// SITE COMPROMISED
WordPress malware removal for a site that's already been hit
If your site is redirecting to spam, flagged by Google or suspended by your host, what you need is WordPress malware removal, not another security plugin. Below: how to confirm it is infected, what to do in the first hour, and what a cleanup involves. We're in Darwin and work remotely for businesses anywhere in Australia.
// CONFIRM IT FIRST
How to tell if a WordPress site is actually infected
Confirm it first, because a slow site or a plugin conflict can look like a hack from the outside. These are the signals that mean something is genuinely in there.
A warning in Google results
"This site may be hacked" under your listing, or a red screen in Chrome. The label stays until the site is clean and reviewed.
Visitors get redirected, you don't
The site looks fine to you. A customer taps it on their phone and lands on a betting page. Injected code hides from admins.
Your host suspended the account
Hosts pull sites that send spam or serve malware. The notice names a few files, which is a start, not the full picture.
Admin users you never created
An unfamiliar name in Users, or an account on a domain you don't know. That is how an attacker keeps access after the hole is patched.
Files and pages from nowhere
New PHP files in the uploads folder, modified core files, or junk pages indexed under your domain. Run a site: search on your domain.
Traffic falls off a cliff
A collapse in Search Console clicks often means Google is de-indexing pages. The Security Issues report names the problem.
// THE FIRST HOUR
What to do in the first hour
Contain it, lock it down, and leave the forensics alone. Stop the damage spreading without wrecking the trail that shows how it started.
- Put the site into maintenance mode or take it offline. Every hour it stays up infected is more damage and more chance Google flags it.
- Change every password: WordPress admins, hosting panel, FTP and SFTP, database user. Assume all of them are known.
- Tell your host. They hold access and error logs you cannot see, and can often say when the intrusion started.
- Screenshot what you are seeing: the warning, the redirect, the suspension email.
And three things not to do
- Do not delete files at random. Guessing breaks the site and destroys the trail showing how it started.
- Do not restore an old backup and call it done. If the hole is still open, or the backup is already infected, you are back where you started.
- Do not stack more security plugins on top. A scanner on a compromised site reports symptoms.
// THE CLEANUP
What WordPress malware removal actually involves
Five stages, in this order. Removing code before you know how it got in is exactly why so many cleaned sites get hit again.
Confirm and scope it
Find out what is infected before touching anything. Scan the file system, compare core files against clean WordPress originals, check the database. The entry point starts showing here.
Remove the injected code
Malware rarely sits in one place. It spreads across core, the theme, plugin folders, uploads and database tables. Every layer gets cleaned, not just the flagged file.
Hunt the backdoors
A hidden PHP file, a rogue admin account, an added cron job, a modified wp-config. Miss one and the site is reinfected within days.
Patch what let it in
Update or remove the vulnerable plugin, theme or core version, fix file permissions, rotate the keys in wp-config, close what the logs point at.
Clear the flags
With the site clean, request a review in Search Console so the warning lifts, and ask the host to lift any suspension.
// WHY IT COMES BACK
A cleanup without a patch just gets reinfected
Removing malware and leaving the vulnerability open is a temporary result. The bot that found the hole is still scanning, your domain is already on a list, and nothing has changed from its point of view. Reinfection within days is the normal outcome when files get deleted without anyone working out how they got there.
Patching the entry point and hardening the login is what makes a cleanup stick, which is the job covered on our WordPress security hardening page.
// WHAT IT COSTS
What a malware cleanup costs in Australia
A one-off WordPress malware cleanup commonly runs $150 to $600 or more, depending on how deep the infection goes, how long it sat there, and how many sites share the hosting account. The invoice is usually the smaller half: the real cost is downtime, the Google warning that stays up until review, and the enquiries that never arrive. For the ongoing numbers, see what WordPress maintenance costs.
// HOW WE HANDLE IT
How we handle a hacked WordPress site
Scoped first, then one number. We look at the site, work out what is infected and how far it spread, and give you one clear price before any work starts. No open-ended hourly rate. We're in Darwin, the work is remote, and we look after WordPress sites we did not build.
One honest limit: if the site is years old, running abandoned plugins and this is not the first time it has been hit, cleaning it may be the wrong spend. Sometimes a rebuild costs less than defending what you have, and we'll say so. See what we build on our websites page.
// AFTER THE CLEANUP
Once it's clean, keeping it clean
Removal is the emergency. Staying out of trouble is two jobs: WordPress security hardening for firewall rules, two-factor login and locking the admin down, and WordPress backups done properly, so a clean restore is a real option next time. To hand the lot to someone local, we do website maintenance in Darwin.
// QUESTIONS
Straight answers while you sort this out
Not sure whether the site is infected or just broken? Send us what you're seeing.
Get in touchHow do I know if my WordPress site has malware?
A "this site may be hacked" label in Google, a browser warning screen, a host suspension, spam redirects you do not see yourself, unknown admin users, or a sudden traffic drop. Search Console's Security Issues report confirms it fastest.
How much does WordPress malware removal cost in Australia?
A one-off cleanup commonly runs $150 to $600 or more, depending on how deep the infection goes, how long it sat there, and how many sites share the hosting account. Downtime usually costs more than the invoice.
Can I remove WordPress malware myself?
You can, if you are comfortable in the file system and the database. The part people get wrong is the backdoors and the entry point. Deleting what a scanner flags buys quiet days, not a fix.
How do I get the Google "this site may be hacked" warning removed?
Clean the site properly, then request a review in Search Console under Security Issues. Google re-crawls and lifts the warning once the site is confirmed clean. Request it too early and the flag comes back.
Do you do WordPress malware removal outside Darwin?
Yes. We are in Darwin and the work is remote, so it makes no difference where your business is or which host the site sits on.
// SITE HACKED?
Send us the domain and what you're seeing
The warning, the redirect, the suspension email. We'll look at the site, tell you what's going on, and give you one clear price before any work starts.
Get in touch