Emergency cleanup for hacked WordPress and WooCommerce sites, including backdoor removal, Google blacklist requests and post-cleanup hardening.
Signs your WordPress site has been hacked
- Visitors are redirected to casino, pharma or scam websites.
- Google shows "This site may be hacked" or Chrome shows a red warning page.
- Strange admin users appear, or you are locked out of your dashboard.
- Your host suspended the account for malware or spam.
- Search results show Japanese or pharmaceutical keywords for your pages.
- The site suddenly became very slow or your traffic dropped sharply.
If any of these sound familiar, stop making changes and send me a message. Speed matters, because every day of infection costs rankings and trust.
How the clean-up works
Professional WordPress malware removal is more than deleting one infected file. It means finding every copy of the infection and the hole it came through.
- Backup first. I take a full backup of the infected state so nothing is lost and the attack can be analysed.
- Find everything. I scan files, database,
.htaccess,wp-config.php, scheduled tasks and the uploads folder for malicious code and hidden backdoors. - Clean or replace. Core files are replaced with clean copies, infected plugins and themes are reinstalled or removed and database injections are cleaned.
- Find the entry point. Unless the hole is closed, the site will be reinfected. I identify the vulnerable plugin, weak credential or server issue involved.
- Reset access. Passwords, salts, API keys and FTP or SSH credentials are rotated and unknown users are removed.
- Remove warnings. I submit review requests to Google Search Console and other blacklist providers.
- Harden. I apply the protections from WordPress security hardening so the same attack fails next time.
# verify core files against the official checksums
wp core verify-checksums
wp plugin verify-checksums --all
# look for classic backdoor patterns
grep -R --include=*.php -nE "base64_decode|eval\(|gzinflate" wp-content | headWhy not just restore a backup?
Restoring an old backup sometimes works, but backups can also contain the infection or the same vulnerable plugin. A proper clean-up removes the cause, not only the symptoms. If your hosting is part of the problem I can also migrate your site to a safer server.