Common questions about WordPress security, malware removal, and ongoing care — answered straight, without the salesy hand-waving.
Cleanup & emergency response
How do I know if my WordPress site is hacked?
Common signs: Google shows a red “this site may be dangerous” warning, your search results show spam content (pharma, casino, Japanese keywords), visitors get redirected to scam sites, your host has flagged the account, new admin accounts you didn’t create appear in WordPress, or your site is sending spam email. A free external scan tells you in minutes.
How fast can you clean a hacked WordPress site?
Most cleanups complete within 24–48 hours of getting backend access. Severe or complex cases take longer; we tell you upfront after the initial scan. Emergency cleanup details →
Why does my WordPress site keep getting hacked after cleanup?
Because the previous cleanup removed the malware file but didn’t close the access vector. Reinfection is an access problem, not a file problem — almost always one of: unknown admin accounts, un-rotated passwords, scheduled scripts re-downloading the payload, or exposed leftover files. Real case study of a 7-time reinfection cycle and how we closed it →
My site is flagged by Google. How long until the warning is removed?
Realistic timeline: 24–48 hours for the cleanup, then 24–72 hours for Google’s review queue once we submit the request. So 2–6 days total in most cases. We can’t promise Google’s clock — just a clean, complete cleanup. Full Google blacklist removal process →
What does a WordPress malware cleanup actually include?
External scan + backup + every infected file removed + WordPress core integrity check + access lockdown (unknown accounts, credentials, scheduled tasks) + Google warning lift request + optional care plan. Detailed breakdown →
Can I clean a hacked WordPress site myself?
Sometimes — if it’s a single visible infection, you have recent backups, you know what to look for in WordPress files and the database, and you’re confident the attacker’s access has been closed. Most owners who try DIY end up calling us within a week because the infection comes back. The risk isn’t the cleanup; it’s missing the access vector.
Specific infection types
What is the pharma hack and how do I remove it?
Injection of viagra/cialis/casino spam content into your WordPress pages, usually with cloaking that shows the spam only to Google’s crawler. The full removal includes file cleanup, database cleanup, .htaccess reset, and scheduled task removal. Pharma hack removal process →
What is the Japanese keyword hack?
Thousands of dynamically-generated Japanese spam pages added to your site for affiliate fraud. Includes backdoor PHP, sitemap manipulation, and often an unauthorized Search Console verified owner. Japanese hack removal process →
What about SEO spam, redirect malware, cryptominers, or defacement?
All standard WordPress infections we remove. Each type has its own pattern, but the cleanup framework is the same: scan, backup, remove every layer, close the access vectors, verify clean. See the full process →
Ongoing care & prevention
What’s included in a WordPress care plan?
Daily monitoring, malware scanning, off-site backups, plugin and theme updates with rollback if anything breaks, WordPress core updates, and incident response if anything is detected. Care plan details →
Do I need a care plan if my site isn’t hacked right now?
No, but care plans are the cheapest way to avoid the next incident. The two patterns we see on sites that didn’t have one: reinfection within weeks of cleanup, and compounding vulnerability accumulation from skipped updates. A care plan turns those into non-events.
How often should I update WordPress and its plugins?
Security patches should be applied within 48 hours of release. Major core updates can wait a week or two for ecosystem compatibility. Plugin updates depend on the plugin — some are notorious for breaking things, which is why a care plan includes a backup before every update plus a rollback option.
Is WordPress less secure than other CMS platforms?
WordPress itself is well-maintained; the security profile comes from the plugin ecosystem. WordPress runs about 40% of the web, which makes it the largest attack target. Most successful attacks exploit outdated plugins, weak credentials, or compromised hosting — not WordPress core.
Pricing & logistics
How much does WordPress malware cleanup cost?
Depends on scope. Most standard cleanups are flat-fee. We quote after the free external scan so you know the price before committing — no surprise add-ons. Request a scan →
What access do you need to clean my site?
WordPress admin (admin role) + SFTP or hosting panel access. For some host configurations we work entirely through WP-CLI. We use temporary credentials when possible and ask you to rotate everything after the work is done.
Do you work with WordPress sites on any host?
Yes. Any host that allows SFTP/SSH or admin access. We have direct experience with Pressable, Kinsta, WP Engine, SiteGround, Cloudways, Bluehost, GoDaddy, and many smaller hosts.
Do you guarantee the site won’t get hacked again?
No reputable security service does — the threat landscape changes daily. What we do guarantee: a complete cleanup including access lockdown, so reinfection from the same vector is closed. The care plan adds monitoring so any new threat is caught in minutes instead of weeks.
Can you also host my WordPress site?
Yes — managed WordPress hosting is available as part of our service stack. Hosting details →
Question not answered here?
Send it to us. If it’s a common question, we’ll add it to this page so the next person searching gets a better answer.
Related services
- Emergency cleanup — Site is hacked or flagged. Start here.
- Malware removal service — Full cleanup + access lockdown + Google warning lift.
- Google blacklist removal — Get the Safe Browsing warning lifted.
- Pharma hack removal — Viagra/cialis/casino spam injections.
- Japanese keyword hack — Japanese spam pages + affiliate fraud cleanup.
- Case studies — Real incidents we've cleaned up.
- Site cleanup overview — How our cleanups work end-to-end.
- Ongoing care plan — Monitoring, scans, backups, updates.
- Managed hosting — WordPress hosting with security built-in.