Website Malware Removal & Cleanup
Your site is hacked, redirecting, blacklisted or flagged by your host. We find every malicious file and database record, remove it by hand, and hand you a written report of what was there and what we did.
Who this is for
- Site owners whose site redirects visitors, shows spam pages, sends spam or was flagged by Google, the hosting provider or an antivirus.
- E-shops and business sites that need the infection gone today, with proof of what was removed.
- Developers and agencies who maintain the site but do not do malware work themselves.
Malware Removal & Cleanup
One website on one hosting account, any CMS. Fixed price for a typical site. Add hardening and verification for €390 total.
What's included
- Full copy of files and database before we change anything (your rollback point).
- Manual inspection of core files, themes, plugins, uploads, must-use plugins, cron jobs and hidden files.
- Database review: injected scripts, spam posts, rogue administrator accounts, malicious options and scheduled tasks.
- Removal of every confirmed malicious file and record. Infected legitimate files are cleaned, not deleted.
- Verification pass after cleanup, including a check from outside the server.
- Written report: what was found, where, and what was removed.
- Blacklist review requests (Google Safe Browsing, common blocklists) once the site is clean.
What's not included
- Hosting, migration, redesign or development work.
- A full forensic timeline of how the attacker got in. That is the Incident Investigation service.
- Ongoing monitoring after the cleanup. See Maintenance & Security Monitoring.
- Hardening of the configuration. Available as Cleanup + Hardening (€390) or as a separate service.
How we work
Every job follows the same sequence. You know at each step what is happening on your site.
Request and accesssame day
You send the request through the contact form. We reply with what access we need (hosting panel, SFTP/SSH, database) and confirm the price before we touch anything.
Backup and triage
Full backup of files and database into a separate evidence folder. First pass to find the active infection and stop ongoing damage (redirects, spam sending).
Deep inspection
File system and database are checked by hand: core integrity, must-use plugins, uploads, cron, hidden files, injected database content, user accounts, scheduled tasks.
Cleanup
Confirmed malware is removed. Legitimate files with injected code are cleaned surgically. Nothing is deleted without a copy in the evidence folder first.
Verification and report1–3 business days total, typical site
Second pass over files and database, external check of the live pages, cache purge. You receive the written report and the list of what was removed.
What you receive
- Clean site, verified from inside the server and from outside.
- Written report (PDF) listing every malicious file and database record, with hashes and locations.
- Backup of the pre-cleanup state, kept for 30 days unless you ask otherwise.
- Summary of risk points we noticed during the work (outdated software, exposed backups, weak permissions).
What changes the price
- Several sites on the same account: each additional site is quoted separately, usually at a reduced rate.
- Large e-shops, custom applications or sites with multiple infected accounts: quoted from €690.
- Server-level compromise (root, cron, other users affected): see Server Security & Remediation.
Frequently asked questions
How fast can you start?
Usually the same business day we receive access. Tell us in the form if the site is actively sending spam or redirecting visitors so we prioritise containment.
Do I need to give you full server access?
For a reliable cleanup we need the hosting panel or SSH/SFTP plus database access. Scanner-only cleanups through a plugin miss the places attackers hide most often (must-use plugins, database, cron). We tell you exactly which access we need before you share anything.
Will my site go offline during the cleanup?
No. We work on the live files with a backup in place. If a file must be replaced we do it in seconds, not hours. If the host has already suspended the site, we coordinate with them to lift the suspension after the cleanup.
What if the site gets infected again?
A cleanup removes what is there now. If the entry point stays open (an outdated plugin, a reused password, another infected account on the same server) the site can be reinfected. That is why we list the risk points in the report and offer hardening and monitoring. If the same site is reinfected, start with our Reinfection Investigation, which looks at every layer rather than just the files.
Which platforms do you clean?
WordPress and WooCommerce most often, plus Joomla, Magento, OpenCart, PrestaShop, Drupal, Laravel and custom PHP applications. The method is the same: files, database, server configuration.
Do you work with my hosting provider or developer?
Yes. Many jobs come to us through hosting providers and agencies. We can report to you, to your developer, or to both. Hosting providers and agencies have their own rates on the B2B page.
Is the price really fixed?
Yes for a single typical site: €220 plus 24% VAT. We confirm it in writing before starting. If the site turns out to be something else (several sites, server-level compromise) we tell you before continuing and you decide.
Related reading
From our research notes
Hacked right now?
Send the request with your site URL. We reply by email with the access we need and the next steps.