A hacked WordPress site is rarely a movie scene. There is no ransom note. Most owners find out because Google flags the site in search results, or their host suspends the account, or a customer says the page redirected somewhere strange.
Here is what the work actually looks like from our side.
First: stop the bleeding
Before anything else, the site comes off the public internet or goes behind a maintenance page. Every hour a compromised site stays live is more spam indexed, more visitors at risk, and more damage to the domain’s reputation, which is the part that takes longest to repair.
Second: find out how they got in
This is the step people skip, and skipping it is why sites get reinfected within a fortnight. Cleaning the malware without closing the door just means doing it again.
It is almost always one of four things:
- An out-of-date plugin with a publicly known vulnerability.
- A nulled or pirated premium plugin or theme, which very often ships with a backdoor deliberately included.
- A weak or reused admin password with no two-factor.
- Stale hosting-level credentials, old FTP accounts, a former developer’s access nobody revoked.
On a compromised site we read the plugin PHP directly rather than trusting a scanner’s summary. The tells are consistent: eval(base64_decode(...)), obfuscated preg_replace with the /e modifier, unexplained curl calls to an external address, functions that write files where nothing should be writing files.
Third: clean, do not just scan
Automated cleanup handles the obvious payload and misses the persistence, the second admin user, the scheduled task that reinstalls the payload, the modified core file that looks legitimate, the injected row in the options table.
The reliable route is a known-good rebuild: fresh WordPress core, fresh plugins from source, your content and uploads brought across after inspection. Slower than a one-click clean. It actually holds.
Fourth: rotate everything
All admin passwords, database credentials, hosting and FTP passwords, API keys, and the WordPress salts. Remove every user account that should not exist and every account nobody can account for.
Fifth: ask Google to take another look
If the site was flagged, the warning does not lift on its own. It needs a review request through Search Console once the site is genuinely clean. Requesting review on a site that is still infected makes the next review slower.
What makes all of this cheaper
Backups with real retention. If you can restore to the day before the compromise, the whole job goes from days to hours. Weekly backups will usually do it. Daily backups with thirty-day retention almost always will, because owners frequently do not notice for two or three weeks.
Then: updates on a schedule, no nulled plugins ever, two-factor on every admin account, and continuous server-level scanning rather than a scan you remember to run after something feels wrong.
None of that is exciting. It is also the entire difference between an afternoon and a fortnight.
Web Design
Managed Hosting
SEO & Growth
eCommerce & Booking
Lead Generation