Ortica
Let’s talk ↗
Ortica
Let’s talk
ciao@ortica.io

Hacked WordPress site

Site hacked.
We’ll get it back on its feet.

If your WordPress site has been hacked, we clean out the malware, find how the attack got in and close the hole. Then, if you like, we look after it so it doesn’t happen again. On WooCommerce too.

Tell us about the site ↗The signs ↓
200+
sites we look after, also on behalf of agencies
How you notice

Something’s off.
And it’s no accident.

A compromised site doesn’t always show it on the home page. These are the most common signs, and the first things to do.

The signs

  • Redirects to betting or pharmacy sites
  • Pages in strange languages in Google results
  • The “deceptive site” warning in the browser
  • Your host suspending the site or blocking email
  • Admin users you don’t recognise

What to do right away

  • Don’t delete anything: the traces matter
  • Change your WordPress and hosting passwords
  • Tell whoever manages the site or hosting
  • Don’t reinstall plugins and theme at random
  • Write to us with the site’s address

What we work with

AnalysisClean-upClosing the holeGoogle and hosting
WordPressWooCommerce
How we step in

First we understand.
Then we clean.

  1. 01

    Analysis.

    A copy of the site as it is, a scan of files and database, a check of users, plugins and server logs. We look for how the attack got in, not just what it left behind.

  2. 02

    Clean-up.

    We remove the malicious code from files and database, restore the original core, themes and plugins, and delete unknown users and access. If there’s a clean backup, we consider starting again from there.

  3. 03

    Closing the hole.

    We update or replace the vulnerable plugin, change passwords and security keys, and fix permissions and the PHP version.

  4. 04

    Google and hosting.

    If Google flags the site as dangerous we request a new review, remove spam pages from the results and, if needed, talk to your host to get the site back up.

What it costs

Clean-up first.
Prevention next.

The price always depends on how far the attack has spread and how the site is built. We tell you before we start.

  1. 01

    Clean-up.

    Analysis, clean-up, closing the hole and a final check. We give you the price after the first analysis, before we start; if the case is more complex, we tell you before going ahead.

  2. 02

    Support contract.

    After the clean-up we can look after the site for a yearly fee: updates tested in staging, off-server backups, a system that blocks intrusion attempts. If you like, with hosting on our servers.

  3. 03

    If we already look after it.

    Within the maintenance fee we remove easy-to-spot malware at no extra cost. Complex cases are quoted separately.

Frequently asked questions

Hacked site:
what everyone asks.

My site has been hacked: what do I do first?

Don’t delete files and don’t reinstall anything: the traces are needed to work out how the attack got in. Change your WordPress, hosting and FTP passwords straight away, then write to us with the site’s address.

How much does it cost to clean a hacked WordPress site?

It depends on how far the attack has spread, how many sites share the same hosting and how the site is built. After a first analysis we give you the price, before we start.

How long until the site is back online?

It depends on how extensive the damage is, so we don’t promise a time. The analysis shows whether it can be cleaned or whether it’s better to start again from a backup, and from there we give you the timing.

Is reinstalling WordPress enough to remove the malware?

No. The malicious code usually also sits in the database, in the uploads folder or in files that look normal, and the hole it came through stays open. Reinstalling without understanding what happened often means getting hacked again a few days later.

Google flags my site as dangerous: can the warning be removed?

Yes, after the clean-up. You ask Google for a new review from Search Console; once the check is passed the warning disappears. We also remove the spam pages left in the results.

How do you stop it happening again?

With regular updates tested in staging first, maintained plugins, passwords and access kept in order, a system that blocks intrusion attempts and off-server backups to roll back if needed. It’s what we do with WordPress maintenance.

Next serviceSpeed and performance Slow sites, Core Web Vitals in the red, shops that can’t handle peaks: we find the bottlenecks and fix them.
The next project

Site hacked?
Write to us.

Send us the site’s address and what you’re seeing: we tell you how to proceed and what it costs, before we start.

Tell us about the site ↗I’m an agency ↗

Let’s talk