WordPress malware removal and hacked site cleanup

The clearest test is a Google search for site:yourdomain.com. If you see pages you never created - Japanese characters, pharmacy or casino titles, random strings - the site is serving injected content. Other signals: Search Console reports "This site may be hacked", the site redirects on mobile but not desktop, admin users appear that you did not create, or your hosting provider warns about outgoing spam. Note that many infections are invisible in a normal browser, because the spam is served only to Googlebot.

It is an automated SEO spam attack. The attacker injects thousands of Japanese-language pages selling counterfeit goods, adds them to your sitemap, and registers themselves in your Search Console to speed up indexing. It is not personal - bots scan the whole internet for a known vulnerability, usually an outdated plugin, and take whatever they find. The value they extract is your domain's reputation in Google.

The warning disappears on its own once Google recrawls the site and finds it clean - but only after the spam is genuinely gone, including the injected URLs already in the index. The sequence that works: remove the infection and the backdoors, clean the sitemap so it lists only real pages, remove the attacker's account from Search Console, request removal of the spam URLs, and then file a reconsideration request if a manual action was issued. Expect days rather than hours.

Usually yes, but not instantly. Once the spam is gone and Google has recrawled the site, impressions typically return over a few weeks. How fast depends on how long the infection was live and whether a manual action was applied. Sites cleaned within days of infection tend to recover fully; sites that were spamming for months take longer and sometimes settle slightly below where they were.

You can, and our step-by-step guide walks through it. It works when the infection is recent and limited to a plugin's files. Where people usually get caught out: backdoors dropped in the uploads folder or in mu-plugins, a scheduled task that reinstalls the malware, a second admin account, and the Google side of the job that most tutorials skip entirely. If the site starts reinfecting itself within days, something was left behind.

Cleanup starts at 7 000 CZK for a standard WordPress site. The initial check is free - send us the URL and we tell you what we find, whether or not you hire us. The final number is fixed before we start and depends on the scope: how many sites are affected, whether the hosting account itself is compromised, and whether Google issued a manual action.

We clean most sites within 24 to 48 hours, hardening and the Search Console work included. What takes longer is Google: recrawling and dropping the spam URLs from the index runs over days to a few weeks, and that part is outside anyone's direct control. Monitoring runs for 30 days after the cleanup, so a reinfection surfaces while we are still on it.

Most reinfections come back through the same door. Keeping WordPress, plugins and themes updated closes the majority of it. Beyond that: two-factor authentication on every admin account, PHP execution disabled in the uploads directory, a login URL that is not the default, removal of plugins you no longer use, and backups stored somewhere other than the server itself. Our hardening guide covers the full list.