What WordPress malware removal needs to find
A hacked WordPress site rarely comes down to one obviously malicious file. The visible symptom might be a redirect, spam pages in Google, an unfamiliar administrator account or a browser security warning, while the code responsible sits somewhere else.
A proper investigation has to cover WordPress files and the database. That means checking core files, themes, plugins, uploads, configuration files, scheduled tasks and user accounts rather than deleting the first suspicious file a scanner identifies.
Common warning signs include unexpected PHP files inside upload directories, altered plugin files, injected JavaScript, unfamiliar database content and unauthorised administrator accounts. Scheduled WordPress or server tasks also deserve attention because an attacker can use them to recreate deleted malware.
WordPress itself recommends limiting access, keeping software current, maintaining reliable backups and paying attention to file permissions, configuration and monitoring. Its security guidance also stresses that a compromised computer used to administer a site can undermine security measures on the server.
Why removing one infected file is not enough
Removing the payload is different from removing the compromise. An attacker may leave several ways back into the site, including modified legitimate files, rogue accounts or code designed to download another copy of the malware later.
The entry point also matters. If an outdated plugin, exposed credential or vulnerable component allowed the intrusion, cleaning the visible infection without addressing that weakness leaves the site open to the same problem again.
We therefore treat the clean-up and the cause as the same incident. The work includes a full malware scan and clean, identifying and closing backdoors, and security hardening after the clean-up. Where Google has flagged the site, the process also includes preparing and submitting the appropriate blacklist or security review request once the site is clean.
Google advises site owners to review the Security Issues section of Search Console, correct the underlying vulnerability and request a review when the whole site is clean. Google controls whether and when its warning is removed, so no legitimate provider can promise an immediate change to Google's systems.
How we clean an infected WordPress website
The first job is to establish what has changed and how far the infection reaches. Files that can be compared with trusted originals are checked for modification, while site-specific files need closer inspection because there is no clean generic copy to substitute.
- Inspect the installation: review WordPress core, plugins, themes, uploads, configuration, database content, users and scheduled tasks.
- Remove malicious code: clean or replace compromised files and remove injected content, unauthorised users and identified backdoors.
- Close the route back in: address the weakness associated with the compromise and apply appropriate WordPress hardening.
- Check the cleaned site: confirm that normal pages and important functions still operate after the clean-up.
- Deal with external warnings: where relevant, submit the Google review or blacklist removal request after remediation.
We also provide an incident report for your records. If the infection returns within 30 days, the Hacked Site Rescue service includes a 30-day re-infection guarantee.
WordPress malware removal price
WordPress malware removal is £349. The price covers the forensic clean, closure of identified backdoors, post-clean security hardening and the 30-day re-infection guarantee.
This is intended for sites that are already compromised. If the site is simply unavailable or malfunctioning and there is no evidence of malware, an emergency website fix may be the more appropriate service.
After recovery, ongoing website security, maintenance and independent backups reduce the risk and impact of another incident. WordPress specifically recommends keeping trusted backups because they provide a known recovery point if a site is compromised.
After the malware has been removed
Cleaning the site is only useful if it returns to a known, maintainable state. WordPress core, plugins and themes should be kept current, unused components should be removed, administrative access should be reviewed and backups should be stored somewhere that is not dependent on the live website.
If the compromise involved passwords or administrator access, affected credentials should be replaced rather than left unchanged. A security incident is also a sensible point to review who still needs administrator privileges and whether old accounts can be removed.
For ongoing protection, see our WordPress maintenance and uptime and security monitoring services.