Immediate help for hacked websites
WordPress hacked? We remove the malware and secure your website
Last updated on
Is your website redirecting to other sites, is Google warning about your domain, or has your host blocked access? We find the malware, remove it completely, close the security vulnerability and bring your website back online clean.
Free initial assessment · Fixed price before we start
Malware removal in files and database
Finding and permanently closing the security vulnerability
Help with Google warnings and blacklists
Cleanup process
Example
Analysis & backup
erledigt
Malicious code & backdoors
entfernt
WordPress core
reinstalled
Passwords & keys
erneuert
Security vulnerability
geschlossen
Google Search Console
Review requested
Typical process – the exact scope depends on how badly your website is infected.
Signs
How to tell that your WordPress site has been hacked
A hack is rarely noticed immediately. Attackers want to stay undetected for as long as possible – they use your website to send spam, redirect visitors to fraudulent sites or place links for other people's shops. You should take these signs seriously:
Visitors are redirected to other sites – often only from smartphones or via Google
Google shows “This site may be hacked” or the browser warns about your site
Search results show unfamiliar pages with pharma, casino or spam content
Your host has blocked the website because of malware or reports unusual email sending
Unknown administrators, changed passwords or no more access to the backend
The website is suddenly slow or the server load rises for no apparent reason
Why you should act quickly
Every day counts: Google downranks infected sites or displays warning notices, emails from your domain end up in spam, and with online shops, customer data may be affected. If personal data is exfiltrated, a notification obligation under the GDPR may also apply.
The most common causes
Attackers usually gain access via outdated plugins or themes, followed by weak or reused passwords and insecure hosting environments. You can read more in our article The most common security vulnerabilities in WordPress plugins.
Services
What we do for a hacked WordPress website
A thorough cleanup is more than a malware scan. We remove not only the visible symptoms but also hidden backdoors – otherwise the website is infected again within a few days.
Remove malware and backdoors
We search files, uploads and the database for malicious code, hidden admin accounts and backdoors – with specialised scanners and manual review.
Renew core, themes and plugins
WordPress core and extensions are reinstalled from clean original sources. We replace outdated or abandoned plugins.
Close the entry point
We determine how the attacker got in and close exactly that gap. Only then does your website stay clean in the long term.
Remove Google warnings
We request the review in Google Search Console and help get your domain removed from blacklists and spam lists.
Backup and restoration
Before any change, we back up the current state. If a clean backup exists, we check whether a restoration gets to the goal faster.
Hardening and follow-up checks
New passwords and security keys, login protection and monitoring – so that a renewed attack does not go unnoticed.
Process
How the cleanup works
Clear steps, firm agreements: you know at all times what we are working on and what it costs.
01
Submit request
Briefly describe what happened. We will get back to you with a free initial assessment and tell you the fixed price.
02
Hand over access
You send the access credentials via an encrypted link. We first back up the current state – nothing is lost.
03
Cleanup
We remove malicious code and backdoors, renew WordPress and close the security vulnerability.
04
Approval and protection
We check the website, request the Google review and, if you wish, set up ongoing protection.
First aid
WordPress hacked – what you should do now
What you should do immediately
Stay calm and don't delete anything – traces help with the analysis
Change the passwords for WordPress, hosting, FTP and database from a clean device
Inform your host and ask whether an older backup is available
Check whether personal data could be affected
What you should avoid
Do not simply restore an old backup without knowing the cause – the vulnerability stays open, and the website is often reinfected within a few days. Deleting suspicious files is rarely enough either: backdoors often hide in the database, in upload folders or in seemingly harmless plugin files.
Not sure whether your website is affected at all? Our free WordPress security check gives you an initial assessment. For technical outages without a hack, our WordPress emergency service can help.
Request help
Report a hacked WordPress website
Briefly describe what you noticed. We will look at the website and get back to you with an initial assessment and a fixed price – without obligation.
Free, non-binding initial assessment
Fixed price before we start work
Confidential handling of your data
No change of hosting required
Please do not send passwords through this form. You will provide access credentials later via an encrypted link.
Your request
Required fields are marked with *.
Prevention
So your website does not get hacked again
Most repeat attacks exploit the same vulnerability or a forgotten plugin update. With ongoing WordPress maintenance, updates, backups and security scans no longer get left undone – and in an emergency, restoration is included.
Core, plugin and theme updates
Daily external backups
Security and malware scans
Restoration in an emergency
Monthly maintenance report
Personal point of contact
WordPress maintenance at a glance
Business Basic
from €39 / month
Restoration in an emergency
inklusive
Daily external backups
inklusive
Security scans
inklusive
Minimum term
keine
All prices incl. VAT, cancellable monthly.
FAQ
Frequently asked questions when WordPress has been hacked
Your question isn't listed? Write to us – we answer honestly and without sales pressure.
Get in touchTypical signs are redirects to other websites, warnings from Google or the browser, foreign content in search results, unknown administrators, or a suspension by the host. Some infections only show to visitors coming from Google or on smartphones – as a logged-in administrator you often see nothing of it.
That depends on the extent of the infection. Simple infections are often fixed quickly, while heavily entangled cases with many backdoors take longer. After the initial assessment, we will give you a realistic timeframe.
We first look at the website and then give you a fixed price. The initial assessment is free and non-binding. Customers with a WordPress maintenance contract receive emergency restoration at no additional cost.
Only rarely. A backup does restore an earlier state, but it does not close the vulnerability through which the attacker got in. Often the backup is already infected as well. That is why we always investigate the cause first.
No. We clean your website at your existing host. If the server environment itself is insecure or outdated, we will tell you openly – a move to our hosting is then possible, but not a requirement.
As soon as the website is clean, we request a review in Google Search Console. Google then checks the site again, which usually takes a few days. We support the process until the warning disappears.
If personal data could be affected – such as customer accounts or form entries – a notification to the competent supervisory authority within 72 hours may be necessary. We document our findings so that you or your data protection officer can assess this. This does not replace legal advice.
Website hacked? We'll put it right again.
Free initial assessment, fixed price and a clean website – without changing hosts.
Free initial assessment
Fixed price before we begin
Malware removal incl. database
Help with Google warnings
