What happens after you message me about a hacked site
When your WordPress site has been hacked, you want to know what happens next and when. This is the sequence I follow on every malware removal job.
- Quick triage. On WhatsApp or a call: what you are seeing, since when, whether your host has suspended the account, whether Google shows a warning, and whether you can still log in. Screenshots and the exact URLs help.
- Access and a snapshot. Once I have hosting and WordPress access, a full copy of the infected site is saved before anything changes. It is a safety net, and evidence of how the attack worked.
- Investigation. Core files are compared with official copies, and I look for PHP files hiding in the uploads folder, unexpected must-use plugins, edited .htaccess rules, injected scripts in posts and settings, unknown admin users and rogue scheduled tasks. Server logs, where the host keeps them, can show when it started and how they got in.
- Cleanup and hardening. Everything found is removed or replaced from clean sources, then the hole is closed.
- Verification. The site is scanned again and checked the way Google and a mobile visitor arriving from search see it, because many infections show only to those visitors. Every other site in the same hosting account is checked too.
- Recovery. Review requests go to Google through Search Console where there is a warning, and to your host if the account was suspended.
Common hacks, and where they hide
| What you notice | Usual cause | Where it usually hides |
|---|---|---|
| Visitors from Google or on mobile land on spam or scam sites | Redirect hack | .htaccess rules, injected JavaScript in the database, fake plugins |
| Japanese or pharma pages in Google results | SEO spam hack | Generated pages, cloaking code in theme files, unknown owners added in Search Console |
| Your host warns about spam email or suspends the account | Mailer script | PHP files in uploads or old plugin folders |
| Customers report card fraud after buying from you | Checkout skimmer | Injected script on the checkout page, often stored in the database |
| Malware returns days after a cleanup | Backdoor left behind | Disguised PHP files, hidden admin users, cron jobs, other sites in the account |
Each has its own guide: a site sending spam emails, WooCommerce card skimming malware and finding and removing backdoors.
WordPress redirect hack removal: why it is hard to spot
A redirect hack is built to hide from you. It usually skips logged-in administrators, fires only for visitors arriving from Google or on a phone, and often sets a cookie so the same visitor is redirected just once. So you open your site, everything looks normal, and meanwhile customers are being sent to scam pages.
The code is rarely in one place. It can sit in .htaccess, in the database, in a theme file and in a fake plugin at the same time, plus a backdoor to put it all back. Removing only the part a scanner flags is why so many redirect hacks return within days. How to find and remove the redirect hack walks through every location.
Security plugin, one-time cleanup or ongoing protection?
| Free scanner plugin | One-time cleanup | Cleanup plus maintenance plan | |
|---|---|---|---|
| Finding malware | Known signatures in files; can miss database injections and disguised backdoors | Manual investigation of files, database, users and the hosting account | As a one-time cleanup, then regular scans |
| Stopping reinfection | Only if you find and close the hole yourself | Entry point closed and security hardened | Plus updates every month, so new holes close quickly |
| Google warnings and host suspension | Not handled | Review requests handled | Handled, with uptime monitoring afterwards |
| What you pay | Free, or a premium licence | A fixed quote after a free review | The cleanup, then a monthly fee |
Scanners are useful early-warning tools; WordPress malware scanners compared explains what each type can and cannot see. To stay protected after a cleanup, a maintenance plan keeps updates, backups and monitoring running every month.
Signs a DIY cleanup has not worked
- You deleted the infected files and the malware came back.
- A scanner says the site is clean, but Google still shows a warning.
- Admin users you removed reappear.
- Your host suspended the account again after you restored it.
- Spam pages keep appearing in search results.
What is included, and what is not
The cleanup list near the top of this page is the core of the job. A few things sit outside it:
- Other sites in the same hosting account need checking too, because one infected site can reinfect the rest. Tell me about all of them so the quote covers them.
- Rebuilding lost content. If the database is badly damaged and no clean backup exists, rebuilding pages is a separate job, and I will tell you before it comes to that.
- Card-data forensics. If a skimmer may have captured payment details, your payment gateway needs to know. I handle the technical cleanup and give you the facts to share with them.
- Google's timing. I submit the review request; Google decides how quickly the warning comes off.
How long a cleanup takes
Most cleanups are done within a day or two of getting access. What makes one take longer: several sites in one hosting account, deep backdoors, file-manager-only access with no SSH, a suspended account that the host must unlock first, or thousands of spam pages to remove. After the site is clean, Google's review can take from a few days to a few weeks depending on the type of issue, and spam URLs drop out of results as Google recrawls. "This site may be hacked" in Google results and recovering rankings after a hack explain that stage.
How to prepare before I get access
- Do not delete the site or reinstall WordPress over it. You could lose content and the evidence of how they got in.
- Do not restore an old backup blindly. If it was taken after the infection started, the malware comes straight back. Tell me what backups you have and their dates.
- Change your hosting password, and any email password that was the same.
- Note what you saw: screenshots, URLs, the device, and where you clicked from.
- Have your hosting login ready, plus Search Console if you use it. If your host has suspended you, read hosting suspended for malware first.
What you get at the end
- A plain-English report: what was found, where, what was removed, and the likely way in when the evidence shows it.
- A fresh backup of the clean site, kept separate from the infected copy.
- A list of every user removed and every password you should change.
- Hardening and firewall settings in place, and review requests sent where there was a warning.
Who this is for
Business owners whose site is showing warnings or redirecting visitors, online stores where a hack puts payments at risk, and agencies with a hacked client site. Any site with public sign-ups or customer accounts needs the user audit done with extra care after a hack, because a rogue account can hide among the genuine ones. If your site is hacked right now, send me a WhatsApp message and I will review it and send a fixed quote.
