WordPress Malware Removal

What the service covers

WordPress malware takes a handful of familiar shapes. There is injected code that redirects mobile visitors to scam pages, hidden links and pages that sell pharmacy products or fake goods, scripts that skim payment details on checkout pages, and backdoors that let an attacker return whenever they like. There are also quieter changes: an extra administrator account with a plausible name, a scheduled task that rewrites files every night, or a modified .htaccess file that only misbehaves for visitors arriving from Google.

Our malware removal covers all of these. In practice that means:

• files in the WordPress core, your theme, your plugins and the uploads folder;
• the database, including posts, options, widgets and user records;
• server files that affect the site, such as .htaccess, wp-config.php and any loose PHP files in the account;
• scheduled tasks, both WordPress cron events and any server cron entries we can see;
• user accounts, roles and application passwords.

How we remove it

1. Copy first. We take a full copy of the files and database before touching anything. If something goes wrong, the site can be put back exactly as it was, and the copy also preserves evidence if you need it later.
2. Scan and compare. Automated scanning gives a first list. Then we compare WordPress core files against the official release for your version, and plugins and themes against fresh copies from their source. Anything that differs is read by a person.
3. Check the database. We search for injected scripts, unexpected redirects in options, spam posts and links, and new or altered admin accounts.
4. Remove and replace. Where a file can be replaced with a clean original, we replace it rather than edit it. Custom files, such as a theme written for you, are cleaned by hand.
5. Find the entry point. We review access logs where the host keeps them, check plugin and theme versions against known security fixes, and look at file dates. We report what we can confirm and what we cannot.
6. Close it and harden. Outdated software is updated, unused plugins are removed, passwords are reset and file editing in the dashboard is switched off, in line with the WordPress hardening guide ^[1].

What you receive

When the work is done you receive a short written report. It lists each infected file or database entry and what happened to it, the accounts that were removed, the updates applied, the probable entry point, and anything we recommend you do next. If Google has flagged the site, the report also says whether the Search Console Security Issues report is clear and whether a review request has been sent.

You also get the pre-cleanup copy for your records, kept for the period agreed in the quote. Some owners need it for an insurer or for their own data breach assessment.

What we need from you

• A temporary administrator login for WordPress, created by you for this job.
• Access to the hosting control panel or file access over SFTP. If you are not sure what you have, tell us the name of your host and we will explain what to ask for.
• Access to Google Search Console if it is set up, or permission to verify the site on your behalf.
• A list of anyone else who has worked on the site recently, so we know which changes are expected.

What we cannot promise

No honest provider can promise that a site will never be attacked again. New weaknesses keep appearing: Patchstack, a WordPress security company, counted 11,334 new vulnerabilities in the WordPress ecosystem in 2025, 91% of them in plugins, and rated 17% as likely to be exploited in automated mass-scale attacks ^[4]. What we can do is remove what is there, close the gaps we find, and leave the site in a state where the next problem is less likely and easier to spot.

We also cannot promise how long Google will take to remove a warning. Google says reviews can take from several days to several weeks, depending on the issue ^[2]. We request the review once the report is clear, and we tell you when it changes.

What you can rely on is careful work: the ACCC reminds businesses that services must be done with acceptable care and skill ^[3]. Our quotes put the scope, the price and any follow-up check in writing, so you can see exactly what was agreed.

When malware removal is not enough

If the site is badly damaged, or if cleaning in place would leave too much doubt, we recommend a full recovery from a clean backup or a rebuild instead. If the site is clean but still flagged, the next step is warning removal. If the site is still slow after cleanup, our speed fixes after an incident clear what the attacker left behind. And if you would like regular updates and checks afterwards, see our maintenance plans.