Service · WordPress security

Hacked WordPress site? I'll clean it and close the way in.

Malware, spam pages, redirects to scam sites or a "This site may be hacked" warning: I remove every trace, find how the attacker got in and patch it, so it doesn't come back next week.

  • From $299
  • Work starts the same day
  • Reinfection guarantee

Who it's for

  • 01

    Your site was hacked today

    Spam pages in Google, visitors sent to scam sites, a red warning in Chrome or your host suspended the account. You need it fixed now.

  • 02

    It keeps coming back

    A plugin or a cheap gig cleaned it, and a week later it's back. That means the way in was never found. I find it and close it.

  • 03

    Stores and business sites

    WooCommerce shops, booking sites and lead forms, where a hack costs real sales and customer trust every hour it stays.

What I find and fix

The infections I see most on hacked WordPress sites, how they show up, and what I do about each one.

  • 01SEO spam (Japanese keyword and pharma hacks)

    What you see
    Thousands of spam pages in Google: Japanese text, fake luxury goods or pills under your domain. Often hidden from you while logged in.
    How I fix it
    I remove the injected code and spam pages, clean the database, and clear the spam URLs from Google through Search Console.
  • 02Malicious redirects

    What you see
    Visitors, often on phones or arriving from Google, are sent to scam, gambling or fake-prize sites.
    How I fix it
    I remove the injected scripts and rogue server rules (.htaccess), and check the database, widgets and settings they hide in.
  • 03Backdoors and web shells

    What you see
    Nothing visible, but the hack returns after every cleanup. Hidden PHP files let the attacker back in.
    How I fix it
    Every file is compared against clean copies; unknown files in uploads and plugin folders are removed; core, plugins and themes are reinstalled fresh.
  • 04Fake admin users

    What you see
    Administrator accounts you didn't create, sometimes hidden from the users list.
    How I fix it
    I remove them, audit every account, reset all passwords and replace the security keys, which logs everyone out.
  • 05Vulnerable or nulled plugins and themes

    What you see
    The usual way in: an outdated plugin, an abandoned one, or a pirated (nulled) theme with malware built in.
    How I fix it
    I update or replace them, remove nulled and unused ones, and tell you which plugin was the entry point.
  • 06Injected scripts and card skimmers

    What you see
    Pop-ups, unknown scripts in your pages, or on stores, code that copies what customers type at checkout.
    How I fix it
    I remove the scripts from files and the database, check the checkout and payment pages, and lock down where they were added.
  • 07Blacklists and host suspension

    What you see
    "This site may be hacked" in Google, a red warning in Chrome, email going to spam, or the host taking the site offline.
    How I fix it
    Once the site is clean I request a review in Google Search Console and give your host the cleanup report.
  • 08Weak logins and brute force

    What you see
    Thousands of login attempts, a shared admin password, or old accounts nobody uses.
    How I fix it
    Two-factor login for admins, limits on login attempts, strong passwords and removal of old accounts.

Three plans, one fixed price each

Every plan finds and patches the way in, not just the malware. The difference is how far the protection goes after the cleanup.

Cleanup

$299

24–48 hours · fixed price

Clean, patched and off the blacklist.

  • Full scan of files and database
  • Malware, backdoors and spam pages removed
  • Fake admin users removed, passwords and security keys reset
  • Core, plugins and themes reinstalled from clean copies
  • The entry point found and patched
  • Google blacklist review requested
  • A written report of what I found and fixed
  • 30-day reinfection guarantee: free re-clean

Cleanup + hardening

Recommended

$499

Within 24 hours · fixed price

Cleaned, then locked down so it stays clean.

  • Everything in Cleanup, with priority
  • Firewall and login protection set up
  • Two-factor login for every admin
  • Vulnerable and abandoned plugins replaced
  • Automatic off-site backups set up
  • Spam URLs cleared from Google and the sitemap resubmitted
  • 60-day reinfection guarantee

Full recovery

From$799

1–3 days · fixed price

Stores, badly damaged sites and several sites at once.

  • Everything in Cleanup + hardening
  • WooCommerce and checkout pages checked line by line
  • Several infected sites on the same hosting account
  • Restore from backup or rebuild of broken parts
  • Help moving to a safer host if needed
  • 90-day reinfection guarantee and monitoring
  • Payment: 50% to start, 50% when the site is clean, via Payoneer
  • Hosting fees and security subscriptions are paid by you
  • No ranking guarantees: Google decides how fast warnings and spam drop out

Cheap gig, my cleanup or a security subscription?

An honest comparison, using typical 2026 market figures.

  • Marketplace gig

    Cost
    $50–$199, one-off
    Finds how they got in
    Rarely
    Who does the work
    An unknown seller
    If it comes back
    Depends on the seller
    Afterwards
    Nothing
  • My cleanup

    Cost
    From $299, fixed
    Finds how they got in
    Yes, and patches it
    Who does the work
    The developer, directly
    If it comes back
    Free re-clean (30–90 days)
    Afterwards
    Hardening and a written report
  • Security subscription

    Cost
    About $99–$490 a year
    Finds how they got in
    Usually
    Who does the work
    A support team
    If it comes back
    Cleanups while subscribed
    Afterwards
    Firewall and monitoring

Want ongoing protection after the cleanup? A security subscription can be a good fit, and I can set it up for you.

In every cleanup

  • A full backup before I touch anything
  • Files and database both cleaned
  • The way in found and patched
  • Passwords and security keys reset
  • Google review requested once clean
  • A plain-English report of what happened

How it works

From your first message to a clean, watched site. The Cleanup plan timeline.

  1. Hour 0

    Message me

    Tell me what you're seeing on WhatsApp or by email. You get a fixed price straight away.

  2. Hours 0–2

    Back up and contain

    A full backup of the site as it is, then the attacker's access is blocked and passwords reset.

  3. Hours 2–24

    Scan and clean

    Files and database compared against clean copies; malware, backdoors and spam removed.

  4. Day 1–2

    Patch and report

    The entry point patched, Google's review requested and your written report sent.

  5. 30+ days

    Watch

    I keep an eye on the site. If it's reinfected within the guarantee, I clean it again for free.

What I need from you

  • A WordPress admin login
  • Hosting access (cPanel or SFTP) and database access
  • Access to Google Search Console, if you have it
  • When you first noticed the problem, and what you saw
  • The 50% deposit

Not included

  • Hosting fees and security subscriptions
  • Rebuilding a site the attacker destroyed (quoted separately)
  • Recovering content that was deleted with no backup
  • Legal or data-breach reporting (I share what I find)

Tools I work with

  • WordPress
  • PHP
  • MySQL
  • Nginx
  • Cloudflare
  • Docker

Words you'll hear, in plain English

Malware
Any code an attacker adds to your site to profit from it: spam, redirects, stolen data or access.
Backdoor
A hidden file that lets the attacker get back in, even after the visible malware is removed.
Entry point
The weakness they used to get in, usually an outdated plugin or a stolen password.
Blacklist
Lists like Google Safe Browsing that warn visitors away from hacked sites.
Hardening
Settings and tools that make the site harder to break into again.
Nulled plugin
A pirated copy of a paid plugin or theme, often with malware built in.

Questions about hacked sites

How fast can you start?

Usually the same day you message me. The Cleanup + hardening plan gets priority and is finished within 24 hours.

Will I lose my content?

No. I take a full backup before touching anything, and I clean the site rather than wipe it. Your posts, pages, products and orders stay.

How did they get in?

Most often an outdated or abandoned plugin, a pirated theme, or a weak or reused password. Finding the exact way in is part of every plan, and it's in your report.

Will Google remove the warning?

Once the site is clean I request a review in Search Console. Google makes the decision, usually within days for malware warnings. Spam pages take longer to drop out of results.

Can you guarantee it won't happen again?

Nobody honestly can. What I guarantee is a free re-clean if the site is reinfected within your plan's guarantee period, and hardening that makes it much less likely.

Was my customers' data stolen?

I check for signs of data theft, such as checkout skimmers, and tell you plainly what I find. If data was exposed, reporting it is your decision, and my report helps.

Available for new projects

Have a project in mind but unsure where to start?

One free 30-minute call is all it takes. We'll talk through your goals, and I'll tell you what to build, how long it takes, and what it costs, with a fixed quote within 24 hours. No pressure, no obligation.

Tell me about your project

I'll reply within 24 hours.

Opens your email app with your message written out, addressed to tokiosman@outlook.com.

  • Fixed price
  • Direct with the developer
  • Launch in 2–4 weeks