it feels at two in the morning, and you do not need to rebuild the site from scratch.
Signs your WordPress site has been hacked
If you recognise any of these, the site almost certainly needs cleaning:
- Your site redirects somewhere elseOften only for visitors arriving from Google, or only on mobile, which is why you may not see it yourself.
- Google shows a warning“This site may be hacked”, “Deceptive site ahead”, or “The site ahead contains harmful programs”.
- Strange pages are indexedJapanese characters, pharmaceutical listings or replica goods appearing under your domain in search results.
- Administrator accounts you do not recogniseNew users in the dashboard that nobody on your team created.
- Your host has suspended the siteUsually for sending spam or eating resources, both classic symptoms of a compromise.
- The homepage has been replacedDefacement, often with a message or a logo from whoever did it.
- Customers report card problemsOn WooCommerce this can mean a payment skimmer, which needs dealing with urgently.
- Files changed that nobody touchedModification dates on core files that do not match any update you made.
- Your emails are going to spamA compromised site sending bulk mail gets the domain blacklisted quickly.
- The site suddenly got slowCryptomining and spam sending both consume server resources.
Not sure whether it is a hack or just an error?
A white screen, a critical error message or a database connection error is usually a plugin conflict, a PHP version change or a memory limit, not a compromise. We would rather tell you that on a free call than sell you a cleanup you do not need.
How our malware removal works
-
We look before we touch
We take a forensic copy first, then find every affected file, the database entries, the scheduled tasks and the user accounts involved. Cleaning without doing this is how sites get re-infected.
-
We find the way in
Usually an out of date plugin, a stolen password or a weak host configuration. If we do not close the entry point, the cleanup does not hold, so this matters more than the removal itself.
-
We clean the site
Malicious code removed from files, themes and the database, core files replaced with clean originals, backdoors and rogue accounts deleted, and any scheduled tasks the attacker left behind removed.
-
We harden it
Passwords and security keys rotated, file editing disabled, permissions corrected, updates applied, and a firewall configured so the same route does not work twice.
-
We deal with Google
Blacklist and Safe Browsing review requested, spam URLs removed from the index, Search Console security issues cleared, and the site resubmitted for crawling.
-
We watch it
We monitor for 30 days afterwards to make sure it is genuinely clean, and give you a written summary of what was found, what was changed and what to do next.
What it costs and how quickly we start
Price
From £70 for a straightforward cleanup on a standard WordPress site. A full engagement, where we clean the site, close the entry point and handle the search recovery, is typically around £395. Either way you get a fixed figure before we begin, so there is no meter running.
Response time
We can often start immediately, and in almost all cases within the hour. Most cleanups are finished within two to five hours of starting.
If it comes back
Every cleanup carries a 30 day warranty. If the same infection returns within that window we deal with it at no further cost, because it means we missed the entry point.
Does the site stay live?
In most cases yes. If the site is actively harming visitors we may put a holding page up while we work, and we will always agree that with you first rather than doing it quietly.
The hacks we see most often
Redirect hacks
Visitors get sent to a spam or scam site. Often conditional, so it fires only for search visitors or only on mobile, which is why the owner is frequently the last to know.
Japanese keyword hack
Thousands of Japanese language pages appear in Google under your domain. Usually the Balada Injector family. The files are the easy part, the index cleanup is the real work.
Pharma hack
Hidden pages and injected links selling pharmaceuticals, shown to search engines but not to you. It can survive a superficial cleanup for months.
SEO spam and link injection
Spam links buried in your posts, footer or database, quietly using your domain’s authority for somebody else’s benefit.
Defacement
Your homepage replaced outright. Alarming, very visible, and usually the least technically damaging of the lot.
Card skimmers
Malicious JavaScript on a WooCommerce checkout capturing card details. Urgent, and it carries obligations to your customers as well as your business.
Getting your rankings back, not just your files
This is where a lot of malware removal stops, and it is the half that costs you money. Once a hack has put spam pages in Google’s index, removing the files does not remove the pages. The warnings stay up, the junk URLs stay indexed, and your real pages stay buried.
Because we are an SEO agency as well as a WordPress one, the search recovery is part of the job rather than an upsell. We request the reviews, get the spam de-indexed, repair what the hack broke in your internal linking and sitemap, and watch Search Console until impressions come back to where they were.
We have been through it ourselves
In August 2026 this site was compromised. A bot redirect was injected into the theme header, two administrator accounts were created that we had not made, and the way in was an outdated file manager plugin.
We cleaned it, removed the accounts, deleted the plugin, locked down file editing, updated twenty nine plugins and two themes, purged the cache and asked Google to recrawl. We write about it openly because it is a far more useful thing for you to read than a claim that we have never had an incident.
Frequently asked questions
My WordPress site has been hacked, what should I do first?
Change your hosting and WordPress administrator passwords, and tell your host. Then stop. Do not delete files you think look suspicious and do not restore an old backup over the top, because both remove the evidence of how they got in, and an entry point we cannot find is one we cannot close.
Can I remove the malware myself with a plugin?
Sometimes, for a simple infection caught early. Scanners are good at finding known malicious files and much weaker at finding the backdoor left behind, the database injections and the modified core files. If the site is your livelihood, the risk of a partial cleanup is that it looks fixed for a fortnight and then returns.
How did my WordPress site get hacked?
Nearly always an out of date plugin or theme with a known vulnerability, a weak or reused administrator password, or shared hosting where another site was compromised first. It is rarely personal. Automated scanners find the opening and take it.
How long does the Google warning take to disappear?
Once the site is genuinely clean and we have requested the review, the browser warning usually clears within a day or two. Spam pages already in the index take longer to disappear entirely, and recovering the rankings you lost takes longer again. We will give you a realistic timescale rather than an optimistic one.
Do you clean sites that are not WordPress?
WordPress and WooCommerce are what we do every day, so that is where we are strongest. For other platforms, ask. If it is not something we can do properly we will say so rather than learn on your site.
Will I lose content or have to rebuild?
Very rarely. The aim is always to clean the existing site and keep your content, design and URLs intact. A rebuild only comes up where a site has been compromised for a long time and is beyond safe repair, and we would talk that through with you before going near it.
What happens after the cleanup?
A site that has been hacked once is a site somebody has already found. Most clients move onto one of our WordPress security plans afterwards so the updates, monitoring and backups are handled. There is no obligation to, and the cleanup stands on its own.
Let us get your site clean
Tell us what you are seeing and we will tell you what it is, what it will take and what it will cost. If it turns out not to be a hack at all, we will tell you that too.