Malware redirects
What it means
Visitors land on your site and get sent to gambling, pharma, or scam pages. This often only triggers on mobile or for search engine traffic, making it hard to spot from your own desktop.
Malware removal and security for business websites
WordPress malware removal
and security hardening.
We clean infected WordPress sites and make them harder to break into, for business owners and for agencies looking after client sites. Cleanup starts at $249 and hardening at $249. A bigger job costs more, and you approve a flat price before any work starts.
From $249Flat rate for a straightforward job
30 daysPost-cleanup monitoring warranty
$0To look at the site and confirm the price
How hacks happen
Why WordPress sites
get hacked.
WordPress runs a large share of the web, so it is a common target for automated attacks. Most attacks are not personal: bots scan the web for sites with known security holes.
Most attacks are not sophisticated. An outdated plugin with a known hole, a pirated ("nulled") theme, or a password you also use somewhere else is usually all it takes. The attacker does not need to know your business exists.
A hack can hurt more than the site. Google may warn visitors away, your host may suspend the account, and email from your domain can start landing in spam. If the site collects customer details, check whether you have to tell those customers about the breach. The sooner a site is cleaned, the less there is to clean.
Warning signs
Signs your site
is compromised.
If any of these sound familiar, your site may already be infected. The sooner it is checked, the less there is to clean up.
Google "This site may be hacked" warning
What it means
A red warning screen stops visitors before they reach your site. It means Google found harmful content there, and visitors have to click past the warning to reach you.
Defaced or altered pages
What it means
Your homepage or key pages show content you did not create - political messages, spam advertisements, or a hacker calling card. Your database or template files have been directly modified.
Spam injection in search results
What it means
Your site looks normal when you visit it, but Google shows Japanese or pharmaceutical spam under your domain in search results. Attackers inject hidden pages that only search engine crawlers see.
Unexplained slow performance
What it means
Your site suddenly slows down for no clear reason. Malware can run cryptocurrency miners, send spam email or attack other sites, all using your server in the background.
Locked out of your own admin
What it means
You cannot log in to wp-admin. Your password no longer works, your admin email has been changed, or the login page redirects elsewhere. Attackers often create hidden admin accounts and lock out legitimate users.
Hosting account suspended
What it means
Your host shut down your site with a vague abuse notice. Hosting providers scan for malware and suspend accounts that are distributing malicious content or sending spam - often with little warning.
Security plugin alerts flooding in
What it means
Your security plugin is reporting lots of file changes, unknown files in wp-content, or modified WordPress files. Treat it as a sign the site needs checking, not just a plugin glitch.
Not sure which one fits? Tell us what you are seeing and we will work it out. If the site is fully hacked rather than just infected, see our hacked site recovery.
What we cover
Cleanup and prevention,
start to finish.
We handle both sides of security: removing the damage that already happened, and making it much less likely to happen again.
Full malware removal
Malicious code comes out of your files, database, theme and plugin directories - including the hidden backdoors and cron jobs scanners miss.
Clean WordPress core restore
Altered WordPress files are replaced with clean official copies, so the infection cannot hide inside core files.
The way in, closed
We find how the attacker got in - an outdated plugin, weak credentials, a vulnerable theme - and close that hole, not just the symptoms.
Accounts and keys reset
Admin passwords, salts and security keys are regenerated, rogue admin accounts are removed, and file permissions are tightened.
Firewall and login protection
A web application firewall, login attempt limiting and brute-force protection go on so the same attack does not walk back in.
30 days of monitoring
After cleanup we watch the site daily for 30 days to catch any re-infection attempt, then hand you a full report of what happened and what is now in place.
Our process
How we clean and secure
your WordPress site.
Five steps, the same on every cleanup. Looking is free, and you approve the price before any paid work.
Look and confirm the price
We look at the site to see how far the infection goes and how the attacker most likely got in. The way in matters as much as the infection itself. Then we confirm a flat price, and you approve it before any paid work starts.
Back up and contain
Before we change anything, we take a full backup of the site as it is. Then we stop the active damage: redirects switched off, unknown admin accounts disabled, malware stopped from spreading.
Clean every layer
Files, database, accounts and the hidden ways back in. Malicious code comes out, altered WordPress files are replaced with clean copies, and we check the uploads folder, scheduled tasks and server rules for backdoors. Scanners miss things, so we check by hand too.
Harden the site
A cleanup that leaves the hole open invites the attacker back. We close the hole that was most likely used, update the software, reset passwords and security keys, add a firewall and login protection, and tighten file permissions.
Verify and monitor
We scan the site again to confirm it is clean, and ask Google and any other blocklist that flagged it to review it. Then we monitor your site daily for 30 days. You receive a full report documenting what happened, what was fixed, and what defenses are now in place.
Security pricing
From $249. Agreed before we start.
Cleanup and hardening are each a flat rate for a straightforward job. Heavier damage, a bigger site or several sites cost more, and you approve the price first.
Malware cleanup & hardening
Security cleanup
$249from, flat rate
Flat rate for a straightforward job. Deeper infections, larger sites or multiple sites cost more, and you approve the higher flat price before any work starts.
- Full malware removal across files and database
- The entry point found and closed
- Passwords, keys and admin accounts reset
- Firewall and login protection added
- 30 days of post-cleanup monitoring
- A full report of what happened and what changed
What this service does not include
We believe in being upfront about scope. Here is where the boundaries are.
- Rebuilding a site from scratch
- If your site is so badly compromised that core data is corrupted beyond recovery, a cleanup may not be enough. We will tell you honestly if a rebuild is the better path, and price that as a separate project.
- Ongoing monitoring beyond 30 days
- Our cleanup includes 30 days of post-cleanup monitoring. After that, daily security scanning, weekly updates and daily backups come with every care plan.
- Content recovery from missing backups
- If the attacker deleted content and no backup exists - not on your host, not locally, not in a staging environment - we cannot recreate what was never saved. We recover everything technically recoverable and are transparent about what is gone.
- Legal or compliance reporting
- If you handle customer data, a breach may mean you have to notify people under breach-notification laws or card-payment rules. We document the technical details for your records, but legal advice is outside our scope.
If a cleanup cannot fix it, we tell you before you pay for one.
Want security watched every day, not just for 30 days? Every care plan includes daily security scanning, weekly updates and daily backups. Fixing this for a client? We work white-label under your brand - see the partner program.
Security questions
Everything you need
to know.
How do I know if my site is actually infected?
The warning signs above are the usual tells: redirects you did not add, Google warnings, spam in search results, locked-out admin accounts, or your host suspending the site. Sometimes there are no visible signs at all - a quiet backdoor waiting to be used. A proper check looks at files, database and accounts, not just what visitors see.
Will you delete my site and start over?
No. We clean the infection in place and keep your content, orders, forms and settings where they are. We only recommend a rebuild if the damage is truly beyond recovery, and we tell you that honestly before charging for a cleanup.
How do you find the backdoors scanners miss?
We check by hand as well as with scanners: the uploads folder, scheduled tasks (cron jobs), hidden admin accounts, modified core files, and server-level rules. Attackers hide re-entry points specifically to survive automated scans.
What if the attacker gets back in?
Our cleanup includes 30 days of daily monitoring to catch re-infection attempts early. If the same infection returns within that window because we missed something, we look at it again. The lasting protection is keeping the software updated and the firewall on - which is what a care plan handles every week.
Do I need to notify my customers about the hack?
That depends on your situation - what data was exposed, where your customers are, and which rules apply to you. We document the technical details of the breach for your records, but we are not lawyers. If customer or payment data was involved, talk to a professional about your notification duties.
My host already suspended the site. Can you still help?
Yes. We find out why the host suspended it - usually malware or spam sending - clean the cause, and give you a summary to send your host when you ask them to switch it back on.
How is this different from hacked site recovery?
They overlap. Hacked site recovery is for an active compromise - redirects, spam, locked-out admin - priced as its own flat-rate rescue. This service is the full cleanup plus hardening with 30-day monitoring, aimed at sites that are infected or want to prevent it. Tell us what you are seeing and we will point you at the right one.
Emergency request
Think your site might be infected?
An infected site is flagged as an emergency and jumps the queue. Looking costs nothing, and you approve the price before any paid work starts.
We work on business websites, for owners and for agencies. If it is a client's site, say so and we can work behind your brand.
- Your website address
- What you are seeing - warnings, redirects, lockouts
- Anything you changed last
Jargon, explained
Terms worth
knowing.
Plain-English definitions of the terms that come up with this service - no tech background needed.
Think your site might be infected?
Tell us what you are seeing. An infected site jumps the queue, looking costs nothing, and the price is approved before any work starts.