Hacked WordPress website: cleanup and recovery

When should a website be investigated?

Unfamiliar administrator accounts, spam pages, altered files or a hosting suspension can point to a security incident. An error message alone does not prove that WordPress has been hacked. We start by reviewing the symptoms and available evidence. Our service is suitable for private website owners, freelancers, businesses and organisations.

What the cleanup can include

Depending on the findings, we examine WordPress files, themes, plugins and database content for suspicious changes. We agree which components need replacing, which content can be restored and which accounts require review. Identifying the likely entry point matters: removing visible spam alone may leave the underlying problem unresolved.

Our approach

1. Describe the incident: Send the website address, the changes you have noticed and any messages from your hosting provider.
2. Preserve the current state: We establish which backups and logs are available before making changes.
3. Agree the scope: We explain the proposed work, access requirements and expected effort.
4. Clean up and test: After the agreed remediation, we check important pages, functions and suspicious redirects.
5. Plan ongoing care: Updates, permissions and backups are reviewed for future operation.

Recovery and follow-up

An existing backup may help, provided it is complete and comes from a suitable point in time. Restoring a backup does not replace investigating the cause. For ongoing care, consider our WordPress maintenance plans. Search engine warnings may require a separate review by the relevant provider after the technical cleanup.

Costs and information we need

The effort depends on the size, accessibility and condition of the website. A small site with a usable backup differs from a shop with many integrations. We agree the services and costs before starting. For your initial enquiry, send the website address and a description of the problem, rather than passwords.