WordPress malware removal service: clean, close the hole, get off the blacklist

You need a WordPress malware removal service when there are signs that someone else controls part of your site. Common ones: visitors from Google or on phones get sent to a spam or scam site while you see nothing wrong, Chrome shows a red "Deceptive site ahead" warning, search results show Japanese or pharmacy text under your pages, your host has suspended the account for sending spam, or admin users you never created appear in the dashboard.

If any of that is happening, act quickly but do not start deleting files at random. Deleting the visible malware while the backdoor stays in place is the most common reason a hacked WordPress site gets reinfected within days. Change your WordPress and hosting passwords, tell your host, and keep a copy of the site as it is.

This service is for a WordPress site that is infected now. If you want a site kept updated and watched so this is less likely to happen, that is WordPress maintenance.

Malware scanners are useful for a first look, but attackers write code to avoid them, so a scanner alone often leaves something behind. When I fix hacked WordPress site infections, I work through every place code or data can hide.

• Contain it: keep a copy of the infected state, reset every password and key, log out all sessions and rotate the security salts.
• Compare files with the originals: WP-CLI verifies core and plugin files against WordPress.org checksums. Anything that differs, or should not exist, is examined. Core, plugins and themes are then replaced with clean copies from WordPress.org or, for premium ones, the vendor.
• Hunt for backdoors: obfuscated code using eval, base64_decode, gzinflate or str_rot13, PHP files inside wp-content/uploads, fake plugins with plausible names, code added to wp-config.php, functions.php or the mu-plugins folder.
• Clean the database: scripts injected into posts, widgets and options, changed siteurl or home values, spam pages, and administrator accounts nobody recognizes.
• Check scheduled tasks and server rules: WP-Cron events and server cron jobs that reinstall the malware, and .htaccess rules that redirect certain visitors.
• Read the logs: access logs show which request created the first malicious file, which usually points straight to the vulnerable plugin, the stolen password or the other site on the same hosting account.

The WordPress hacked redirect is the infection people find most confusing. The malicious code checks who is visiting. Logged-in administrators and people typing the address directly see the normal site; visitors arriving from Google, or on a phone, are sent to a scam page. Some versions only redirect each visitor once, so it is very hard to reproduce.

The redirect can live in a JavaScript snippet injected into the database, in a modified theme file, in .htaccess, or in a plugin that looks legitimate. I test as a search visitor and as a mobile visitor, and trace the redirect back to its source rather than guessing. I have written a fuller guide to fixing a WordPress hacked redirect if you want to understand what you are dealing with.

To remove the Google blacklist warning, the site has to be completely clean first. Google's Safe Browsing system is what shows the red warning in Chrome and other browsers. Once every infected page is fixed, I submit a review request through the Security Issues report in Google Search Console, with a short explanation of what was found and removed. Google says these reviews can take from several days to a few weeks, and a request made before the site is clean can slow down the next one, so I do not rush it.

Other services keep their own lists, so I also check Norton Safe Web and similar tools and request reviews where the site is listed. If the hack created thousands of spam pages, those URLs need to return 404 or 410 so Google drops them; a technical SEO audit afterwards can confirm the index is clean.

WordPress security hardening is what stops the same attack working twice. I fix the specific way in first, then add sensible layers that do not get in your way.

• Update or remove the vulnerable plugin or theme, and replace any nulled (pirated) theme or plugin, which often contains malware from the start
• Remove unused plugins, themes and old admin accounts; give each person the lowest role they need
• Two-factor login for administrators and limits on login attempts
• Disable the built-in file editor and block PHP from running in the uploads folder
• Correct file permissions and a firewall layer such as Cloudflare or Wordfence
• Off-site backups and file change monitoring, so a future problem is caught early

Malware is PHP code, usually obfuscated, so reading it is a developer's job. I write PHP and work on application security every day, which means I can tell a backdoor from an ugly but harmless plugin, and fix custom theme code an automated tool would skip. You deal directly with me, and I work remotely from India with clients in different time zones. My client WordPress work is private, but I can walk you through it on a call.

The cost depends on the size of the site, how many sites share the hosting account (one infected site often infects its neighbours), how long the infection has been there, whether the database is affected, and whether blacklist reviews are needed. A fixed quote follows a short call or a written description of what you are seeing.