7 min read
How to remove malware from WordPress, step by step
A practical WordPress malware cleanup guide covering backups, core files, plugins, database checks, hidden access and validation with WP-CLI.
- Guides
- Malware
- Incident response
Malware removal · WordPress
WordPress malware removal: your site clean and back online.
Hacked WordPress site cleanup: I remove malware, backdoors, suspicious users and plugins, fix the entry point the attacker used and deliver a report. Scope and price agreed before I start.
Response within the same business day.
- Timeline
- 24–72h
- Price
- from BRL 900
- Follow-up
- 7 days after cleanup
WhatsApp, Discord or email.
The problem
What malware does to your site
You may not notice at first. These are the most common effects of a hacked WordPress site.
Redirects your visitors
Malicious code sends visitors to scam, casino or ad sites, often only those arriving from Google or on mobile. That's why you may not see it when you open the site.
Creates spam on Google
Pages about pills, casino or Japanese text get indexed under your domain. The site's reputation drops and real traffic disappears.
Puts your data at risk
It can capture logins, form data and, on online stores, tamper with the checkout. That's why it needs to be handled quickly.
Leaves a door open
Backdoors let the attacker come back even after you delete the infected file. Without finding the backdoor, the site gets reinfected.
Why deleting the infected file isn't enough
Malware rarely comes alone. There is usually a hidden backdoor (in a plugin, in the uploads folder, in a theme file or even in the database) and a flaw that let the attacker in: an outdated plugin, a leaked password or a pirated plugin.
If only the symptom is removed, the site is usually reinfected within days. That's why the cleanup includes finding the entry point, removing everything that was planted and closing the hole.
Process
How I clean your site
- 01
Triage
I confirm the compromise, what was affected and what still works. I give you scope and price before touching anything.
- 02
Snapshot of the current state
I back up the site as it is, to preserve evidence and be able to roll back if needed.
- 03
Cleanup
I remove malware, backdoors, extra files, admin users and suspicious plugins, and check the database. I reinstall core, plugins and themes from official sources.
- 04
Entry point and hardening
I identify the likely vector, update or replace the vulnerable component, rotate passwords and keys, and apply hardening (permissions, access and login protection).
- 05
Revalidation
I check the site as a regular visitor and on Google, including indexed pages. If there is a security warning, I guide the review request.
- 06
Report and follow-up
I deliver a report of what happened and a prevention checklist, and watch the site for 7 days.
What's included
- triage and confirmation of the compromise
- removal of malware, backdoors, suspicious users and plugins
- identification of the likely vector and fixing the entry point
- rotation of passwords and WordPress security keys
- hardening of what was exploited
- incident report and prevention checklist
- 7 days of follow-up after the cleanup
What's not included
- recovery of data that was deleted and has no backup
- Google's review of security warnings (I guide the request, but the timing is Google's)
- redesign or new feature development
- a guarantee the site will never be attacked again
Price
How much the cleanup costs
Cleanup starts at BRL 900. The final price is agreed in writing before I start, after I look at your case.
Payment: 50% to start and 50% on delivery, via Pix or PayPal.
Talk on WhatsApp nowWhat changes the price
- site size and amount of affected files and pages
- online store (WooCommerce) or business site
- whether a clean backup exists to restore
- more than one site on the same hosting
Questions
Frequently asked questions
How long does it take?
Usually 24 to 72 hours, depending on site size and severity. I give you the timeline together with the price.
Do I have to share my site password?
I need access to the WordPress dashboard and, preferably, the hosting. The best approach is a temporary account for me and changing all passwords at the end. Everything is done with your written authorization.
My site shows a “dangerous site” warning in the browser or on Google. Does this fix it?
After the cleanup I guide the review request in Google Search Console. Removing the warning depends on Google's review, so the timing isn't in my hands.
What if I have no backup?
Often the site can be cleaned even without a backup, since the content lives in the database and files. What I can't do is recover data that was already deleted. During triage I check what exists.
Do you guarantee I won't be hacked again?
No, and be wary of anyone who does. I close the entry point I found, apply hardening and recommend keeping updates and backups current, which is what monthly maintenance covers.
Do you handle WooCommerce stores?
Yes. On stores, besides the site, I check whether checkout and forms were tampered with and advise on next steps.
Does it work on any hosting?
On most, yes, as long as I have access to the files, the database and the WordPress dashboard. If your hosting limits something, I'll say so during triage.
My site isn't WordPress. Do you take it?
My focus is WordPress. Other cases on request.
Read also
See all articles 7 min read
My WordPress site was hacked: what to do right now
Found malware, strange redirects or a warning on your WordPress site? Here's what to preserve, how to contain the damage and what to do next.
- Guides
- Malware
- Incident response
6 min read
Japanese keyword spam on WordPress: how to remove it
Seeing Japanese search results for pages you never created? Learn how to check WordPress for SEO spam, remove the infection and recover in Google.
- Google spam
- Malware
If your site is hacked, the sooner the better.
Send me the link and what is happening. I confirm scope and price before starting.
After the cleanup
Don't get hacked again.
Monthly maintenance handles updates with backups, monitoring and malware scans.