If your site is defaced, redirecting elsewhere, sending spam or flagged by Google, the order of work matters. Cleaning the files without closing the way in means it comes back within days.
Most cleanup services delete the malicious files and declare it done. The site works again, everybody relaxes, and a week later it is back — because the route in was never found or closed, and often a second backdoor was left behind deliberately.
So the work is really four things: contain it so it stops doing damage, find how it got in, clean thoroughly including the parts people miss, then close the entry and harden what is left. Skip the middle two and you are paying to do this again.
If you are reading this during an active incident, the useful immediate step is to take the site offline or into maintenance mode if you can. It stops the damage spreading to visitors and stops Google recording more bad pages while you sort it out.
What we do
Working UK-wide — directly with businesses, and white label behind design and marketing agencies.
Discuss a projectSite taken out of harm's way, and a snapshot taken of the compromised state before anything is changed — because that evidence is how you find the entry point.
An outdated plugin, a weak password, a compromised hosting account or a vulnerable theme. Without this, cleaning is temporary.
Core files, themes, plugins, uploads, the database and scheduled tasks. Injected content hides in all of them, not just the obvious places.
Attackers routinely leave a second way in. Finding those is what separates a cleanup that holds from one that does not.
Credentials rotated, the vulnerability patched, access tightened, and filtering put in front so the same probe does not reach the site again.
Requesting review so browser and search warnings are lifted, which otherwise outlast the infection by weeks.
A badly compromised site on an ancient platform can cost more to clean reliably than to rebuild. We will tell you when that is the case rather than bill for the cleanup.
Nobody can promise it will not happen again. What reduces the risk is patching, monitoring and access control afterwards, not the cleanup itself.
Even after a clean review, browser and search warnings can take days to clear. That is Google's timeline, not ours, and we would rather say so up front.
A lot of our work is delivered white label or under agreement, so these describe the problem and the approach rather than naming the client.
It is the fastest way to reach somebody who can start. If it is less urgent, send us the address and what you are seeing and we will tell you what we think it is.