WordPress Malware Removal That Cleans Google, Too

Most WordPress malware removal stops when the scanner turns green, and that's usually where the trouble starts. The files look clean, but the attacker still has a spare key in the hosting account, and Google still shows a few thousand spam pages under your name.

Your site got hacked. Annoying, fixable, and not a reflection of you. I clean three layers, in this order: the WordPress files, the whole hosting account, and then Google's index. Skip a layer and the problem tends to come back, usually on a Friday.

If you're looking at a red warning screen right now, you can tell me what you're seeing in a short questionnaire and I'll reply with a plan. No pressure either way.

Starting at $300 for a standard cleanup, or $500 for an emergency job I start within hours. Both include the malware cleanup, a sweep of the hosting account, hardening, and the Google side: warning removal steps and the review request.

What you get with BigRed's WordPress malware removal

Here's what's on the list for every cleanup, standard or emergency:

• Malware cleanup. Malware (code someone planted to misuse your site) gets removed from WordPress core, themes, plugins, uploads and the database. Core and wordpress.org plugin files are checked against official copies, not eyeballed.
• Backdoor hunt. A backdoor (a hidden way back in, like a secret login or a script that re-downloads the malware) is the part cheap cleanups miss. I look for hidden admin users, rogue must-use plugins, and scheduled tasks.
• Hosting-account sweep. Every site, folder, cron job (a task the server runs on a timer), FTP account and SSH key in the account gets checked, not just the one site that looks hacked.
• Hardening. Updates, removal of dead plugins and themes, fresh passwords and salts (the secret keys that sign your login cookies), 2FA (a second login step, usually a phone code) for admins, and server rules that stop PHP from running where it shouldn't.
• Google cleanup. Spam URLs removed from the index, the attacker's Search Console access revoked, a clean sitemap submitted, and a review request filed so the "This site may be hacked" label can come off.
• A plain-English report. What I found, how they likely got in, what I changed, and what to watch for next.

How it works, from questionnaire to clean

1. You fill in the questionnaire. What you're seeing, where the site is hosted, and who has access.
2. I reply with a plan and a fixed price. Typically the same business day for standard jobs, faster for emergencies.
3. You give me access. Hosting control panel (cPanel, Plesk or similar), WordPress admin, and Google Search Console. I take a full backup before I touch anything, including the infected copy, because evidence is useful.
4. I clean the three layers in order. Files first, then the hosting account, then Google. A typical single-site cleanup takes one to two working days of hands-on time. Large or multi-site accounts take longer, and I'll tell you before I start.
5. Google review and follow-up. I file the review request and watch Search Console until Google answers. Google says a review can take from a few days to a few weeks, and nobody can hurry that part.

Why the order matters: files, hosting account, then Google

This is the part I care about most. Each layer has its own way of undoing the others.

Layer 1: the WordPress files and database

The attack usually comes in through a plugin. Patchstack's State of WordPress Security in 2026 counted 11,334 new vulnerabilities (security holes) in the WordPress ecosystem in 2025, with 91% of them in plugins. For the most heavily attacked holes, the weighted median time to first exploit was 5 hours. Your plugin update reminder is not being dramatic.

Modern malware also hides well. In October 2026, Patchstack documented a campaign that installs four separate ways back in, including an admin account hidden from the Users screen by a must-use plugin (a plugin WordPress loads automatically and won't let you switch off from the dashboard). It also backdates its files so a "recently changed files" search walks right past them.

That's why I don't trust file dates. I compare files against official checksums (digital fingerprints of the real files) with WP-CLI (WordPress's command-line tool):

## Read-only: compare core and wordpress.org plugin files with the official fingerprints.
## Safe to run. It changes nothing, but premium plugins can't be checked this way.
wp core verify-checksums --include-root
wp plugin verify-checksums --all

## Uploads should hold images and PDFs, never PHP. Anything listed here is a suspect.
find wp-content/uploads -type f -name "*.php"

Malware also lives in the database (posts, widgets, options), so I search there too. A file-only cleanup leaves those behind.

Layer 2: the hosting account

Malware is like a houseguest who copied your keys. Changing the locks is step one, not the whole plan.

On a typical shared hosting plan, every site in one account runs as the same server user. An old test install, a forgotten staging copy, or a second domain you parked years ago can quietly rewrite the site you just cleaned. So I list every site and folder in the account, delete what's dead (after a backup), check cron jobs, FTP users and SSH keys, and rotate the database password.

Then I close the door that malware loves most. This small file stops the server from running PHP inside your uploads folder:

## Put this in wp-content/uploads/.htaccess (Apache 2.4 or LiteSpeed).
## Blocks any PHP file in uploads from running. Could break: a rare, badly built plugin
## that runs PHP from uploads. Nginx needs a server rule instead.
<FilesMatch "\.(?:php[0-9]?|phtml|phar)$">
    Require all denied
</FilesMatch>

That Require all denied line is the modern Apache 2.4 syntax. Plenty of guides still hand out the old Order Deny,Allow version, which only works if the host loaded a compatibility module.

Layer 3: Google's index and Search Console

This is the layer most cleanups skip. Attackers sometimes verify themselves as owners of your site in Google Search Console (Google's free dashboard for site owners). From there they can submit their own sitemaps (lists of pages they want Google to find). Google's own help page puts it plainly: if you find an owner you don't recognize, you might have been hacked, and that owner can re-verify as long as their verification token stays on your site.

Some spam is also cloaked (shown to Google but hidden from you). Google suggests checking your pages with the URL Inspection tool to see what Googlebot sees, because your own browser may show a perfectly normal site.

Once the site is clean, the spam URLs need to return a "gone" status. Google removes previously indexed URLs that return 4xx codes like 404 (not found) or 410 (gone for good). For spam that follows a pattern, one rule beats deleting pages one by one:

## Put above the "# BEGIN WordPress" block in the site's root .htaccess.
## Returns 410 Gone for an example spam pattern like /jp/abc123.html.
## Could break: any real page matching the pattern. Test it against your URL list first.
RewriteEngine On
RewriteRule ^jp/[a-z0-9]+\.html$ - [G,L]

For the handful of spam pages that show up for your brand name, I also use the Removals tool. It's a stopgap: a removal lasts only about six months, so the 410 does the real work. (The full sequence is in my guide to getting hacked pages out of Google.) Only after all of that do I request the review, because Google asks you to confirm the problem is fixed across the whole site first.

Who this is for (and who it isn't)

This is a good fit if you run a WordPress site on cPanel, Plesk, a VPS or managed WordPress hosting, and you're seeing any of these:

• Google shows "This site may be hacked" or a red browser warning
• Search results list Japanese, pharma or casino pages you never wrote
• Visitors on phones get redirected to spam, while your laptop looks fine
• Your host suspended the account or flagged outgoing spam email
• You cleaned it once already and it came back

I work with contractors, clinics, law firms, local retailers and SaaS startups across the US and Canada, all remotely. A cleanup never needs anyone in the room.

It isn't for you if your site is on Shopify, Wix or Squarespace. Those platforms run the servers themselves, so call their support first. It also isn't needed if a scanner like Wordfence (its free version includes a malware scan) flagged one file, you deleted it, and Google shows nothing odd. That's often enough. My guide on cleaning a hacked WordPress site yourself walks through the DIY route step by step.

WordPress malware removal cost: what $300 and $500 buy

Prices for this work are all over the map. Codeable estimates that recovering a hacked WordPress site typically runs $200 to $2,000+, depending on severity. The low end is usually a file scan and delete. The high end is usually a rebuild. Here's mine, as of October 2026:

If the account turns out to hold several hacked sites, or the site needs rebuilding rather than cleaning, I tell you before doing any extra work, and you decide. All prices are in USD, and Canadian clients can pay in CAD at the day's exchange rate. The full list sits on the pricing page.

Why hand it to me

I've spent 20+ years in search marketing, and a good part of that time inside servers: WordPress hack cleanups and hardening, cPanel/WHM, Plesk, Cloudflare and Linux setups, and a lot of .htaccess and regex (pattern-matching) redirects. That mix matters here, because a hack is both a server problem and an SEO problem.

Security shops tend to stop at the files. SEO people tend to stop at Search Console. I do both, so the spam pages leave Google's index and the hole they came through gets closed.

You also get the same person from first email to final report. No ticket queue, no handoffs.

Hacked website repair FAQ

How much does WordPress malware removal cost?

At BigRed it starts at $300 for a standard cleanup and $500 for an emergency cleanup that starts within hours. Both include the files, the hosting-account sweep, hardening and the Google review request. Across the market, prices run from about $200 for a quick scan-and-delete to $2,000 or more for complex recoveries. The difference is usually whether anyone looks for backdoors and cleans up Google afterward.

How long does it take to fix a hacked WordPress site?

The hands-on cleanup of a single site typically takes one to two working days. Accounts with many sites or heavy database infections take longer. The slow part is Google: once you request a review, Google says it can take from a few days to a few weeks. Spam URLs that return a 410 status drop out of search results as Google recrawls them, which also takes some weeks.

Why does the malware keep coming back after a cleanup?

Usually because a backdoor survived. Common hiding places are a second site in the same hosting account, a cron job that re-downloads the malware, a hidden admin user, or a must-use plugin. Restoring a backup doesn't help if the backup already contained the backdoor. That's why I sweep the whole hosting account, not just the site that looks hacked.

Will my rankings come back after the hack is cleaned?

Usually, once the spam is gone from the index and the warning label comes off. Rankings tend to recover as Google recrawls the clean site, though I can't promise a timeline because Google sets the pace. If traffic was falling before the hack, or doesn't return a few weeks after the review clears, that's a separate problem worth diagnosing on its own.

Can I just restore a backup instead?

Sometimes. A backup from before the infection is a fine starting point, but it doesn't close the hole the attacker used, remove their Search Console access, or delete the spam pages Google already indexed. If you restore, update everything right away, change every password, and check Search Console for owners you don't recognize. Otherwise you may be restoring the same problem with an older date on it.

Next step

If your site is showing spam, warnings or redirects, send me the details through the cleanup questionnaire and I'll come back with a plan and a fixed price. Once it's clean, ongoing WordPress maintenance keeps updates and monitoring on someone's calendar, so you don't have to remember.