WordPress malware removal: your questions answered
The things people most often ask us before, during and after a clean-up. If your question isn't here, just ask.
How does payment work, and what if you can't fix my site?
We send you a fixed quote first. Once you accept it, payment is 100% in advance and then we start work. If we don't deliver the job we quoted for, you get 100% of your money back. No partial refunds, no small print about effort spent.
What does the 15 days of free monitoring actually include?
Once your site is clean, we check it every day for 15 days. That means a malware scan of your files, a check for changed or newly added files in WordPress core, your theme and your plugins, a look at Google's and the main browser blocklists, and a check that the site is up. If anything suspicious turns up, we investigate and clean it again at no extra cost. At the end you get a short email summary.
How do I know if my WordPress site has been hacked?
The common signs are a red "Deceptive site ahead" or "This site may harm your computer" warning in Chrome, visitors being sent to spam or gambling pages (often only on mobile, or only when they arrive from Google), Japanese or pharmacy keywords showing up in your Google results, admin users you didn't create, or your host suspending the account. Our guide to the signs of a hacked WordPress site goes through each one in more detail.
Will I lose any of my content?
No. We take a full backup of your files and database before we change anything. We remove the malicious code and files, and leave your pages, posts, products, orders and media alone. If a plugin or theme has been tampered with, we replace it with a clean copy of the same version or an updated one.
What access do you need?
Usually a WordPress administrator login and either your hosting control panel (cPanel, Plesk or similar) or SFTP access. Some infections live in the database or in files WordPress can't see, so admin access on its own is rarely enough. We'll tell you exactly what we need and how to share it safely. Change those passwords once we're finished.
How long does a clean-up take?
It depends on how big the site is and how badly it's infected. We start as soon as we have your WordPress and hosting logins, so the quicker we get those, the quicker you're clean. We give you an honest estimate with your quote, before you pay.
Why can't I just install a security plugin and let it fix things?
Security plugins are good at spotting known malware patterns, but hackers usually leave more than one way back in. A plugin might delete the obvious infected file and miss a backdoor hidden in the uploads folder, a fake admin account, or a malicious scheduled task in the database. Then the infection comes back a week later. Removing it properly means finding how they got in and every way they set up to return.
Will you remove the Google warning on my site?
Yes. Once the site is clean we request a review through Google Search Console (we can help you set it up if you don't have it). Google decides when to lift the warning, but malware reviews usually take a few days. We keep checking until it's gone.
What happens if the malware comes back after the 15 days?
If it returns after the monitoring period, get in touch and we'll look at it. Re-infection after a proper clean-up usually means something new: a fresh plugin vulnerability, a reused password, or another site on the same hosting account that wasn't cleaned. We'll tell you which it is and quote for the fix.
Do you work with WooCommerce and other plugins?
Yes. WooCommerce stores need extra care because of customer and order data, and because card-skimming malware targets checkout pages specifically. We check the checkout for injected scripts as part of every WooCommerce clean-up.
Do I need to tell anyone that my site was hacked?
If personal data such as customer names, emails or order details may have been accessed, UK GDPR may require you to report it to the ICO within 72 hours of becoming aware. We can't give legal advice, but we'll tell you what we found so you can make that decision with the facts in front of you.
Think your site has been hacked?
Send us the address and a line about what you're seeing. We'll tell you what we think is wrong and what it will cost to fix, before any work starts. Every clean-up includes 15 days of free monitoring.
Get your site checked