The problemYou cleaned the hacked site, and it came back overnight.
In shortFixing a hacked WordPress site means backing up the infected copy, changing every password, finding the entry point, replacing core and plugins with clean copies, removing hidden admins and backdoors, patching, then requesting a Google review. We do this for small businesses with hacked or reinfected sites, with a fixed quote after diagnosis, typically $150–$600.
Your site is sending visitors to spam pages, Google shows a warning next to your listing, or an admin account you never created has appeared. Maybe you already cleaned it once, rotated every password, got a clean scan, and it came back within hours. The security plugin said everything was fine. The host will not investigate. This is the point where most owners lose days.
It is fixable, and it follows a defined process. Most hacks are automated: bots look for a plugin with a known hole, and Patchstack found 96% of the 7,966 new WordPress vulnerabilities in 2024 were in plugins. The fix is to find that entry point and every way the attacker kept access, not just the files that look wrong. Below is the process in order, including the mistakes that make recovery harder.
Maintained by Haider Ali, Founder & CEO · Updated
What you are seeing, what it is costing you, and what we do about it.
Days lost, a store held in maintenance mode, and you stop trusting every clean scan.
What we doWe find the entry point and every persistence spot: hidden admins, scheduled tasks, drop-in files, must-use plugins and auto-prepend settings. Then we patch the hole they came in through.
Lost visitors, donations or customers, and the embarrassment of a site that looks like it belongs to someone else.
What we doWe trace the redirect to its source, often a pirated or abandoned plugin or injected .htaccess or database code, and replace it with clean copies.
Searchers are warned away, so leads stop. Google says a review can take from a few days to a few weeks.
What we doWe remove the injected pages and database spam, check the Security Issues report in Search Console, and file the review request once the site is clean.
Search traffic for the wrong terms, your real pages pushed down, and a risk of Google labeling the site as hacked.
What we doWe delete the generated spam pages and the code that creates them, clean the database, and use Search Console to get the junk URLs dropped.
The attacker kept admin access for weeks while you trusted the scan.
What we doWe use scanners for detection only. The diagnosis is a manual comparison against clean copies of core, plugins and theme, plus a check of users and the database.
Password resets go to a dead address, and restoring a backup does not tell you how they got in.
What we doWe regain access through hosting or the database, remove rogue accounts, and rotate hosting, SFTP, database and WordPress credentials.
| Price | Fixed quote after diagnosis, typically $150–$600 |
|---|---|
| Response | An assessment the same day for live hacks |
| What we fix | Spam redirects, injected pages, hidden admins, backdoors, Google warnings and swapped payment settings |
| Google warning | Review requested once the site is clean; Google says reviews take a few days to a few weeks |
| What you get at the end | A plain-language summary of the entry point, what was removed and what was patched |
| Monthly plan | Not needed. This is one-off work |
| What nobody can promise | That a site will never be hacked again. We close the hole and harden what is left |
Worth knowing: Do not start deleting suspicious-looking files. It feels productive and it is the most common way people destroy the evidence of how the attacker got in, which means the backdoor stays and you get reinfected two weeks later wondering why.
A 22-second look at a hacked-site fix: spam redirects, injected pages, hidden admins and backdoors removed, the way in patched, and a Google review requested. Fixed quote after diagnosis, typically from $150.
You cleaned the hacked site. It came back overnight. Visitors redirected to spam. Google warns: "This site may be hacked.". A clean scan that was not. There’s a better way. Fix a hacked WordPress site so it stays fixed. Spam redirects and backdoors removed. Hidden admins found and closed. Google review requested when clean. From $150 · Same-day assessment · fixed quote. Get a same-day assessment. pixelandoak.com/fix-hacked-wordpress-site
Before touching anything, take a complete copy of files and database. It is compromised, but it is also the only record of how the attack worked. Losing that means you patch the symptom and miss the entry point.
If malware is being served to visitors, every additional visit risks their browser flagging you and Google adding a warning to your search listing. Maintenance mode limits the damage while you work.
Hosting, SFTP, database, and all WordPress administrator accounts, plus the salts in wp-config.php. Then look for administrator accounts you do not recognize. On a store, check the payment gateway keys too, because attackers sometimes swap them to redirect payments.
Check server access logs around the time symptoms started, and compare core files against a clean copy of the same WordPress version. The entry point is most often an outdated, abandoned or pirated plugin; identify it before you overwrite anything.
Replace WordPress core with a fresh copy of the same version, reinstall plugins and themes from source rather than repairing them, and inspect wp-content/uploads for PHP files. Nothing in uploads should ever be executable.
This is the step people skip and the reason reinfection is so common. Look for unknown administrator users, unexpected scheduled tasks, must-use plugins, drop-in files like db.php, auto-prepend settings in .user.ini, code injected into functions.php, and modified .htaccess rules.
Update everything, remove plugins you do not use, add file-integrity monitoring, and submit for review in Google Search Console if the site was flagged. Then set up something that keeps it updated, because this happened for a reason.
Use this on us as well as on anyone else you’re considering.
The hack is fresh, it is one site, you have a backup you know is clean, and you are comfortable working over SFTP and in the database.
It came back after a cleanup, there is no clean backup, several sites share the hosting account, or you cannot find how they got in.
Do not restore a backup over a live store without thinking, because it can wipe recent orders. Check the payment gateway settings and admin users first.
Ask for the infected file list and the log entries they found. Only move to a new host with a clean copy, or the infection moves with you.
Talk to your payment processor and, where needed, a lawyer about any duty to notify customers. That is a separate question from the cleanup.
Likely, if you see redirects to sites you do not own, pages or search results you never wrote, admin users you did not create, a Google or browser warning, or a notice from your host. A sudden drop in traffic with spam queries in Search Console is another sign. Any one of these is worth checking today.
In most cases, yes. Content lives in the database and uploads folder, and both can be cleaned. Core, plugins and themes are replaced with fresh copies. A full rebuild is only needed when there is no usable copy of the content left, and we will tell you if that is where things stand before quoting.
Because the attacker left a way back in, or the original hole is still open. Common hiding places are a hidden admin account, a scheduled task that rewrites files, a must-use plugin, a drop-in file, or an auto-prepend setting. Cleaning the visible files without finding these means the hack returns, sometimes within hours.
Only if you are certain the backup predates the compromise, and many people are not, because infections often run quietly before symptoms appear. Restoring an infected backup wastes a day. On a store, a restore can also wipe orders taken since the backup. And without patching the original hole, you can be reinfected within days.
Most often through a plugin with a publicly known vulnerability. Patchstack found 96% of new WordPress vulnerabilities in 2024 were in plugins. Attacks are usually automated: bots scan large numbers of sites for specific vulnerable versions. Weak or reused passwords, pirated plugins and outdated PHP are the next most common causes.
Google says a review takes from a few days to a few weeks once you request it in Search Console. The warning stays until the site is clean and the review succeeds, so speed of cleanup matters more than tidiness. Requesting a review before the site is truly clean can slow things down.
Not as a first step. Ask the host for the infected file list and log entries, clean the site, then decide. Moving an infected copy to a new host just moves the problem. Switch hosts afterwards if they would not help, or if a shared account means other sites keep reinfecting yours.
Security plugins are good at detection and hardening, and unreliable at removing an active infection, because they often miss obfuscated backdoors. Use one to spot the problem and to harden afterwards, but do the actual cleanup by hand. Our malware removal page covers that service in more detail.
Typically $150–$600 depending on how long the infection has been running and how many sites share the server. We quote a fixed price after diagnosis. Sites left infected for months cost more, because the backdoors multiply. Diagnosis comes first, so the quote is based on what we actually find.
A WordPress monthly maintenance package that catches stopped backups, aging plugins and…
Read more →Free website maintenance cost calculator. See what ongoing upkeep should cost for your site…
Read more →Custom web development for businesses that outgrew Wix, Squarespace or a plugin-heavy WordPress…
Read more →Send the URL and what happened. You’ll get an assessment today and a fixed quote before any work starts — no monthly plan required.