Redirects, Japanese text in Google, a host that suspended you. I find how they got in, clean every file, and close the door behind them.
Any one of these is enough. You do not need to be sure before you message me.
Search results show “This site may be hacked” or the browser throws a red screen before anyone reaches you.
Japanese, Chinese or pharmacy pages appear under your domain in Google, pages you never made.
The site opens fine for you but sends customers to a betting or scam page, often only on phones.
The hosting company found malware or outgoing spam and took the site offline without much warning.
New administrator accounts appear in WordPress, or your own password stops working.
The server is busy doing something for somebody else. Pages crawl, and the error log fills up.
Before I touch a single file I copy the site and the database. If anything goes wrong during the clean, we can always go back.
An outdated plugin, a stolen password, a weak host account. Cleaning without finding the hole just means you call me again next month.
Injected code hides in theme files, uploads, the database and scheduled tasks. I go through all of it, not just the obvious places.
Updates applied, passwords and keys changed, unknown admin users removed, file permissions fixed, and the entry point sealed.
I submit the site for review so Google drops the warning and your host lifts the suspension, then I tell you exactly what happened.
A clean site, back online and working
A written report of what was found and where
The way in closed, not just the mess cleaned
Google and host warnings submitted for removal
Hardening applied so the same trick fails next time
Plain language advice on keeping it clean
Four minutes of work now saves hours later. None of it costs anything.
Deleting files in a panic removes the evidence I need to find the way in. Leave it exactly as it is.
Start with the hosting account and your email, not WordPress. That is usually where the real key is.
When did you first notice, and what changed just before. A plugin update, a new theme, someone new getting access.
That is all I need to start looking. Logins can wait until we have talked.
Most sites are finished within 24 hours of getting access. A large store with thousands of infected files takes longer. If that is your case I tell you on day one, not halfway through.
It starts at $90. The final number depends on how deep the infection goes and how big the site is. I look first, then give you one fixed figure before any work starts. No hourly surprises.
Usually not. I work on a copy where I can, so your customers keep seeing the site. If the host has already suspended it, getting it back online is the first job.
Not through the same hole. I find the entry point and close it. Nothing on the internet is permanent though, so I also set up updates, backups and monitoring if you want them.
A plugin is good at stopping the next attack. It is not good at cleaning one that already happened, because the code hides in places a plugin does not scan. Clean first, then protect.
The site address to start. Then hosting access and WordPress admin, or whoever holds them. If you have lost access, say so, there are other ways in.
That is enough for me to start looking. I read every message myself. If the site is down right now, WhatsApp is faster than email.