1. First look and a fixed quote
You send us your website address and tell us what you're seeing. Before we ask for any logins, we check the site from the outside. We look at Google Safe Browsing, search Google for spam pages indexed under your domain, load the site as a mobile visitor and as someone arriving from a search result (a lot of malware only shows itself to those visitors), and look at the page source for injected scripts.
That's usually enough to tell what kind of infection it is and roughly how big a job it will be. We send you a fixed price. Nothing starts until you say yes.
2. Access and a full backup
We'll need a WordPress admin login and hosting access, either your control panel or SFTP. Admin access alone usually isn't enough. Plenty of malware lives in files WordPress never loads through the dashboard, or in database tables a plugin can't see.
Before changing anything, we take a complete backup of the files and the database and keep it off the server. If something unexpected happens, we can always get back to where we started.
3. Finding everything that doesn't belong
This is the bulk of the work, and it's where cheap clean-ups cut corners. We go through the site in layers.
- WordPress core. We compare every core file against the official copy for your version. Anything modified or added gets looked at.
- Plugins and themes. Same again, against clean copies from WordPress.org or the developer. Nulled (pirated) premium plugins are a common source of infection, and we'll flag any we find.
- The uploads folder. It should only contain images and documents. PHP files in there are almost always backdoors.
- The database. We search posts, options and widgets for injected scripts and spam links, check the site URL settings haven't been changed, and review scheduled tasks.
- Users. Every administrator account gets checked. Ones you don't recognise are removed after we confirm with you.
- Server config. Files like
.htaccess,wp-config.phpandphp.iniget edited by malware to set up redirects or load hidden code.
Automated scanners help here, and we use them. But they only catch what they already know about. Reading through suspicious files by hand is what finds the obfuscated backdoor that no scanner has a signature for yet.
4. Closing the way in
Cleaning a site without fixing the entry point is how you end up paying twice. Once the malware is out, we update WordPress, plugins and themes, replace anything abandoned by its developer, reset all passwords and the security keys in wp-config.php, and tighten file permissions. If we can see from the logs or the file dates how they got in, we'll tell you.
Sometimes the problem is bigger than your site. On shared hosting, another site in the same account can re-infect yours. If we see that, we'll explain the options rather than quietly cleaning the same thing twice.
5. Getting blocklist warnings removed
If Google is showing a warning, we request a review through Google Search Console once the site is clean. Google makes the final decision, and malware reviews usually take a few days. If your host suspended the account, or the domain is on an email or security blocklist, we contact them with the details of what was cleaned.
6. 15 days of free monitoring
Then we keep watching. Every day for 15 days we scan the files, check for any changes, check the blocklists and make sure the site is up. If anything comes back, we deal with it at no extra cost. Here's exactly what the monitoring covers.
7. Your report
At the end you get a short, plain-English report. It says what we found, where it was, what we think caused it, what we changed, and what we suggest you do from here. It's useful for your own records, and useful if you need to explain the incident to customers or the ICO.