If your WordPress site has been hacked or infected, take a breath: it can almost always be fixed. We make a backup, remove the malware, close the hole they got in through and explain everything in writing.
If you have landed here thinking “my website has been hacked”, these four steps help and will not make anything worse.
Not strange files, not plugins, not users you do not recognise. It seems logical, but deleting blindly destroys the clues to how they got in and can break the site.
The one for your provider’s control panel, not your WordPress one. If the attacker has access to the server, changing only the WordPress password does little. Do it from a computer you trust.
If the backup was made after the infection, you will put the malware straight back. First you need to know how long it has been there.
Tell us what you have seen and since when. That is already enough for us to point you in the right direction, and reviewing your site is the first thing we do.
You can write to us through the assistant on this page, or leave your phone number and we will call you. We do not publish a price because it depends on how much damage there is: we work it out after reviewing the site and give you a fixed quote, in writing, before we start.
Two quick checks before you talk to anyone: run your site through the public scanners from Google and others, and tick what you are noticing.
Enter your address and open it in these public scanners. They open in a new tab.
Tick what is happening and we will tell you how urgent it is.
Tick at least one symptom
This is only a guide: confirmation comes from checking the site from the inside.
An infected WordPress site does not always give itself away. These are the most common clues.
“Deceptive site ahead” or “This site may be hacked” appears when you visit it or in search results.
Your site sends you to a gambling, pharmacy or scam site, sometimes only on mobile or only when you arrive from Google.
New pages, hidden links or text in another language that nobody published.
You open Users and there are accounts you did not create.
The site is slower than usual or goes down, and your hosting warns you about a spike in resource usage.
Your messages land in spam, or people tell you about emails you never sent.
A single one of these signs is reason enough to have it checked. You do not need all six.
We look at what has happened and how much work there is. The quote is fixed and in writing, before we start.
We save the current state and look for malware in files, database, users and scheduled tasks.
We remove the malicious code, reinstall everything cleanly, change the keys and fix the way in.
We check the site works, ask Google for a review if needed and hand you the report.
Most attacks on a WordPress site are neither personal nor sophisticated. They look for out-of-date plugins or themes, weak passwords and sites nobody keeps an eye on. WordPress security, like any website’s, is like the front door of a building: it is not about an armoured door, but about locking it every night.
Cleaning the site is half the job. The other half is making sure it does not happen again, and that depends on keeping it up to date. That is why, once the clean-up is done, we offer you WordPress maintenance. It is not compulsory.
Business websites and blogs
Your site kept up to date and monitored, without you having to think about it.
Online shops, membership sites (MemberPress) and sites that cannot go down
If your site sells or delivers a service, someone should be looking after it every day.
Not included: redesigns, new features, premium plugin licences or hosting, unless stated otherwise. Extra work: we give you a written quote before we start, so there are no surprises.
We are a studio from Oleiros (A Coruña, Spain) with 8 years of hands-on WordPress experience, working freelance since February 2018. You talk to the person who does the work, not to a go-between. Meetings are by video call and, if you are in the city of Barcelona, we can also meet in person.
It depends on how badly infected the site is, and we do not know until we look at it. That is why we review it first and give you a fixed quote in writing before we start. If it does not suit you, there is no commitment.
You should not. Before touching anything we back up the current state, and the clean-up focuses on removing what is malicious, not your content. If a file or data is damaged beyond saving, we tell you in the report.
First the site has to be cleaned: if you request a review with the malware still inside, Google rejects it. Once it is clean, we request the review in Search Console. Until Google processes it, the warning may keep appearing.
It is almost never personal. The most common causes are a vulnerable plugin or theme left un-updated, a weak password or an access account nobody uses any more. Part of our job is to find which door they came through and close it. We put it in the report.
Yes, if the cause is still there or if the site is left without updates. That is why we fix the way in and change all the keys. And to stop it happening again, what helps most is maintenance: an up-to-date site is much harder to attack. Nobody can promise you zero risk, and be wary of anyone who does.
It depends. If the backup is from before the infection, it may work. If it is from after, you will bring the malware back. And even if it works, the way in has to be closed, or they will get in again. Tell us what backup you have and we will tell you what makes sense.
Write to us through the assistant, or leave your phone number and we will call you. We review your site and give you a fixed quote, in writing, before touching anything.