Hacked WordPress site? Cleaned, closed, and hardened.
Strange redirects, spam pages in Google, a browser warning, or a host that suspended the account. Four Eyes cleans the infection, finds and closes the way in, and hardens the site so it does not happen again next month.
Removing the malware is the easy half. Closing the door is the half that matters.
A cleanup without a cause is temporary.
Most hacked sites that come to us have already been "cleaned" once. The infection came back because nobody found how it got in.
WordPress sites are rarely targeted by a person. They are found by automated scanners looking for an outdated plugin, an abandoned theme, or a weak password. Once in, the attacker usually leaves more than one way back.
What a real cleanup involves. A copy of the infected site is kept before anything is changed. Core files are replaced with clean originals. Plugins and themes are verified or replaced. The database is checked for injected content and unknown administrator accounts. Every password and security key is reset. Then we look for the cause, because a cleanup without a cause is temporary.
If Google has flagged the site. Warnings in search results and browsers are removed through a review request once the site is verifiably clean. We submit it and follow it through.
An honest limit. Nobody can promise a site will never be attacked again. What we can do is remove what is there, close the way in, reduce the attack surface, and put monitoring in place so the next problem is caught in hours, not months.
Contain, clean, close, watch.
Contain
Access secured, site backed up as it stands, and taken offline or put behind a holding page if it is harming visitors.
Clean
Core, plugins, themes, database, and user accounts checked and cleaned. All passwords and keys reset.
Close the way in
The vulnerable component identified and fixed or removed. Site hardened and updated.
Clear and watch
Google review requested where flagged. Monitoring and scheduled updates in place.
Often paired with
Website Maintenance
Staged updates, monitoring, and backups are what prevent the next one.
Website maintenanceWordPress Development
If the site is built on abandoned components, a clean rebuild may be the safer fix.
WordPress developmentSecond Opinion Audit
Not sure what is wrong yet? Start with a written read of where the site stands.
Second opinion auditSigns a WordPress site has been hacked
- Redirects. Visitors, often only on phones or only from Google, land on a pharmacy, betting, or “your computer is infected” page.
- Spam pages under your domain. Search Google for
site:yourdomain.comand find pages you never wrote, often in Japanese or pushing pharmaceuticals, handbags, or casinos. This is the “injected spam pages” hack, and it usually comes with thousands of fake URLs. - A browser or Google warning. “Deceptive site ahead”, “This site may be hacked” under your listing, or a Search Console email about security issues.
- An administrator you did not create. Check Users in WordPress. A rogue admin means the attacker still has a door.
- Your host suspended the account for malware or outbound spam, or your email started bouncing because the domain was blacklisted.
- Files you do not recognise in wp-content or the site root, a theme or plugin you never installed, or a site that got slow for no reason.
One of these is enough. Two means the site has probably been compromised for a while.
What Google’s warning means, and how it comes off
Google flags a site when its crawler finds malware, deceptive content, or spam injected into pages. The warning shows in Chrome, in search results, and in Search Console under Security issues. It does not come off on its own, and it does not come off because the visible problem was removed. It comes off when the site is actually clean and you request a review in Search Console. Our cleanup ends with that request, written so the reviewer can see what was found and fixed. Reviews usually clear in days; a site that was only half cleaned fails the review and goes to the back of the queue.
What a cleanup costs
Every hacked site is different, so we do not publish a flat rate. We look first, usually within the hour, tell you what we found, and give a fixed price for the cleanup before any work starts. The price covers containment, the cleanup, finding and closing the way in, hardening, the Google review request, and a month of watching. Ongoing protection after that is a care plan, optional. If you are an existing care plan client, a hack is an incident and the plan covers the first response.
Nights and weekends
Sites get hacked at 2 a.m. on a Saturday because the scanners never sleep. We take after-hours incidents at the after-hours rate on our rates and policies page, and the containment step, which stops the harm to visitors, is the first thing done, not the last.
Do not do these first
- Do not delete things. The evidence tells us how they got in. We copy the infected site before touching it.
- Do not restore an old backup and call it done. The hole that let them in is in the backup too.
- Do not run a “one-click malware removal” and move on. It removes what it recognises and leaves the back door.
What people ask when a site has been hacked.
Common signs: visitors are redirected to other sites, Google shows a warning or strange pages for your domain, unknown administrator accounts appear, the host suspends the account, or the site suddenly slows down. Any one of these is worth checking.
Yes. We keep a copy for reference, remove the infection from files and database, reset all credentials, find and close the way in, and harden the site afterwards.
No one can honestly promise it never will. Closing the original weakness, keeping everything updated, and monitoring the site make a repeat far less likely and far quicker to catch.
Yes, once the site is clean. We submit a review request through Google Search Console and follow it until the warning is lifted.
Sometimes. A clean backup from before the infection is the fastest fix, but the weakness that let the attacker in will still be there, so it has to be found and closed either way.
An injected spam hack: the attacker added thousands of hidden pages or rewrote your titles so Google lists pharmacy, casino, or Japanese keyword pages under your site. Cleaning the files is half of it. The fake URLs have to be removed from Google too, through a cleaned sitemap, a security review request, and sometimes removal requests, or the spam listings linger for months. We do both halves.
Yes, treat it that way. A rogue administrator is a door the attacker left open, and removing the user alone does not close it; the same hole that created it will create another. We keep the evidence, remove the account, reset every password and security key, find the component that allowed it, and then harden the site.
Tell us what you are seeing and when it started.
The short form is enough to start. An expert reads it and replies within one business day with concrete next steps.
Brief reviewed by an expert within one business day. Thirty-minute call. Written scope within five days.
“Four Eyes built and maintained two of our websites. The support and service have always been fast and professional, and we email them anytime with questions or modifications. Working with us since 2016, Michael and the Four Eyes team have been consistently…”
"*" indicates required fields
Goes to Michael. No CRM, no autoresponder, no newsletter signup.