Have a web emergency? We'll fix your site free! →
Main Menu
Menu
Main Menu
Site Health · Recovery

WordPress Hack Cleanup by Real Engineers

A hacked site loses traffic, trust and email delivery. We find the entry point, remove the attacker and close the hole.

  • Backdoor and shell removal
  • Entry point found and patched
  • Passwords and keys rotated
  • Hardening after cleanup
Fix My Site Free
Run a Free Security Test
  • Trusted WP Experts Since 2008
  • Trustpilot Excellent ★ 4.3
  • Secure or It’s Free Guarantee
Isometric rack server with a glowing crack that a repair scan seals, a neon warning sign turns into a neon check inside a rotating glass shield

What attackers leave behind

Removing the malware isn’t enough. Attackers leave ways back in. Here is what a typical hacked site hides. Switch views to see the cleanup.

6 signs of compromise, site at risk0 signs left, site clean

Backdoor in uploadsA PHP shell hidden in the media folder.Removed, and uploads blocked from running PHP.wp-content/uploads/2024/03/cache.php
BackdoorRemoved
Rogue admin userA hidden admin account named like a system user.Deleted, and every session logged out.
Rogue adminDeleted
Spam redirectMobile visitors get sent to a scam site.Redirect code removed from the server config and database..htaccess
RedirectRemoved
Modified core filesWordPress core files changed by the attacker.Core reinstalled from a clean copy.wp-includes/
ModifiedReplaced
Entry pointAn outdated plugin with a known hole.Plugin patched and a firewall rule added.
OpenClosed
Leaked passwordsOld passwords, salts and keys still work.Passwords, salts and API keys rotated.
ExposedRotated

Example findings, not a customer report.Run a free security test

What every hack cleanup includes

We handle the whole incident, from triage to cleanup to hardening, so your site comes back clean and stays that way.

Locked out of your site?We can still clean it. With hosting or file access, we remove the attacker and reset your admin access.

Find

  • Full malware and backdoor scan
  • Manual code review of core, themes and plugins
  • Imunify360 deep scan
  • Entry point found

Clean

  • Database cleaning and integrity check
  • Core, theme and plugin reinstall
  • File permission and ownership reset
  • Spam and redirect code removed

Lock out

  • Admin user and credential audit
  • Passwords, salts and API keys rotated
  • Sessions logged out
  • Cloudflare WAF rules tightened

After

  • Blacklist review requests
  • Post-cleanup hardening report
  • 60 days of monitoring
  • 1 month of free WP Farm hosting

A cleanup that closes the door

A scanner finds known malware. A real cleanup has to find the way in, remove every backdoor and lock the attacker out.

What gets done
Security plugin scanWorks inside WordPress
Freelancer or agencyVaries by person
WP FarmOne team, server to site
Finds known malware
Yes
Yes
Yes
Finds disguised backdoors
Known patterns only
Sometimes
Yes
Cleans the database
No
Sometimes
Yes
Finds and patches the entry point
No
Sometimes
Yes
Rotates passwords, salts and keys
No
Sometimes
Yes
Files blacklist reviews
No
Sometimes
Yes
Reinfection guarantee
No
Varies
60 days

Back online, most within 24 hours

Send access and we take it from there, with a status update at every stage.

  1. 1

    Send access

    We start within 30 minutes, isolate the site and put up a maintenance page.

  2. 2

    Scan and identify

    We find the malicious code, backdoors and the exploit, and send a first breach report.

  3. 3

    Clean and restore

    We remove infected files, clean the database, revoke access and bring the site back.

  4. 4

    Harden and monitor

    We patch the hole, tighten the firewall and monitor your site for 60 days.

Complex break-ins or large stores can take 48 to 72 hours.

Get your site back today

Pay once for a full cleanup, or host with us and we fix it free.

Hacking Repair

One-time fix

Hacked, defaced or redirecting? We isolate the breach and restore your site safely.

How many sites?

$200$400$600$800$900one-timeone-time, $200 per siteone-time, $200 per siteone-time, $200 per siteone-time, $180 per site
  • Full malware and backdoor scan
  • Manual code review of core, themes, plugins
  • Database cleaning and integrity check
  • Core, theme and plugin reinstall
  • File permission and ownership reset
  • Admin user and credential audit
  • Imunify360 deep scan
  • Cloudflare WAF rules tightened
  • Post-cleanup hardening report
  • 1 month of free WP Farm hosting
Repair My Site

No commitment required. Includes the Secure or It’s Free Guarantee.

Emergency Fix

Free with hosting

Hacked, broken or offline? Host with WP Farm and we fix it free.

$0repair fee
  • Hacked, broken or offline WordPress sites
  • You pay only for a month of hosting
  • No contracts
  • Secure intake form for logins
  • Tell us the impact level, P1 to P4
  • Free migration to WP Farm
Fix My Site Free

Hosting starts at $35 per month

Clean, or you don’t pay

If we can’t resolve the issue within the agreed scope of work, no charge is applied to your account. If your site is compromised again through the same hole within 60 days, we clean it again at no charge.

The full Site Health lineup

Hacking Cleanup is one of eight hands-on services, from tuning to recovery.

A plugin vulnerability surfaced and they audited, explained the risk, and fixed it, no downtime.
WP Farm customer

4.3 out of 5

Rated Excellent by our customers on Trustpilot.

Read Our Reviews

Questions before you start

Straight answers when your site is under attack.

Still unsure? Ask a WordPress expert

How fast can you clean my site?

Most cleanups are done and back online within 24 hours of access. Complex break-ins with many backdoors, or stores with thousands of files, can take 48 to 72 hours. We start triage within 30 minutes and update you at every stage.

Will I lose my content, products or customer data?

No. The cleanup replaces core files and plugins but leaves your content in place. Posts, pages, media, products, orders and customer data are kept. We never restore from a backup older than the breach unless you ask us to.

How do I know you got everything?

We scan every file, every database table and every entry point, including webshells hidden in image uploads, theme files and core. You get a report showing what we found and where.

What if my site gets hacked again?

Every cleanup includes 60 days of monitoring and a reinfection guarantee. If your site is compromised again through the same hole within 60 days, we clean it again at no charge.

Will my site come off Google’s blacklist?

Yes. After cleanup we file review requests with Google Search Console, Norton Safe Web and any other list flagging you. Google usually reviews malware cases within 1 to 3 days.

Can you fix my site if I can’t log in?

Yes. With hosting or file access we can clean the site and reset your admin access.

Is the emergency fix really free?

Yes, when you host with WP Farm. You pay only for a month of hosting, with no contracts.

Ready to get your site back?

Tell us about the emergency, or book a cleanup now. Secure or it’s free.

Fix My Site Free
Repair My Site