WordPress site hacked? I'll clean it up.
Foreign content on the homepage, redirects to unknown sites, admin users you never created, a warning from Google. A hacked site is an emergency: first I secure everything with a backup, then I hunt down backdoors and infected files, restore and lock down. And I explain what happened.
- !Homepage content in foreign languages or links to phishing sites
- !Sudden redirects to external domains
- !WordPress administrator users you never created
- !Installed plugins you don't recognise
- !Spam email being sent from your domain
- !Google flags the site as compromised, or sudden slowness
- 01WordPress, plugins or theme not updated for weeks or months
- 02Weak or reused passwords on wp-admin, FTP or hosting
- 03Plugins or themes downloaded from unofficial sources (nulled)
- 04No protection on wp-login.php and exposed XML-RPC
- 05Missing or outdated backups: the infection is discovered months late
- 06Stray .php files in wp-content/uploads
A repeatable procedure, not guesswork.
- 01
Lockdown
Screenshot of the current state and a full backup of files and database, even if infected. Needed to understand what was touched and to be able to roll back.
- 02
Diagnosis
I check unknown admin users, unrecognised plugins, base64/eval code, stray .php files in uploads, hidden redirects and suspicious database records.
- 03
Cleanup or restore
With a clean backup: restore, update WordPress and plugins, change all credentials. Without one: manual file-by-file and database cleanup.
- 04
Verify and reopen
The site goes back online only after verification that it's clean. If Google had flagged it, I request the review to remove the warning.
- 05
Hardening
New unique passwords, updates, wp-login.php protection, XML-RPC disabled if unused, rules to keep it from happening again.
How much can it cost?
Indicative range. Final estimate after seeing the site.
Few infected files and a recent backup available: restore, updates, new credentials.
Backdoors scattered through the code, compromised database, hidden redirects. Full manual cleanup.
Content modified over months: a rebuild may be needed. I assess the case and write the estimate before starting.
The questions I always get.
01How do I know if my site is really hacked?
+
Clear signals: homepage content in foreign languages, redirects to external domains, administrator users you never created, plugins you don't recognise, spam email sent from your domain, a Google 'site compromised' warning. One of these is enough: the site is compromised.
02Should I delete the infected files right away?
+
No. First a screenshot of the situation and a full backup of files and database, even if infected: they're needed to understand what was changed and for a possible restore. Deleting blindly can worsen the damage or destroy evidence of the intrusion.
03Restore from backup or manual cleanup?
+
If you have a clean backup from before the attack, restoring is the fastest and safest path: restore, update everything, change credentials. Manual file-by-file cleanup is for when there's no backup or it's too old.
04How much does it cost to recover a hacked site?
+
Flat €45/hour, billed in real 30-minute blocks. A mild infection with a recent backup fits in 2–4 hours. Widespread compromises, with backdoors in the code and a dirty database, can reach 6–12 hours. Written estimate before I start.