WordPress malware removal
Hacked WordPress Site Repair
Your site was hacked and Google, your visitors or your host noticed. We remove the malware, close the hole that let it in, and clean the spam out of Google so your real pages can recover.
We're based in Roseville, near Sacramento, and repair hacked sites for businesses anywhere in the US.
Quoted per site, after we review it.
Example of what a hacked site looks like in Google
yourbusiness.com
Your Business | Sacramento Plumbing & Drain
This site may be hacked.
Plumbers serving Sacramento, Roseville and Folsom. Drain cleaning, water heaters and...
- Malware and backdoors removed
- Entry point closed
- Spam pages cleaned from Google
- Google review requested
Signs your site is hacked
Any one of these is worth a look. Google adds its “This site may be hacked” label when it believes a hacker changed pages on the site or added spam pages. Not sure yet? Run our free website security check first.
Google says "This site may be hacked"
The note shows under your listing in search results, and some browsers show a red warning page before your site loads.
Visitors get redirected to spam
People land on a scam, pill or gambling site instead of yours. It sometimes only happens on phones or for visitors coming from Google, so you may not see it yourself.
Admin users you didn't add
A new administrator account in WordPress, or an unknown owner in your Google Search Console property.
Spam pages in Google results
Searching site:yourdomain.com shows pages you never wrote, often in Japanese or selling fake brand goods.
Your host suspended the account
Hosts take infected sites offline to protect their other customers. The site stays down until it is cleaned.
Strange files or a sudden slowdown
PHP files with random names, changed theme files, a full disk, or a site that suddenly crawls.
What hacked site repair includes
Deleting a few bad files makes a site look clean for a week. A real repair removes the infection, closes the way in, and fixes the damage in Google.
1. Find and remove the malware and backdoors
We scan the files and the database, then remove the injected code, spam pages and hidden backdoors. Backdoors are what let an attacker come back after a quick cleanup, so we look for them on purpose.
2. Close the hole that let it in
The usual ways in are an outdated plugin, theme or WordPress core, or a weak or shared login. We find the likely entry point and close it, so the cleanup holds.
3. Update or replace vulnerable plugins
We update what can be updated. Abandoned plugins that no longer get security fixes get replaced with maintained ones or removed.
4. Rotate passwords and keys
New passwords for WordPress, hosting, the database and FTP, plus new WordPress security keys. That signs out anyone still logged in with a stolen session.
5. Set up a firewall and login protection
Depending on your host: a firewall, limits on login attempts and two-factor sign-in for admin accounts.
6. The part most cleanups skip
Clean up Google, not just the server
Spam pages can stay in Google after the files are gone, and the warning stays until someone asks Google to review the site. We're an SEO agency, so this part gets the same attention as the malware. Google's guide to the Japanese keyword hack notes that the attacker “will typically add themselves as a property owner in Search Console,” so we check that first.
- Check who has access to your Search Console property and remove owners you don't recognize
- Find the spam URLs Google indexed and make sure they now return "not found"
- Request a review in the Security Issues report if Google flagged the site
- Watch the indexed pages report until the spam drops out of search
site:yourbusiness.com
yourbusiness.com/kx82qd/item-41207.html
【公式】ブランド 財布 激安 通販
yourbusiness.com/kx82qd/item-41208.html
ブランド コピー 時計 送料無料
yourbusiness.com/pjt0w/?p=9135
人気 バッグ アウトレット 最安値
7. Backups and monitoring afterward
Before we hand the site back, we set up backups and malware scanning where your hosting allows, so a new problem gets caught early and there is a clean copy to restore from.
How pricing works
Every hacked site is different, so we review yours first and quote it before any work starts. The price depends on how deep the infection goes, how many plugins and pages are involved, and whether Google has flagged the site.
- 1
We review the site
You share access. We look at the files, plugins, users and Search Console to see what happened.
- 2
You get a quote
The price and scope for your site. Nothing starts until you approve it.
- 3
We repair and report
We do the cleanup, then send a plain-English summary of what we found and what we changed.
Repair or rebuild?
Many hacked WordPress sites can be cleaned and kept. Sometimes the cleanup is only the first of several, and a rebuild costs less over time. We tell you which one we'd pick and why.
Repair usually makes sense when
- The site works well for your business and you like it
- Most plugins are still maintained by their developers
- This is the first infection
- Someone will keep it updated after the cleanup
A rebuild may cost less when
- Many plugins are abandoned and no longer get security fixes
- The site keeps getting reinfected after cleanups
- The theme or PHP version is too old to update safely
- You were already planning a redesign
A rebuild can stay on WordPress or move to a different setup. See our website redesign service and our comparison of Next.js vs WordPress for a local service business.
After the cleanup
A cleaned site stays clean when someone keeps it updated. New holes show up all the time: Patchstack found 11,334 new vulnerabilities in the WordPress ecosystem in 2025 (State of WordPress Security in 2026).
Our website maintenance service covers tested updates, backups, malware scans and uptime monitoring. If your host is warning you about your PHP version, read what PHP 8.2 end of life means for WordPress.
Hacked site questions
Google's own steps are in its Security Issues report help page.
How do I know if my WordPress site is hacked?
The common signs are a "This site may be hacked" note under your listing in Google, visitors getting sent to spam or scam sites, admin users you never created, pages in Google you never wrote (often in Japanese or selling fake brand goods), or a suspension notice from your host. If you have Google Search Console, open the Security Issues report. If it lists issues, Google has found them too.
Will I lose my Google rankings?
A hack can hurt rankings and clicks. A warning in the results scares people off, and spam pages can crowd out your real pages. Removing the malware, the spam pages and any Google warning is how you stop the damage. We can't promise how fast rankings come back, because that depends on how quickly Google re-crawls your site.
How long does recovery in Google take?
If Google flagged your site, it reviews the cleanup after you request a review in Search Console. Google's own help page says a review "can take from a few days to a few weeks to complete." Google emails you when it receives the request and again when the review is done. Spam URLs drop out of search as Google re-crawls them and finds them gone, and that pace varies by site.
Do you fix sites you didn't build?
Yes. Who built the site doesn't matter. We need WordPress admin access, hosting access, and Search Console access if you have it. If you're locked out of any of those, we help you get access back from your host first.
Can you fix sites that aren't on WordPress?
We review any site and tell you what's possible before you pay for anything. Some platforms handle the server side for you, so the fix looks different. On other systems, the honest answer is sometimes that a rebuild makes more sense than a cleanup. Either way, you get our view and a quote first.
Can I just restore an old backup?
A clean backup helps, but on its own it usually isn't enough. Restoring brings back the same outdated plugin or weak login that let the attacker in, so the site can get reinfected. And if the backup was taken after the break-in, it may already contain the backdoor. We use backups as part of the repair, not as the whole fix.
How much does hacked site repair cost?
Every hacked site is different, so we review yours first and quote it before any work starts. The price depends on how deep the infection goes, how many plugins and pages are involved, and whether Google has flagged the site.
Get your hacked site reviewed
Tell us what you're seeing: the Google warning, the redirects, the host notice. We review the site and send a quote before any work starts.
Related services
Website Maintenance
Updates, backups and monitoring that keep a cleaned site clean.
Learn moreWordPress Development
Custom WordPress builds, themes and plugin work.
Learn moreWebsite Redesign
For sites that cost more to patch than to rebuild.
Learn moreSEO Services
Win back and grow search traffic after the cleanup.
Learn more