Hacked WordPress: malware removal and security
Is your site redirecting to strange pages, is Google flagging it as dangerous, or has your host blocked it? I clean it up, find the hole the infection came through and close it.
Signs of infection
- Redirects to other sites, especially on mobile or from Google
- A browser or Google warning: "This site may be hacked"
- Unknown administrators, files or spam links in search results
- Your host suspended the site for sending spam
How I proceed
First I preserve the current state for analysis and make a backup. Then I compare core and plugin files with the originals, go through the database, users and scheduled tasks and find the entry point: a vulnerable plugin, a leaked password or a forgotten file.
After the cleanup I update what's needed, change access credentials, harden the login and help you request removal of the Google warning.
FAQ
Is restoring a backup enough?
Only if we know when the hack happened and the hole is closed. Otherwise the attacker will come back. That's why I always look for the entry point.
Do I have to report the hack under GDPR?
If the attacker could have obtained customers' personal data, you may be required to report it to the authority within 72 hours. During the analysis I'll tell you what the attacker had access to.