# Hacked WordPress: I remove the malware and close the way in.

> WordPress malware removal for hacked sites: I clean the files and database, close the way in and fix the site. From €219, with a 90-day guarantee.

URL: https://webintacta.com/en/wordpress-malware-removal
Language: English (Spanish version: see the hreflang alternate of the HTML page)
Last updated: 2026-10-24

**In short:** Cleaning a hacked WordPress site with WebIntacta costs €219, and +€80 if you want your case to go ahead of the rest of my work (excluding VAT). I do it myself, Jose Soriano: I remove the malware from the files and the database, delete the users and scheduled tasks the attacker left, and update or replace the plugin or theme they got in through. It includes a report of what was there and a 90-day guarantee.


In WordPress, malware is rarely in just one place: there is usually a backdoor in a plugin, code in the database and, often, a new admin user. To really remove malware from WordPress you have to find all three; if only the visible part gets cleaned, it comes back.

## Where it hides in WordPress

- `wp-content/uploads/` with .php files (only images and documents belong there)
- `wp-content/mu-plugins/`: plugins that always load and don't show up in the normal list
- The `siteurl` and `home` options changed, or scripts in `wp_options` and in posts
- `.htaccess` with rules that redirect depending on the browser or where the visitor comes from
- Core files (`wp-includes`, `wp-admin`) that don't match the originals
- Unknown admin users and scheduled tasks (cron) that reinstall the infection

## How I do it

1. **Backup and infection footprint.** I copy the site and the database, and compare every core file with the original for your WordPress version. Whatever doesn't match gets flagged.
2. **Plugins and themes.** I reinstall the plugins and the theme from the official source (with your license if they are premium). I remove abandoned ones that can't be fixed and suggest an alternative.
3. **Database and users.** I look for scripts injected into posts, options and widgets; I delete users and tasks that aren't yours and regenerate the keys in `wp-config.php`.
4. **Google and verification.** I request a review in Search Console if there is a warning, scan again and hand you the report with the cause and what was changed.

## Fixing a hacked WordPress site: what you can do without making it worse

Before hiring anyone, there are steps you can take yourself without the risk of erasing the evidence of how they got in. This is the order I would do them in:

1. **Make a full copy exactly as it is**: files and database. If something goes wrong you can go back, and it is the evidence of what happened.
2. **Change the passwords from a clean computer**: the hosting control panel, FTP or SFTP, and every WordPress administrator. If you change the database password, change it in `wp-config.php` too or the site will stop loading.
3. **Check the administrators** under Users → All Users, filtering by "Administrator". Note the ones you don't recognize and switch them to "Subscriber" instead of deleting them: their registration date helps tell since when someone has had access.
4. **Compare the core and the plugins with the originals.** With SSH and WP-CLI, the commands below do it in seconds; any line that isn't "Success" deserves a closer look.
5. **Look for .php files in `wp-content/uploads/`.** Only images and documents belong there; a PHP file in that folder is almost always a backdoor. Also check `wp-content/mu-plugins/` and the `.htaccess` in the root.
6. **Update WordPress, the plugins and the theme** from the official sources, and delete (don't just deactivate) the plugins you don't use and any "nulled" copy.
7. **Don't ask Google for a review yet.** If Search Console shows a security issue, request it once the site is clean and the way in is closed: a rejected review delays the next one.

```
wp core verify-checksums
wp plugin verify-checksums --all
find wp-content/uploads -name "*.php"
```

If something turns up that you don't know how to read, stop there and keep the copy: it is what I will need to clean it. Without SSH, the [free external scan](https://webintacta.com/en/free-website-security-scan) detects the symptoms visible from outside (redirects, injected scripts, vulnerable plugins, blacklists), and to look inside without giving me FTP there is the [read-only connector](https://webintacta.com/en/read-only-connector). The signs, one by one, are in the [guide to telling if your WordPress site is hacked](https://webintacta.com/en/guides/how-to-tell-if-wordpress-is-hacked).

## Free plugin, Wordfence Care, Sucuri or me: what each option includes

| Option | Does it clean the site? | What it checks | Price |
| --- | --- | --- | --- |
| Free plugin (Wordfence, Kadence Security) | Not in the free version | From inside WordPress: firewall, malware signatures and login attempts. Free Wordfence gets rules and signatures 30 days after Premium | Free |
| Wordfence Care | Yes: it is a paid service that includes help with hacked sites | What the plugin does, plus their team stepping in | Paid; pricing on their website |
| Sucuri Website Security Platform | Yes: unlimited manual cleanups on every plan | Remote malware scanning from every 12 hours (Basic) to every 30 minutes (Business), and a cloud firewall | US$229, US$339 or US$549 a year per site |
| WebIntacta (Jose Soriano) | Yes, at a fixed price and with a 90-day guarantee | Core file by file, plugins, database, users and the way the attacker got in, with a written report | €219; with priority, +€80 |

Third-party data checked on their official pages on October 8, 2026; it may change. My prices, excluding VAT.

The source of each figure, and when another option suits you better, are in the [comparison: Wordfence, Sucuri or a technician](https://webintacta.com/en/compare). If you only want prevention and your WordPress site is simple, a well-configured free plugin may be enough.

## Clean up a hacked WordPress site and keep it monitored

If, besides cleaning it, you want someone to look after it afterwards, the **WordPress rescue** pack (€429) combines the cleanup with priority with three months of the Business website plan and the Priority add-on. When it ends it moves to the normal fee, or you cancel it.

If pages in Japanese show up in Google under your domain, that is a very specific variant of this problem: I explain it in the [guide to the Japanese keyword hack](https://webintacta.com/en/guides/japanese-keyword-hack).

## Price

Fixed price for one WordPress installation. Multisite or more than 5 GB: +€90.

### Hacked WordPress cleanup — €219 (excluding VAT)
I remove the malware, close the way in and check that it does not come back.

$219 outside the EU.
- Files, database and backdoors
- Users and scheduled tasks the attacker left behind
- Update or replacement of the plugin or theme they got in through
- Password and key rotation (wp-config) together with you
- Review in Google Search Console and blocklists
- A report of what was there and what was done

> 90-day guarantee: if it gets reinfected, I clean it again at no cost.

**With priority: +€80** (+$80 outside the EU). Your case goes ahead of every other job, weekends too if needed. It is priority, not a guaranteed deadline.

### WordPress rescue — €429 (excluding VAT)
Cleanup with priority + 3 months of Business website maintenance with the Priority add-on.

$389 outside the EU.
- WordPress cleanup with priority
- 3 months of Business website maintenance
- 3 months of the Priority add-on

> Afterwards it moves to the plan's normal fee; you can cancel it.

Outside the EU, removing the malware and repairing a WordPress installation costs $219, done remotely.

## Frequently asked questions

### How much does it cost to clean a hacked WordPress site?

€219 for the standard cleanup, and +€80 if you want it with priority over the rest of my work, excluding VAT. Multisite or more than 5 GB, +€90. The WordPress rescue pack, with three months of maintenance, €429.

### Is a security plugin enough to clean it?

Security plugins are good at detecting known signatures, but they don't know how the attacker got in and they don't go through the database thoroughly. If the infection comes back after "cleaning" it with a plugin, the way in is still open. I compare them in [which WordPress security plugin to choose](https://webintacta.com/en/guides/best-wordpress-security-plugin).

### Do I have to update WordPress and the plugins?

Yes, and I do it myself, with a backup first. If a plugin is abandoned or a "nulled" (pirated) copy, it has to be replaced: they are often the source.

### Will I lose my SEO?

Not because of the cleanup. What hurts your rankings is the injected spam and the Google warning; once they are removed and the review is requested, Google crawls the clean site again.

### What does the 90-day guarantee cover?

If the same problem comes back within the next 90 days, I clean it again at no cost. It doesn't cover new infections caused, for example, by installing a pirated plugin afterwards.

Hire or ask (email and chat): https://webintacta.com/soporte?lang=en