WordPress Security and Malware Removal
Handled for you, before a hack or after one
Most WordPress sites that get hacked were let in by something small, like a plugin that missed an update, a password used on another site, an old login nobody removed. I close those gaps before anyone finds them, clean up sites that have already been hacked, malware removal included, and look after the site afterward as part of a website care plan. You get plain answers about what I found and what I changed.
How WordPress sites get hacked
Most hacks are automated, and they look for the same few gaps.
A WordPress site has three layers. The core is WordPress itself, the software that runs the site. The theme controls the design. Plugins are add-ons that give the site its features, like forms, galleries, and booking calendars. Most of the security holes found each year are in plugins and themes, and only a few are in WordPress itself.
WordPress runs more websites than any other platform, so it draws the most attacks, and nearly all of them are automated. Programs check site after site for known weak spots and break into any site that has one. They pick a site by the software it runs, so a small business is as likely a target as a large one.
These are the usual ways in.
Plugins and themes that missed an update
When someone finds a security hole in a plugin, its maker releases a fix, and the details of the hole become public. From that day, every site still running the old version is easy to find and easy to break into. Most hacks happen in the gap between the fix and the update.
Plugins nobody maintains
Some plugins stop getting updates because their makers move on. A hole found in one of those stays open for good. Pirated copies of paid themes and plugins, often called "nulled," carry a bigger risk. Many arrive with harmful code already hidden inside.
Weak or reused passwords
A password used on another site that was later breached is probably on a list attackers already try. Login pages also face brute-force attacks, where a program guesses passwords thousands of times until one works. A short password, or the username "admin," makes the guessing easy.
Old accounts with too much access
Logins pile up over the years, with one for a past web designer, one for a former employee, one for a marketing company you stopped using. Each is another way in, and many still carry full administrator rights. Nobody uses them, so nobody notices they still work.
The hosting account
A site is only as safe as the server it runs on. An old version of PHP (the programming language WordPress runs on) raises the risk, as does crowded shared hosting, where one hacked site can reach the sites next to it. An email that tricks someone into typing the hosting password on a fake login page can open the door too. Few owners ever look at this side of their site.
Why hacks go unnoticed
A hacked site rarely announces itself. The attacker wants it running, because they're using it to send your visitors to scam pages, to publish spam pages under your web address, or to send junk email. Many hacks hide from the owner on purpose. A redirect may fire only for visitors who arrive from Google on a phone, so you open your own site, see nothing wrong, and the problem runs for months.
Seeing signs of this on your site?
Tell me what you've noticedWhat hardening covers
Hardening changes how the site is run, not how it looks.
Hardening means finding and closing the gaps an attacker would use, ahead of any attack. Your site looks the same afterward. The changes are in how the site is run and what the server allows.
Hardening a WordPress site covers eight areas.
A firewall
A firewall is a filter in front of the site that blocks common attacks before they reach the site. It turns away most of the automated traffic that probes sites for weak spots.
Protection against traffic floods
Some attacks send a flood of fake traffic meant to knock a site offline. The site has protection against these floods.
A second layer in front of the server
A second layer of protection sits in front of the server. It blocks attack traffic and speeds up page loads.
Security software on the site
Security software runs on the site itself, next to the firewall and the protection in front of the server.
WordPress updates, applied automatically
WordPress core updates install automatically, so the software that runs the site stays current.
A secure connection
Every page loads over HTTPS, so what visitors type into a form is encrypted on its way to you. The security certificate behind it renews on its own, so browsers never warn your visitors away.
Each site walled off
Each site is walled off from the others on the server, so a problem on one site can't spread to the next.
Daily backups, kept somewhere else
The files and the database are backed up daily and stored away from the server. A backup kept on the same server can be lost along with everything else if that server is hacked or fails.
Want the gaps on your site closed?
Tell me about your siteMalware removal and cleanup after a hack
Seven steps, so nothing the attacker left behind survives.
If your site has already been hacked, the goal is a clean site that stays clean. Removing the visible damage is the easy part. Most sites hacked a second time were never fully cleaned the first time. The attacker left a backdoor, a hidden file or account that lets them back in, and nobody found it.
A cleanup runs in seven steps.
- 1
Contain it.
I copy the site exactly as I found it, so nothing is lost and there's a record of what the attacker did. If the site is sending visitors to harmful pages, I may put up a short maintenance notice while I work, and I'll tell you before I do.
- 2
Find everything.
I scan the files and the database, check every user account, and look for scheduled tasks the attacker may have set to run again later. Spam often hides in the database, where a scan of the files alone won't reach it.
- 3
Replace with clean copies.
WordPress, the theme, and the plugins are reinstalled from their original sources, so no tampered file survives. Your pages, photos, and settings are checked and kept.
- 4
Close the way in.
The server's logs usually show how the attacker got in, whether through an outdated plugin, a stolen password, or a weak spot at the host. That gap gets closed, because a cleanup that leaves it open won't last.
- 5
Change every key.
Every password tied to the site is replaced, including the WordPress logins, the hosting account, file access, and the database. WordPress's security keys are reset too, which signs everyone out, the attacker included.
- 6
Clear the warnings.
If Google flagged the site, I confirm the cleanup in Search Console, where Google reports the problems it finds on a site, and ask for a review so the warning comes down. Spam pages Google picked up under your web address are removed from its results. If your host suspended the account, I send them what they need to restore it.
- 7
Watch it afterward.
The site gets extra scans for the weeks after a cleanup. If anything comes back, it shows up early and gets handled before it spreads.
Which backup is safe
A backup can help, if it was made before the hack began. Many hacks sit quietly for weeks first, so the newest backup may carry the problem with it. Working out when the attacker got in tells me which backups are safe.
- How they got inan old slider plugin
- What they changedspam pages, a hidden login
- What I removedall of it
- What keeps them outregular updates
A summary in plain words
When the site is clean, you get a written summary in everyday words of how the attacker got in, what they changed, what I removed, and what will keep it from happening again. You keep it, so you know what happened and what changed.
Your part: Tell me what you've noticed, and send any logins you have for the site and the hosting account.
Hacked right now?
Send it through the formWhy security is ongoing work
Security holds when updates go in regularly.
A site can be fully hardened today and exposed next month. New holes turn up in WordPress plugins every week, and each one starts the same race. The fix comes out, the details go public, and attackers start scanning for sites that haven’t updated. A site that updates regularly stays ahead. A site that updates when someone remembers falls behind.
So I treat security as part of a website care plan. I update the software, and the site is backed up daily.
Sites built by someone else
I take on WordPress sites other designers built. The first step is a security review of every plugin and theme, every user account, the hosting, and the backups. You get a plain summary of what's at risk, and the most urgent gaps get closed first. After that, if the site moves to my hosting, it gets the same updates and backups as the sites I built myself.
Site built by someone else?
Start with a security reviewWordPress sites I host and look after
The same routine runs on every one of them.
I built each of these sites, and each one runs on my hosting today. The updates, logins, backups, and scans on this page are how I look after every one of them.
Love and Beauty Maui
Working together since 2023. I host it and look after it.
Read the case study
Family Value Flooring
Working together since 2020. I host it and look after it.
Read the case study
Therm-A-Guard
Working together since 2022. I host it and look after it.
Read the case study
Troyer Transformations
Working together since 2018. I host it and look after it.
Read the case study
DR Miller Design Build
Working together since 2015. I host it and look after it.
See the project
Ecosense
Working together since 2015. I host it and look after it.
Read the case studyWant your site looked after the same way?
Tell me about it"He stepped in and helped resurrect a dying website that was rife with programming errors and contradictions trapped in the header and footer.
Josh did a bang-up job working with us, correcting errors that could be corrected and providing terrific insight into what needed to be done."
Questions about WordPress security
Still have a question?
Ask me directlyWhat is WordPress security?
WordPress security is the set of steps that keep a WordPress site from being hacked. It means updating the core, plugins, and theme, using strong unique passwords, removing old accounts, running a firewall, and keeping backups. Doing this ahead of an attack is called hardening. Your site looks the same afterward. The changes are in how it's run and what the server allows.
What do WordPress security services include?
WordPress security services include a review of the site's plugins, theme, accounts, and hosting, fixes for the gaps that review finds, cleanup if the site was hacked, and ongoing updates and backups. Every site I host runs the same setup, with security software on the site, a firewall in front of it, WordPress core updates applied automatically, and daily backups, plus a backup before every update. The ongoing part runs through a care plan.
How do I know if my WordPress site was hacked?
You can tell a WordPress site was hacked if you see a browser warning, pages in Google you never wrote, visitors sent to other sites, a malware notice from your host, or unknown admin accounts. To check Google, search for "site:" followed by your web address. Try your site on a phone through a Google search, since many redirects only fire that way. Emails that bounce or land in spam can be a sign too. If you see any of these, assume the site is hacked until it's checked.
How do you remove malware from a WordPress site?
To remove malware from a WordPress site, copy the site as it is, scan the files and database, delete every infected file and unknown account, reinstall everything from clean copies, then change every password. The step most cleanups miss is the backdoor, a hidden file or account that lets the attacker back in. Then find how they got in and close it, so the site stays clean.
What does a WordPress malware removal service do?
A WordPress malware removal service cleans a hacked site. It removes every infected file, hidden backdoor, and fake account, closes the hole the attacker used, and asks Google to take down any warnings. My cleanup runs in seven steps and ends with extra scans in the weeks after, so anything that comes back gets caught early. A hacked site goes to the top of my list, and cleanup is covered for sites on a care plan.
Why does my WordPress website redirect to spam?
A WordPress website that redirects to spam has been hacked. The attacker added code that sends some visitors, often people arriving from Google on a phone, to spam or scam pages. Because the redirect usually skips logged-in owners and desktop visits, many owners hear about it from a customer first. The cleanup has to remove that code and the backdoor that put it there.
My site was hacked. What do I do now?
If your site was hacked, change the password for your hosting account and your own WordPress login, from a computer you trust. Hold off on deleting files or restoring a backup, because the files show how the attacker got in, and the newest backup may be infected too. Then send me your web address and what you've noticed through the form, with "hacked" at the top.
Is WordPress secure?
WordPress is secure when it's kept up. WordPress itself has a security team and installs small security fixes automatically, and most hacks come through the plugins, themes, passwords, and accounts the owner controls. It draws the most attacks because it runs more websites than any other platform, and nearly all of those attacks are automated programs looking for sites that missed an update.
What is the best WordPress security plugin?
The best WordPress security plugin is one that's actively maintained and adds a firewall, login limits, and malware scans, without doubling up on protection your host already runs at the server. A plugin is one layer, though. It can't protect a site that skips updates or keeps old accounts, and it's one more plugin to keep current. I set up whichever fits your site and your host.
How do I improve WordPress security?
To improve WordPress security, update WordPress, plugins, and theme promptly, delete plugins you don't use, give every login a strong unique password, remove old accounts, and keep daily backups off the server. A firewall in front of the site blocks most automated attacks before they reach it. Together, those steps close most of the gaps attackers look for.
Doesn't my host take care of security?
Your host takes care of part of your security, not all of it. A good host secures the server, keeps its software current, and often adds a firewall and backups. What happens inside WordPress is up to whoever runs the site. That covers the plugins, the theme, the user accounts, and the updates. Most hacks come in through those parts, and a care plan covers them.
Will security changes slow my site down?
Security changes usually speed your site up when they're done well. Removing unused plugins and blocking junk traffic before it reaches the site both take load off the server. A heavy security plugin stacked on top of others can slow a site, which is one reason I keep the setup lean.
How much does WordPress security cost?
The cost of WordPress security depends on the site. Hardening a site that's current is a smaller job than cleaning up a hacked one, and ongoing protection runs through a care plan. We talk through the cost on our call.
Close the gaps before someone finds them.
Send me your web address, who built the site, and roughly when it was last updated. If anything seems off, or the site has been hacked, put that at the top. Securing your site starts with the form.