Before hiring anyone, there are steps you can take yourself without the risk of erasing the evidence of how they got in. This is the order I would do them in:
- Make a full copy exactly as it is: files and database. If something goes wrong you can go back, and it is the evidence of what happened.
- Change the passwords from a clean computer: the hosting control panel, FTP or SFTP, and every WordPress administrator. If you change the database password, change it in
wp-config.php too or the site will stop loading. - Check the administrators under Users → All Users, filtering by "Administrator". Note the ones you don't recognize and switch them to "Subscriber" instead of deleting them: their registration date helps tell since when someone has had access.
- Compare the core and the plugins with the originals. With SSH and WP-CLI, the commands below do it in seconds; any line that isn't "Success" deserves a closer look.
- Look for .php files in
wp-content/uploads/. Only images and documents belong there; a PHP file in that folder is almost always a backdoor. Also check wp-content/mu-plugins/ and the .htaccess in the root. - Update WordPress, the plugins and the theme from the official sources, and delete (don't just deactivate) the plugins you don't use and any "nulled" copy.
- Don't ask Google for a review yet. If Search Console shows a security issue, request it once the site is clean and the way in is closed: a rejected review delays the next one.
wp core verify-checksums
wp plugin verify-checksums --all
find wp-content/uploads -name "*.php"
If something turns up that you don't know how to read, stop there and keep the copy: it is what I will need to clean it. Without SSH, the free external scan detects the symptoms visible from outside (redirects, injected scripts, vulnerable plugins, blacklists), and to look inside without giving me FTP there is the read-only connector. The signs, one by one, are in the guide to telling if your WordPress site is hacked.
Free plugin, Wordfence Care, Sucuri or me: what each option includes
| Option | Does it clean the site? | What it checks | Price |
|---|
| Free plugin (Wordfence, Kadence Security) | Not in the free version | From inside WordPress: firewall, malware signatures and login attempts. Free Wordfence gets rules and signatures 30 days after Premium | Free |
|---|
| Wordfence Care | Yes: it is a paid service that includes help with hacked sites | What the plugin does, plus their team stepping in | Paid; pricing on their website |
|---|
| Sucuri Website Security Platform | Yes: unlimited manual cleanups on every plan | Remote malware scanning from every 12 hours (Basic) to every 30 minutes (Business), and a cloud firewall | US$229, US$339 or US$549 a year per site |
|---|
| WebIntacta (Jose Soriano) | Yes, at a fixed price and with a 90-day guarantee | Core file by file, plugins, database, users and the way the attacker got in, with a written report | €219; with priority, +€80 |
|---|
Third-party data checked on their official pages on October 8, 2026; it may change. My prices, excluding VAT.
The source of each figure, and when another option suits you better, are in the comparison: Wordfence, Sucuri or a technician. If you only want prevention and your WordPress site is simple, a well-configured free plugin may be enough.
Clean up a hacked WordPress site and keep it monitored
If, besides cleaning it, you want someone to look after it afterwards, the WordPress rescue pack (€429) combines the cleanup with priority with three months of the Business website plan and the Priority add-on. When it ends it moves to the normal fee, or you cancel it.
If pages in Japanese show up in Google under your domain, that is a very specific variant of this problem: I explain it in the guide to the Japanese keyword hack.