Your site is redirecting to somewhere you’ve never heard of. Google is showing a red warning page. Your host has suspended the account. Whatever brought you here, the fix is a fixed £200. And if I can’t solve it, you don’t pay.
It happens to good people running well-maintained sites. Attackers automate at a scale no individual can watch for, and they only need one unpatched plugin. Getting angry about it helps nobody; getting it cleaned, hardened and back online does.
Signs your WordPress site is compromised
- Visitors are redirected to gambling, pharmacy or adult sites. Often only on mobile, or only for first-time visitors
- Google Search Console reports “Deceptive site ahead” or flags harmful content
- Pages you did not write are appearing, frequently in another language
- Your host has suspended the account or is warning you about outbound spam
- Admin users exist that you did not create
- The site has become dramatically slower, or the server is under sustained load
- You can’t log in to wp-admin, or your password no longer works
- Customers tell you their antivirus blocks your site
If any of these sound familiar, act today. Every hour a compromised site stays live is more damage to your search rankings, your sender reputation and your customers’ trust.
What the £200 covers
1. Contain
First I take a full forensic copy of the site as it stands. Files and database, before changing anything. That copy is the evidence, and it means nothing is lost if we need to go back and look at how the attack worked.
2. Find it
Malware is rarely in one place. I check the WordPress core files against the official checksums, scan themes and plugins for injected code, and go through the database for the parts people miss, backdoors in wp_options, injected admin users, and scheduled tasks quietly re-infecting the site after every clean.
3. Clean it
Core files are replaced from source, not patched. Compromised themes and plugins are cleaned or reinstalled fresh. Injected database content is removed. Unknown admin accounts go, and every remaining credential is rotated. WordPress users, database password, FTP and SFTP, and the security salts in wp-config.php, which logs every existing session out.
4. Close the door
Cleaning without finding the entry point just buys you a few weeks. I work out how they got in. An outdated plugin, a weak password, a neighbouring site on shared hosting. And fix that specific hole, then harden file permissions, disable file editing from the dashboard, and lock down the obvious attack surface.
5. Get you back in the index
A clean site still carries the warning until Google is told otherwise. I submit the site for review through Search Console, request removal of any blacklisting, and confirm the malware flags have cleared.
6. Tell you what happened
You get a plain-English write-up: what was found, where it was, how it got in, what I changed, and what you should do next. No jargon designed to make the bill look bigger.
No fix, no fee
If I can’t recover your site, you don’t pay. I would rather turn down work I can’t deliver than take money for a job half done. In the rare cases where a site is beyond recovery. Usually no backups and a compromise months old. I’ll tell you early and talk about a rebuild instead.
Common questions
How long does it take?
Most sites are clean and back online the same working day. Larger sites, or ones where the compromise has been present for a long time, can take longer. I’ll give you a realistic estimate once I’ve looked, not before.
Is it really a fixed price?
£200 covers the work above for a single WordPress site. If you have a network of sites, or the site needs rebuilding instead of cleaning, I’ll quote separately and tell you before doing anything chargeable.
Can I just restore a backup instead?
Sometimes, and if that’s the right answer I’ll say so. The catch is that most people don’t know when the compromise started, so the backup they restore is already infected. And the hole that let the attacker in is still open.
What stops it happening again?
Keeping WordPress, themes and plugins patched, and having someone watching. That’s exactly what a WordPress care plan is for. And the Commerce plan includes malware removal at no extra cost if it ever happens again.
Start the rescue
Order below and I’ll be in touch to arrange access, or contact me directly if you would rather explain the situation first. Based in Cheltenham, working with businesses across Gloucestershire and the UK.
-
Hacked Site Support£200.00
Last reviewed and updated: