Full recovery, not just cleanup
Hacked WordPress Site Repair and Full Recovery
Get a hacked WordPress site back — service restored first, then files and database cleaned, the entry route closed, credentials rotated, blacklists cleared and the whole thing written up. 500+ sites recovered on WordPress alone.
Get a free written site audit
Send the address and we return a written report inside one working day: patch backlog, exposure, load timings, restore status.
- Service restored first, cleanup in parallel — you are not down while we work
- Rankings and blacklist status recovered, not just files
- Every credential rotated: admin, database, FTP, hosting, API keys
- Written incident report you can give a client or an insurer
What this covers
- Emergency triage and evidence snapshot
- Service restored from a clean point
- Full file and database cleanup
- Rogue admin accounts and scheduled tasks removed
- Entry route identified and closed
- All credentials rotated
- Hardening applied so the same route cannot be reused
- Google Safe Browsing and host blacklist clearance
- Search Console review and reindexing where rankings were hit
- Written incident report
Restore service first
The instinct is to take the site down and clean it properly. For most businesses that is the wrong order — a day of downtime often costs more than the breach itself.
We restore from a clean point so visitors have a working site, then do the forensic work against the snapshot. The exception is a site actively serving malware to visitors or leaking data, where it comes down immediately.
Why cleaned sites come back infected
The most common thing we are called about is a site that was cleaned a fortnight ago and is compromised again. It is nearly always the same story: the payload was removed and the way in was left open.
Malware on WordPress persists in more places than the file system. Injected rows sit in post content and in the options table. Administrator accounts nobody created survive a file replacement untouched. Scheduled tasks and must-use plugins reinstate the payload on a timer, days after everything looked clean.
A cleanup that replaces files and stops there addresses the visible half. We treat the entry route as the deliverable and the file cleanup as a step inside it, which is why the written report names how they got in rather than only what was removed.
Recovery ends when the route is shut. Staying uncompromised is hardening and daily scanning on a schedule, bundled into WordPress maintenance so it does not depend on anyone remembering — unlimited hack recovery sits on the Business tier in maintenance plans and pricing.
How the work runs
- TriageWhat is compromised, what is still serving, and whether visitor data is involved. That last question changes the order of everything else.
- Restore serviceVisitors get a working site while the forensic work continues. Being down for the length of a cleanup is a choice, not a requirement.
- Clean thoroughlyFiles diffed against known-good, database scanned, cron and must-use plugins checked, users audited.
- Close and rotateThe vulnerability is fixed and every credential is changed. Cleanup without rotation leaves a stolen password valid.
- Clear the recordBlacklist reviews, Safe Browsing, and Search Console security issues, chased until they clear.
- ReportTimeline, entry route, what changed, what to watch. Useful for a client, an insurer, or a regulator.
Plans that include this
- Starter$39/monthor $390 a year — two months freeBlogs, portfolios and brochure sites
- UpdatesMonthly
- BackupsWeekly, 30-day retention
- Uptime5-minute checks
- Malware removalNot included
- Most chosenProfessional$79/monthor $790 a year — two months freeSmall businesses and lead-generation sites
- UpdatesWeekly + PHP version management
- BackupsDaily, 60-day retention
- Uptime1-minute checks
- Malware removalIncluded
- Business$149/monthor $1490 a year — two months freeStores, membership sites, anywhere downtime costs money
- UpdatesWeekly, tested on staging first
- BackupsDaily, 90-day, multi-location
- Uptime1-minute + 2-hour restore
- Malware removalIncluded
What clients say
They found malware two of our previous agencies had missed, cleaned it in an afternoon, and told us exactly how it got in.
Operations Director, professional services, 4 sitesThe staging step is the whole point. Three years and not one update has taken our booking form down.
Practice Manager, healthcareWe resell it to 31 clients under our own brand. The reports go out with our logo and our clients have never heard their name.
Agency Founder, digital agency
The service that covers this
WordPress price and packageCompare three levels of ongoing WordPress care, priced per month and set out feature by feature so you can see exactly what each tier patches, backs…
Related pages
Questions people ask before calling
My site shows a red warning in Chrome.
That is Google Safe Browsing. It clears after the site is genuinely clean and a review is submitted — usually 24–72 hours after cleanup, and we chase it.
Will I lose my rankings?
There is usually a dip if the site was blacklisted or serving cloaked spam. Recovery typically takes weeks once the warning clears and the injected content is gone.
Should I just restore an old backup?
It restores the files and usually restores the vulnerability with them. If the backup predates the breach it is a good starting point, but it is not the whole job.
How do you find out how they got in?
Server access logs, file modification times, the plugin versions present at the time, and the shape of the payload. It is not always conclusive, and we say so when it is not.
What does it cost?
Quoted after triage, because the range is genuinely wide. On Business it is included, unlimited.