Emergency WordPress malware cleanup and recovery
Emergency
Free assessment
Quoted after a look at your site
If your WordPress site has been hacked, you need it cleaned up, the way in closed, and your reputation with Google and your customers restored. Book a free assessment call. I’ll look at what’s happening and give you a quote before any paid work starts. I’m based in Shrewsbury, Massachusetts, and help businesses in Worcester, Boston and across New England, and remotely.
Signs your site has been hacked
- Google or your browser shows a warning when people visit
- Visitors are redirected to spam, gambling or pharmacy sites
- New admin users or files you didn’t create
- Your host suspended the account or flagged malware
- Search results show pages or text that aren’t yours
What I do
- Assess. A free call to understand what you’re seeing, then a written quote.
- Contain. Lock down access so the damage doesn’t spread.
- Clean. Remove malicious code, files and users.
- Close the way in. Find how the attacker got in and fix it, so it doesn’t happen again next week.
- Verify. Check the site is clean and working, and help you clear any Google warnings.
What you get
- A clean, working site
- A written summary of what happened, what I found and what I changed
- Recommendations for keeping it secure, such as the Hardening Package or a Watchdog care plan
Related reading
- Lessons from Cleaning Up a Compromised Website
- The 2026 WordPress Plugin Hack (blog post)
- Hardening WordPress for High-Risk Environments
- SEO and AI search optimization (service), for rankings after a cleanup
How a cleanup works
- Free assessment: I look at the site and send a written quote.
- Find the entry point, so it can be closed, not just cleaned.
- Remove malware and backdoors, including the ones hidden in the database, uploads and scheduled tasks.
- Restore from a known clean state where files can’t be trusted.
- Lock it down: updates, passwords, user accounts and hardening.
- Monitor and verify that it stays clean, and check Google for spam pages left in search results.
This follows the process in Lessons from Cleaning Up a Compromised Website. For checking a site yourself, I publish a free scanner: JAT Shell Scanner, which looks for webshells, rogue admins and database backdoors.
Common questions
How much does it cost?
It depends on how badly the site is compromised, so I quote after the free assessment call. You’ll know the price before paid work begins.
Should I just restore a backup?
A backup can help, but if it was taken after the attacker got in, or the hole is still open, the site can be re-infected. Finding the way in matters as much as the cleanup.
Can you work with my host?
Yes. If your host suspended the site, I can work with them to get it back online once it’s clean.
How do I know if my site is still compromised after a cleanup?
Watch for new admin users, changed files and spam pages in Google Search Console. A scanner like JAT Shell Scanner checks for the common signs automatically.
How do I stop it happening again?
Keep everything updated and lock the site down. The Hardening Package does the lockdown, and the Watchdog retainer keeps it updated and monitored.