WordPress malware removal

A hacked WordPress site rarely announces itself. More often, visitors are sent to a site you have never heard of, a browser shows a red warning in place of your home page, or your host suspends the account and emails you about malicious files.

Malware removal is a one-time service for that situation. We clean the site, harden it, ask for it to be taken off blacklists, and give you a written report. You do not need a care plan to buy it, and the price is on this page.

Who it is for, and who it is not

It is for a WordPress site that has been broken into. These are common signs, each with the guide that explains it:

• Visitors are sent to a site you do not know. See WordPress site redirecting to another site.
• A browser shows a red warning in place of your pages. See "Deceptive site ahead".
• Google lists pages on your site that you did not write. See spam pages in Google.
• Your host has suspended the account and written to you about malicious files. See hosting account suspended for malware.
• The site was cleaned before, and the infection came back. See why a site keeps getting hacked.

It is not the right purchase in these cases.

• You are not sure the site has been hacked. A redirect can also come from a setting, and a blank page after an update is not by itself a break-in. Check first: the section "Before you buy" below has a tool and a guide for it.
• The site is down, with no sign of a break-in. That is an Emergency Fix. See emergency support.
• The site is healthy and you want to keep it that way. That is upkeep, not a clean-up. See WordPress security.
• You want the clean-up and the upkeep that follows. The Care plan includes malware cleanup. Ask which route fits your site when you ask for the diagnosis.
• Your host may cover it. The malware removal cost guide explains why your hosting company is the first one to ask, in writing, before you pay anyone.

You may be able to do the work yourself. How to remove malware from a hacked WordPress site sets out the steps, and says what a cleanup you do yourself can miss.

What you get

At the end you have a site with the malicious code removed and tightened against the next attempt, a request for review lodged with whoever flagged it, if anyone has, and a written account of the work.

• Full clean-up. The malicious code is removed from the site.
• Hardening. After the clean-up, the site is tightened so that it is harder to break into again.
• A blacklist removal request. If a search engine or security vendor has flagged your site, we ask for a review so the warning can be lifted.
• A written report of the work.
• A 30-day re-clean guarantee. If the infection comes back within 30 days, we clean the site again.

Malware cleanup is also included in the Care plan, together with security scanning, weekly updates and daily offsite backups kept for 90 days. The Essential plan includes security scanning but not cleanup.

How it works

What we need from you to start

Only what the free diagnosis form asks for:

• your name, and an email address for the reply
• your site's address, if you can share it
• what you and your visitors see, and when it started
• the text of any warning, and any email from your host about the site

We reply to the address you give, with a written cause and a fixed quote. Whether to go ahead is up to you. We use these details to reply to you about this request, and for nothing else.

Before you send it, read the first steps of the hacked site runbook. Write down what you see and when, and do not delete what you found.

What it does not cover

• A promise that it never happens again. Hardening makes a break-in harder. No one can make it impossible.
• The outcome of the blacklist request. We send the request. The company that issued the warning reviews the site and decides, so we cannot promise the outcome or how long it takes.
• Ongoing protection. This is a one-time job. Scanning, updates and backups from then on are what a care plan does. See WordPress security.
• Anything that is not WordPress. Other software on the same hosting account, your email and your own computer are outside this service.

Before you buy: check first, or do it yourself

Each of these is free to use.

• Hacked-site check. Give your site's address and see the signs of a break-in that show from outside. It reports signs, not a verdict.
• How to check whether your WordPress site has been hacked. Checks from outside first, then from inside. It also lists what looks like a hack and is not one.
• Hacked WordPress site: a runbook for the first hour. What to do, in order, before any cleaning starts.
• How to remove malware from a hacked WordPress site. The clean-up, step by step, if you want to do it yourself.
• What WordPress malware removal costs. How a cleanup is priced, the nine parts of a complete one, and the questions to put to anyone who quotes. Put them to us too.
• WordPress security and hacked sites. Every page we have on the subject, in one place.