There is a particular feeling that comes with opening your own website and seeing a red warning screen instead of your homepage. Or getting the email from your host saying your account has been suspended. Or worse, hearing it from a customer.
If that is where you are right now, here is the short version: yes, I can fix it, and it is usually less bad than it feels. Send me a message and I will look at it today.
The longer version is below, because you probably want to know what you are dealing with before you hand it to a stranger.
“Google is showing a warning on my site”
The red interstitial screen. Visitors get “this site may harm your computer” before they ever reach you, and every one of them leaves.
This is Google’s Safe Browsing flag, and it means Google found something malicious. Removing the warning is a two-part job: clean the site properly, then submit it for review through Search Console. The cleanup is the part I control. The review queue is Google’s, which is why the honest answer to “how fast” is “the site can be clean today, the warning usually lifts within a few days.”
The one thing that makes it slower is submitting for review before the site is genuinely clean. Google re-flags it, and you go to the back of the queue.
“My host suspended my site”
Most hosts do not clean infected sites. They take them offline to protect the other sites on the server, and often your email goes with it.
I have dealt with this on cPanel, Hostinger, SiteGround, Kinsta and plenty of others. It usually means working from a backup or a file archive rather than the live site, cleaning it there, and then talking to the host to get the account reinstated. That conversation goes faster when someone can tell them specifically what was found and what was done.
“My site redirects somewhere strange”
You type your domain and end up on a pharmacy site, or a gambling page, or something worse. Often it only happens on mobile, or only for visitors arriving from Google, which is why you might not see it yourself.
That selective behaviour is deliberate. The malware checks who is visiting and stays quiet for anyone who looks like the site owner. It is one of the reasons people tell me “it looks fine to me” while their traffic collapses.
“There is spam in my Google results”
You search your own brand and find pages you never created, often in another language, often selling something you do not sell. This is SEO spam injection, and it is the most common WordPress hack there is.
It is also the one that does the most quiet damage, because your site keeps working normally while Google slowly reassesses what your site is about.
“I cleaned it and it came back”
This is the one I hear most, and it is the reason I am careful about how I work.
Malware almost never consists only of the thing you can see. It leaves a way back in. A modified wp-config.php. An admin account you did not create. A scheduled task, a single injected row in the database, an innocent-looking file sitting in an uploads folder. Delete the visible payload and leave the backdoor, and the site reinfects itself within days or weeks.
So the job is not “remove the malware.” The job is find how they got in, close that, then remove the malware. A cleanup that cannot tell you the entry point is not finished, however clean the files look.
“I can’t log into wp-admin any more”
Your password stopped working, or your account is gone, or you log in and immediately get logged out. Usually it means the attacker created their own administrator and removed yours. Recoverable, almost always, through the database.
What I actually do
I built my own WordPress malware detection plugin and an activity-logging plugin, and I use both on this work. The detector is why diagnosis is normally same-day rather than a two-day fishing expedition. I am not running a generic scan and reading the output. I am running something I wrote and know the limits of.
The process:
- Backup first. Nothing gets touched until there is a copy of the site as it currently is, infection and all. If anything goes wrong, we can go back.
- Find the entry point. Which plugin, which credential, which file permission. This comes first, not last.
- Clean. Core, themes, plugins and database. Fresh files from source rather than patched files.
- Close the door. Remove rogue admin accounts, kill scheduled tasks, rotate every password including database and hosting, harden the install.
- Verify. Rescan, check the site from a few different devices and referrers, confirm it behaves the same for everyone.
- Google and your host. Submit for review, and speak to your host if they suspended you.
- Install activity logging. So that from now on there is a record of what changed on your site, when, and by whom. This is the question everybody asks after a hack and almost nobody can answer.
Afterwards you get a plain explanation of what happened. Not a scary PDF full of jargon, just a straight answer about which plugin let them in and what to do about it.
How fast
Most straightforward infections are cleaned the same day. Complicated ones take longer: a store with live orders, a multisite network, a host who has already suspended you. I will tell you that at the start rather than halfway through.
Message me and you will get a reply in about five minutes during my working hours. If your site is down, that matters more than anything else on this page.
Common questions
Can you guarantee it will not come back?
Nobody honest can guarantee that, because reinfection usually comes from something outside the cleanup itself. A reused password, an unpatched plugin, another compromised site sitting on the same hosting account. What I can tell you is that I find and close the entry point rather than only removing what is visible, and I will tell you what you need to change so it does not happen again.
Will I lose my content?
Very rarely. Cleaning malware means replacing WordPress core, themes and plugins with clean copies and removing injected code from the database. Your posts, pages, media and settings stay. And there is a backup taken before I start.
How much does it cost?
It depends on the infection, and I will give you a fixed price before I start rather than an hourly estimate that grows. I have written a full honest breakdown of what this work costs across every option, including the ones that do not involve paying me: what WordPress malware removal actually costs.
Can I just do it myself?
Sometimes, genuinely. If your site is small, your backups are recent and the infection is a first-time, obvious one, a free Wordfence scan and fresh files may be all you need. I would rather tell you that than take money for something you could have done in an afternoon.
Do you work on sites other developers built?
Constantly. Most of them, in fact.
The honest bottom line
A hacked website feels like a catastrophe and is usually a manageable technical problem, provided somebody looks for the entry point rather than just the mess.
If your site is down, flagged, redirecting or suspended right now, send me a message. Tell me your domain and what you are seeing. I will look at it today, tell you what it is, and give you a fixed price. If it turns out you can fix it yourself for free, I will tell you that too.
And once it is clean, keeping it clean is the easy part. That is what ongoing maintenance is for.
