WordPress malware removal that closes the way in.
Spam pages, strange redirects or a Google warning on your site? WordPress malware removal, done by hand, closes the way in so it does not come back.
Why a scan alone does not stop reinfection
A malware scanner finds and deletes infected files, but it rarely finds how the attacker got in. The hidden admin user, the pirated plugin or the stolen password stays, and the site is reinfected within days.
The usual way
- Run a scanner, delete what it flags
- Leave the hidden admin user
- Hacked again a week later
How I do it
- Find the way in first
- Clean files, database and users
- Close the hole, then monitor
What the cleanup covers
Find the way in
The outdated plugin, the stolen password or the writable file that let the attacker in, found before anything is deleted.
Clean files and database
Injected code, backdoors and spam content removed from the files and the database, by hand rather than by scanner alone.
Users and passwords
Admin accounts that should not exist removed, and passwords and security keys reset.
Plugins and core
WordPress, themes and plugins updated or replaced, and abandoned plugins removed.
Google and your host
Help with the Search Console security review so warnings come off, and with your host if the account was suspended.
Monitoring after
Security monitoring on a care plan, so a new problem is seen the day it appears.
Related guides: How to check if your site is hacked · What fixing a hacked site involves · What malware removal costs · Google Ads Compromised Site flag
A recent cleanup: Google Ads flagged a SaaS site as "Compromised"
A SaaS client’s ads were disapproved for "Compromised Site", and an appeal made after a scanner cleanup had failed.
- 01
The way in
A pirated (nulled) copy of a paid caching plugin had carried the infection onto the site.
- 02
What the scanner missed
A second pirated plugin, the page builder’s Pro add-on, held hidden code that loaded content from an outside server over plain HTTP.
- 03
Checked against the source
WordPress core and every free plugin matched the official checksums. Uploads, the database, scheduled tasks and server keys were checked by hand, and Googlebot was served the same pages as visitors.
- 04
Closed and tidied
A file manager plugin attackers often target and two leftover plugins were removed, files anyone could download were taken offline, and the security keys were rotated. Everything removed was backed up first.
- 05
Next steps for the owner
Replace the pirated plugin with a licensed copy, review the eight admin accounts, and resubmit the Google Ads appeal, which went back into review the same day.
Security plugin, a cheap gig or a cleanup by hand?
All three can remove some malware. They differ in whether the site stays clean.
A security plugin
Good at flagging known infected files. It rarely finds the hidden admin user, the pirated plugin or the stolen password that let the attacker in.
A very cheap gig
Often an automated scan and a delete. If the way in stays open, the site is usually infected again within days.
A cleanup by hand
Finds the way in first, cleans files, database and users, closes the hole and checks the result the way visitors and Google see the site.
How a cleanup runs, step by step
1. Backup
A full copy of the infected site is taken first, so nothing is lost.
2. Find the way in
The plugin, password or file that let the attacker in is found before anything is deleted.
3. Clean
Injected code, backdoors and spam are removed from the files and the database.
4. Lock down
Unknown admin users removed, passwords and security keys reset, plugins updated or replaced.
5. Check
The site is checked as visitors and as Google see it, to confirm it is clean and not just quiet.
6. Google and report
Help with the Search Console review, and what was found and fixed written down for you.
What malware removal does not include
Rebuilding a damaged site
If the site must be rebuilt from scratch, that is a separate quote.
Ongoing protection
The cleanup fixes today’s problem. Updates, backups and monitoring each month are a care plan.
Paid licences
Replacing a pirated plugin means buying the real licence. I can tell you what to buy and install it.
What happens after you send the site
- Step 01
Find the cause
I test the site, read the errors and check what changed before I touch anything.
- Step 02
Fix the root
One clean fix where the problem lives, not a patch on top of it.
- Step 03
Measure it
Before and after numbers from PageSpeed Insights that you can check yourself.
- Step 04
Hand it over
You get notes on what was done, so the next change does not undo it.
Client recommendations
Recommendations from clients and colleagues, copied word for word from my LinkedIn profile.
Sakib has done a fantastic job with our Tabby 2.0 launch work along with continuous maintenance and updates on Tabby's website. He is very responsive and dedicated to any project he works on. I highly recommend him.
He is highly reliable and resourceful, with a great ability to solve problems effectively, even with limited tools and resources. His practical approach and problem-solving skills make him a valuable member of our team.
Sakib Islam is an exceptional Senior WordPress Developer with deep expertise in custom development, performance optimization, and clean, scalable code. Reliable, proactive, and easy to work with, they consistently deliver high-quality results.
His attention to detail, commitment to clean and scalable code, and deep understanding of modern frontend frameworks have consistently elevated the quality of our digital products.
His ability to translate ideas into functional designs and optimize website performance sets him apart. Beyond his technical skills, Sakib is detail-oriented, creative, and an excellent communicator.
I had the pleasure of working with Sakib Islam on several projects, and I was really happy with his performance and commitment.
Every one of these can be checked onmy LinkedIn recommendations ↗.
Your questions about WordPress malware removal
Ask something else on WhatsAppHow do I know my WordPress site is hacked?
Common signs are spam pages in Google results for your site, visitors being redirected elsewhere, a "deceptive site" warning in Chrome, new admin users you did not create and a host suspension notice. The guide on checking for a hack walks through each one.
How much does malware removal cost?
Malware removal starts at $99 for one WordPress site. A deep infection, several sites on one account or a store can cost more, so you get a written quote after a free first look. Nothing starts until you have agreed the price.
Will I lose my content?
No. I take a full backup of the infected site first, then clean it. Your pages, posts and orders stay.
Will the Google warning go away?
Once the site is clean, I help you request a review in Google Search Console. Google usually reviews within a few days, and the warning comes off when the review passes.
Will it come back?
Not through the same hole, because closing it is part of the job. Keeping plugins updated and the site monitored afterwards is what stops the next one.
Is a security plugin enough to remove malware?
A plugin can flag known infected files, but it rarely finds how the attacker got in. That is why sites get reinfected after a scan-and-delete. A cleanup by hand finds the way in and closes it.
Does malware removal include ongoing protection?
No. The cleanup fixes the current infection and the hole behind it. Monthly updates, backups and monitoring are a care plan, which keeps the site safer afterwards.
Need WordPress malware removal?
Reply within 24 hours · Hours overlap US, UK and Australia