Hacked WordPress website: what to do without making things worse
WordPress website hacked? What to check, what to avoid and when to request a diagnostic review so cleanup does not make things worse.
Read the articleHacked WordPress cleaning
Hacked WordPress website: costs, timing and a clearly scoped intervention.
Unknown redirection, malware, Google alert, spam pages, site blocked by the hosting provider or suspicious admin access: send the URL and the alerts received to assess the cleanup without deleting useful traces.
Symptoms treated
When to ask WordPress cleaning.
The page is used in cases where the risk of hacking is already probable. For a breakdown or unclear access without visible infection, the emergency hub may be enough to choose the right first move.
- 01
Redirect to an unknown domain, sometimes only from Google or mobile.
- 02
Browser, Google Safe Browsing, Search Console or antivirus warning.
- 03
Japanese pages, casino, pharmacy, adult or spam indexed in Google.
- 04
Hosting provider that blocks the site for malware, spam or abnormal consumption.
- 05
Unknown admin accounts, suspicious files or fake plugins.
- 06
Reinfection after first cleaning too fast.
Scope included
Effective cleaning should leave a website you can manage.
A useful cleaning does not stop at "the site is working again". We also need to understand what has been done, what remains fragile and what needs to be monitored afterwards.
Before
Reading the symptom, backed up the current state, access and level of risk.
During
Cleaning files and database as appropriate, rotation of access details and removal of suspicious components.
After
Public website checks, form testing, Search Console where useful, recommendations and a decision on further monitoring.
Pricing and first steps
The price depends on the real risk and what to secure.
A serious estimate begins by distinguishing a limited symptom from a complete security recovery: files, database, accounts, backups, Google, hosting and risk of re-infection.
- Limited infection (a few hours to 24 hours): accessible brochure website, localized symptoms, available access and usable backups.
- Urgent or complex cases (24 to 48 hours, sometimes more): Google alert, redirection, spam pages, hosting provider that blocks, affected base or reinfection.
- High risk (several days, quoted individually): WooCommerce, multisite, sensitive data, a compromised server or a widespread SEO hack.
Avoid repair at random
- Do not restore a backup without checking if it is anterior and healthy.
- Do not delete suspicious files without copying the current status when access allows.
- Do not limit yourself to what you see in the browser: Google can see invisible spam pages in normal navigation.
- Do not launch several random security plugins on an already unstable site.
- Do not request the Google review until the site, spam URLs and probable cause have been processed.
The continuation depends on the actual state of the site
Once the incident has been handled, it is not necessary to launch a redesign or subscription. The right follow-up is decided according to the cause, age of the site, backups, requests received and commercial criticality.
- Stabilized site: one can stop after cleaning if the risk is controlled, the access details resumed and the fragile points identified. One diagnostic review may be enough.
- Website to follow: if the site counts for incoming requests, the maintenance helps avoid leaving it without backups or anyone responsible.
- Unclear cause: if the site remains unstable or opaque, a audit is more honest than a promise of quick repair.
- Too fragile base: if the theme, plugins or hosting are too fragile, a targeted recovery work can become more rational.
If the site is not clearly hacked, start with theWordPress emergency supportwhich helps distinguish a breakdown from a security incident.
Method
Clean, secure, check.
- 01
Initial assessment
Symptoms, affected URLs, messages received, commercial criticality, latest changes and access available.
- 02
Preservation
Copy the current state before deletion or restoration when possible.
- 03
Diagnostic review
WordPress files, uploads, database, admin accounts, redirects, plugins, theme and backups.
- 04
Cleaning
Removal of injections, backdoors, fake plugins, suspicious accounts and replacements from clean sources.
- 05
Security and control
Rotation of access details, useful updates, removal of abandoned components and correction of likely entry, then control of public pages, administration, form, Search Console, sitemap and external scans.
In practice
They trusted us with their websites.
LegalTech
Le Cordographe
A compromised WordPress brochure website: rebuilding a clean foundation, cleaning components and caches, reviewing access and checking pages after relaunch.
Read the case studySEO and marketing
SmartKeyword
Surveillance, cleaning after infection, hardening and follow-up after correction of a WordPress site dedicated to SEO.
Read the case studyFrequently asked questions
What people often ask us.
How much does cleaning a hacked WordPress site cost?
The price depends on the actual risk. An accessible brochure website with localised symptoms needs less work than a case involving a Google warning, hosting suspension, reinfection or an affected database. WooCommerce, multisite, sensitive data or a compromised server requires a specific quote. We provide the estimate before any work.
How long does it take to intervene?
A simple case can sometimes be framed and processed within a few hours. A common case requires 24 to 48 hours depending on the access, the status of backups and the checks required. If Google or the hosting provider have to recheck the site, the full return to normal may take longer.
What does it take to get a useful estimate?
Send the URL, visible symptoms, Google messages or hosting provider, date of appearance, latest known changes, available access details and what you know about backups. A screenshot of the alert helps a lot.
Do you offer 24/7 emergency support?
No. We do not advertise 24/7 on-call cover. Our first commitment is to assess the incident properly and avoid harmful changes. A prompt intervention depends on availability, risk, access and the agreed scope.
Should we restore a backup right now?
Not necessarily. A backup may be too old, incomplete or already infected. Before restoring, you must check its date, content and preserve a copy of the current state if possible.
What happens after the cleanup?
You leave with a site stabilized according to the validated scope, the sensitive access changed when necessary, the fragile points identified and a clear recommendation: nothing more, maintenance, audit or wider resumption.
Explore further
Related services.
Maintenance & hostingWordPress emergency support→Maintenance & hostingMaintenance and hosting→Maintenance & hostingWordPress maintenance→RedesignWordPress website audit→RedesignWebsite diagnostic review→RedesignWordPress website redesign→
On the blog
Read before deciding.
Google hacked-site warning: what should you do on WordPress?
Does Google warn that your WordPress website is hacked? What to check in Search Console, what to avoid and how to request a review properly.
Read the articleHacked WordPress site with Japanese pages: what should you do in Google?
Japanese pages in Google while your WordPress website looks normal? What to check, what to avoid and how to prepare cleanup while preserving useful evidence.
Read the article