Hacked website repair for US and Canadian small businesses
WordPress malware removal and hacked website repair
If your site is redirecting visitors, sending spam or showing a red warning in Chrome, I will find the infection, clean the files and database, and shut the door it came through. Cleanups start at $100. Prices are in US dollars.
Diagnosis
I go through the symptoms, files, database, user accounts, CMS, plugins, server logs and hosting settings to see how far the damage goes.
Cleanup
Malicious code, backdoors, injected scripts and rogue files come out, and legitimate content stays.
Hardening
Updates, new passwords, correct file permissions, an admin account audit, SSL, backups and a baseline level of protection.
Follow-up
I recheck pages, forms, Google indexing, error logs and email to make sure nothing has crept back.
A hacked website rarely announces itself
Picture a roofing contractor in Texas whose homepage loads fine every morning. Meanwhile the site is sending junk email, quietly publishing hundreds of foreign-language pages and sending some visitors to a gambling site. The owner finds out when a customer calls to say Chrome showed a warning. Here are the signs I see most often.
Google or browser warning
Chrome or Search says the site is dangerous, may contain malware or is deceptive. Often the first sign is a message in Search Console.
Hidden spam pages
Unfamiliar pages show up in search results: pharmacy offers, casino text, Japanese-language product listings or strange URLs full of outbound links.
Redirects and pop-ups
Visitors on phones land on another site, ads appear that you did not place, or the site looks normal to you when you are logged in and different to everyone else.
Unknown users
Admin accounts you never created, changed roles, new FTP or SFTP users, or passwords that stopped working.
Suspicious files
Odd PHP files in upload folders, a modified index.php, unfamiliar directories, web shells or code injected into the theme.
Spam and email trouble
The site sends mail you did not write, the host suspends outgoing email, your domain lands on a blocklist or the contact form behaves strangely.
Deleting the bad file is only half the job
If I remove one malicious file and leave the hole it came through, the site is usually reinfected within days. That is why I look at more than the symptoms: the CMS version, plugins, the theme, user accounts, passwords, file permissions, the database and the server configuration.
- Before touching anything, I save the current state of the site and check whether a clean backup exists to fall back on.
- I search for malicious code in files, the database, themes, plugins, the uploads folder, scheduled tasks and user accounts.
- Once the site is clean, I update whatever was vulnerable and tell you in plain language what to do going forward.
Platforms I work with: WordPress (most common), Joomla, PrestaShop, custom PHP sites, shared hosting, VPS and dedicated servers, databases and Google Search Console. If you already have a recent backup and want to restore rather than clean, see backups and recovery.
Contain first, clean second
When a site is infected the worst move is to start clicking around in a panic. I work in a fixed order so that the site stays usable and the way in actually gets closed.
Diagnosis
Symptoms, files, database, CMS, plugins, users, access credentials, logs and hosting or server settings.
Snapshot
I save the infected state and verify any existing backup, so nothing good on the site is lost during cleanup.
Cleanup
I remove malicious code, injections, suspicious files, unneeded users and every trace of the break-in I can find.
Closing the way in
Updates, new passwords, file permissions, vulnerable plugins and themes, email sending, SSL and server settings.
Verification
Pages, forms, Google indexing, error logs, email delivery and speed, plus advice on staying protected.
Why a cleanup without upkeep often fails
- WordPress or its plugins have not been updated in a long time
- An unknown admin account is still there
- Passwords were never changed after the break-in
- File permissions on the host are too loose
- Malicious entries are still hiding in the database
- An abandoned theme contains vulnerable code
- There are no regular backups and nobody is watching the site
- The VPS or server itself is out of date
- Email and forms are set up in an insecure way
- The real cause was never found, only the visible symptoms were removed
Questions small business owners ask about hacked websites
What should I do first if my WordPress site is hacked?
Stop making changes and do not delete files at random. Write down what you see, take screenshots, and change the passwords for hosting, WordPress and email from a device you trust. Then get someone to take a copy of the site as it is now and look at the files, database, users and hosting access.
Can the malware be removed without losing my site?
Almost always. The aim is not to wipe everything that looks odd but to find the malicious code, keep your real pages, photos and orders, clean the database and confirm the site works afterward.
Google shows a “deceptive site” or “site may be hacked” warning. How do I get rid of it?
Clean the site and close the entry point first. After that you can request a review in Google Search Console. If the cause is still open, the warning tends to come back, so the order matters.
Why did the malware return after the last cleanup?
Usually the earlier cleanup removed what was visible but left the way in: an outdated plugin, a vulnerable theme, a rogue admin user, a weak password, loose permissions, infected database entries or a problem at the host.
Which kinds of sites can you clean?
WordPress most often, but also Joomla, PrestaShop and custom PHP sites, on shared hosting, a VPS or a dedicated server. The approach depends on the platform, how the files are organized, the access I have and whether a backup exists.
What access do you need from me?
For a full cleanup I almost always need hosting or file manager access (or SFTP), the database and a WordPress admin login. On a VPS I may also need SSH. Most US and Canadian hosts let you create a temporary account for this, which you can delete afterward.
Can I just restore the site from a backup?
Yes, if the backup is clean and recent enough. A rollback by itself is not a fix, though. Unless the way in is found and closed, the site can be reinfected, and plugins and logins need checking after the restore.
How long does a cleanup take, and what does it cost?
Hacked-site cleanup starts at $100, and the final price depends on the size of the site, the platform, the number of files, the state of the database and how deep the infection goes. A small brochure site can often be done quickly. A busy online store or an old custom-built site needs more careful diagnosis. If the site is down during your busiest season, tell me up front and I will plan around it.
Do customers’ card details get exposed when a site is hacked?
It depends on how your store takes payments. If you use a hosted checkout such as Stripe, PayPal or Square, card numbers normally never touch your server, but a hack can still harm trust and rankings. Whether any notification duty applies to you depends on where your customers live and what data you hold, so check what applies to you. I am not a lawyer.
What protection do I get after the cleanup?
I update WordPress and plugins, reset passwords, review users and file permissions, check backups, SSL and email, tighten the admin area and give you recommendations for regular upkeep.
Can you look after the site after the cleanup?
Yes, and it is the sensible next step. Regular updates, backups, monitoring and security checks cut the chance of reinfection. Have a look at website maintenance plans, which start at $79 per month.
Think your site is infected? Start with a diagnosis.
Tell me what you are seeing and I will reply with the next step, whether you are on the East Coast, the West Coast or anywhere in Canada.