Signs your site is compromised
If any of these are true, assume the site is hacked and act now.
- Google shows a "This site may be hacked" warning
- The site redirects to spam, pharma ads, or gambling pages
- There are files in the uploads folder you did not put there
- Hosting shows sudden traffic spikes from strange countries
- There are admin users you did not create
- Pages show content you never wrote
- The contact form is sending spam from your domain
How recovery works
Take the site offline
We park a holding page and take the hacked site offline immediately, so it stops sending spam and Google stops flagging it.
Scan and clean the filesystem
We scan every file, remove malware, backdoors, and injected code. Anything that is not a known-good application, core or plugin file is suspect.
Restore from clean backup
If you have backups, we restore from the most recent clean version. If not, we clean the existing files manually.
Find the entry point
We work out how they got in: outdated plugin, weak password, exposed admin, file upload exploit. We fix that hole.
Harden and monitor
We reset all passwords, update everything, lock down file permissions, and put checks in place so a reinfection gets spotted rather than found by your customers.
What we fix
Hacked WordPress sites
Old WordPress versions with known vulnerabilities are the most common job we see. We clean it, update it, and make sure auto-updates are turned on.
Plugin and theme exploits
Outdated or nulled plugins with backdoors. We remove them, replace them with legitimate versions, and update everything.
Brute force attacks
Weak admin passwords that were cracked. We reset all passwords, install two-factor auth, and rate-limit login attempts.
File upload exploits
Contact forms or media uploads that allowed PHP files through. We lock down upload directories and strip executable permissions.
Database injections
Malware stored in post content, options, or user meta. We scrub the database and remove every trace.
Spam SEO attacks
Hidden pages and links injected for SEO spam. We remove them, submit a reconsideration request to Google, and monitor for reinfection.
Common questions
How fast can you recover a site?
It depends on the damage. A straightforward clean-up is often done within a day or two; a site that has been reinfected for months takes longer. After the first look we tell you which it is. If it is urgent, say so and it goes to the front of the queue.
How much does a hacked site repair cost?
A standard clean-up is £299. Complex cases are £595, and severe or repeat infections, with a written root-cause report, are £1,495. Emergency help is £125 an hour with a two-hour minimum. We quote before we start.
What if I do not have backups?
We can still clean the site manually. It takes longer and is less certain, but it is usually recoverable. Backups make it faster and cleaner.
Can you recover email that was compromised?
Maybe. If the site was sending spam from your domain, we can stop it and clean up the mail queue. If mailboxes were accessed, you need to reset passwords immediately.
Will Google remove the hack warning?
Once the site is clean we request a review in Google Search Console. Google's review usually takes a few days, and the warning comes off when it passes.
Can you prevent it happening again?
We can harden the site, lock down access, and set up monitoring. But nothing is 100% secure. Keeping the software current, WordPress and its plugins especially, is your best defence. A care plan makes that our job.
Get your site back online
Email info@wp-helpdesk.co.uk now with "urgent" in the subject. Tell us what happened and send admin access if you still have it. We will take it from there.