WordPress malware removal: hacked site cleanup at a fixed price

WordPress malware removal at a fixed price: if your WordPress site has been hacked, sends visitors to spam sites or is flagged by Google as dangerous, we clean it up for €179. We remove the malicious code from files and database, get rid of suspicious accounts and hand you a report with the most likely entry point. No miracle promises: we tell you what we found, what we removed and what's left to do.

How to tell if your WordPress site is infected

A hacked WordPress site doesn't always look hacked: a lot of malware only shows itself to certain visitors so the owner doesn't notice. The most frequent symptoms:

• visitors coming from Google or on a smartphone get redirected to gambling, pharmacy or scam sites, while from the office you see the site as normal;
• search results show pages with Japanese titles or pharmacy ads (the so-called Japanese keyword hack or "pharma hack");
• the browser shows the red "deceptive site" page, or Google Search Console reports security issues;
• your host suspends the account for malware, abnormal resource usage or sending spam;
• admin users nobody created appear in the user list, or odd PHP files turn up in the uploads folder.

What we do, step by step

1. Backup of the current state before touching anything, so nothing is lost and we can analyse the infection properly.
2. Comparison with the originals: using WP-CLI we check core and plugins against the official versions (wp core verify-checksums, wp plugin verify-checksums) and restore any altered files; themes and plugins not in the official repository are checked by hand.
3. Removal of malicious code: added files, backdoors, scripts injected into pages and redirects in .htaccess or the server configuration.
4. Database cleanup: injected content, options and scripts, and suspicious admin users.
5. Password and key changes: WordPress admins, database, the security keys in wp-config.php and, where you manage them, FTP and hosting panel access.
6. Blocklists and Google: removal requests for the blocklists the site has landed on, and a review request through Google Search Console.
7. Final report: what we found, what we removed, the most likely entry point and what it takes to close it.

What's included and what isn't

The fixed price covers the cleanup: initial backup, removal of malicious files and code with original files restored, cleanup of the database and suspicious users, password and key changes, blocklist removal and Google review requests, and the final report.

It doesn't cover closing the vulnerability. That's often development work: an abandoned plugin to replace with a maintained alternative, custom code to fix, a theme that's never been updated to sort out. Timelines vary a lot from case to case, so it's billed hourly (€75/hour) or from hour packages, always with a quote first. If updates have been on hold for a while, there's also the WordPress update fix, from €199.

Price and timing

• Single WordPress site: €179, fixed price.
• PrestaShop, Joomla, Drupal, Magento: €349, with a wider scope: closing the hole included if an update or a configuration change within one hour of work is enough, and a free re-clean within 30 days if it gets reinfected through the same hole we closed. Details in PrestaShop malware removal.
• WordPress multisite: quoted separately.

We work Mon-Fri 09:00-18:00; out of hours, the band rates on the On-call page apply, and pickup is only guaranteed with an active on-call plan. If something beyond the cleanup comes up during the work, we stop and give you a quote before going any further. All fixed-price fixes are listed on the pricing page.

Why the site gets reinfected if the hole stays open

Removal gets rid of the infection, but it doesn't change how the attacker got in. If the way in was a vulnerable plugin that's still installed, automated bots find it again within days and the site is reinfected, often with the same malware. That's why the report doesn't just list the files removed: it points to where the attack started and what it takes to close it.

A typical case: a brochure site with around twenty plugins, some not updated in years, redirecting only mobile visitors to pharmacy sites. The cleanup removes the injected files and a ghost admin account; the report points to an abandoned contact-form plugin as the likely entry point. Replacing it with a maintained alternative is separate work, estimated and approved before it starts.

Who it's for

• Businesses and professionals whose WordPress site has been flagged by Google, suspended by the host or is sending visitors elsewhere.
• Agencies and web designers with a client whose site has been compromised, looking for a technical partner for the cleanup.
• Anyone who's inherited a site with no documentation or reliable backups and finds it infected.
• If you then want it kept in order on an ongoing basis, there's monthly CMS maintenance from €49/month and WordPress support.

How we work

You write to us describing what you're seeing; we ask for the access we need (hosting panel, FTP or SSH, WordPress admin) and confirm price and timing before starting. Blocking issues are picked up according to our response times. We always take a backup before touching the site, and when the job is done you get the report with everything we found and did, written so it's readable even without a technical background.