WordPress Security & Recovery
Most of the sites we clean are WordPress and WooCommerce. We know where the malware hides, how it rebuilds itself, and what a security plugin cannot see. Cleanup, investigation, hardening and monitoring, in one place.
Who this is for
- Owners of hacked WordPress or WooCommerce sites: redirects, spam pages, fake admin users, blacklisting, host suspension.
- Sites that keep getting reinfected after plugin-based cleanups.
- Agencies and freelancers who build with WordPress and want a specialist for the security side.
WordPress Malware Removal & Cleanup
Fixed price for a typical WordPress or WooCommerce site. Cleanup + Hardening €390. Reinfection Investigation from €590. Monitoring plans from €35 per month.
What's included
- Core integrity verification against the official checksums for your version, not just a file listing.
- Must-use plugins, drop-ins (object-cache.php, db.php, advanced-cache.php) and wp-content/uploads checked by hand.
- Database: wp_options payloads, scheduled cron events, spam posts and revisions, hidden administrators, application passwords, injected post content and page builder data.
- Theme and plugin review for injected code, nulled components and abandoned plugins with known vulnerabilities.
- Server-side locations WordPress plugins cannot see: .htaccess, .user.ini and php.ini overrides, cron, PHP configuration, other accounts.
- Cleanup, verification and a written report. Hardening and monitoring available as add-ons or plans.
What's not included
- Theme or plugin development, design, content and performance work.
- Replacing nulled or abandoned components. We identify them; replacing them is your decision.
- Managed hosting. We work on the hosting you have.
How we work
The WordPress-specific checklist below is what separates a cleanup that lasts from one that does not.
Access and backupsame day
Hosting panel or SFTP/SSH plus database access. Full backup of files and database into an evidence folder before anything changes.
Core and must-use layer
Core files verified against checksums. mu-plugins and drop-ins inspected line by line. Uploads scanned for executable files.
Database layer
Options, cron events, users and application passwords, posts and meta, page builder data, transients and object cache.
Server layer
Configuration overrides, cron jobs, other accounts that can write to the site, PHP settings that hide the malware.
Clean, verify, report1–3 business days total, typical site
Everything confirmed malicious is removed, caches flushed, the live site is checked from outside, the report is delivered.
What you receive
- Clean, verified WordPress site.
- Written report with every malicious file and database record (path, hash, table, ID).
- List of risk components and settings we noticed, in priority order.
- Pre-cleanup backup kept 30 days unless agreed otherwise.
What changes the price
- WordPress multisite networks and large WooCommerce stores: quoted from €690.
- Reinfected after a previous cleanup: Reinfection Investigation from €590 is the right starting point.
- Several WordPress sites on one account or server: quoted per site at a reduced rate.
Frequently asked questions
My security plugin shows the site is clean. Why is it still hacked?
Plugins run inside WordPress and see what WordPress lets them see. Malware in must-use plugins, drop-ins, wp_options, cron, .user.ini or another account on the same server is invisible to them. Most of our cleanups start exactly from that situation.
Should I reinstall WordPress instead?
Replacing core files is part of a proper cleanup, but the infection is rarely only in core. Reinstalling without cleaning the database, uploads, must-use plugins and the server-side locations usually brings the malware back within days.
Do you handle WooCommerce stores?
Yes, frequently. For stores we pay extra attention to checkout pages, payment plugins and anything that could skim card data, and we agree a working window if the store is busy.
What about fake administrator accounts?
We identify them and list them in the report. Removing user accounts and resetting credentials is done with you, so nothing legitimate is lost.
Can you harden the site after the cleanup?
Yes. Cleanup + Hardening is €390 in total and includes the verification report. Hardening alone is €300.
Do you offer ongoing WordPress maintenance?
Yes. The Maintenance & Security Monitoring plans cover weekly checks, updates with backups, and cleanups included on the Protect and Respond plans.
Related reading
From our research notes
WordPress site hacked?
Send the site URL and what you see. We reply with the access we need and the next steps.