In this guide · 8 sections
- 01First: contain it before you decide who cleans it
- 02When DIY malware removal is realistic
- 03What a WordPress cleanup service must deliver
- 04Why hacked WordPress sites get reinfected
- 05Google warnings, blacklists and how long recovery takes
- 06Keep it from happening again
- 07Do it yourself or get help?
- 08Frequently asked questions
Short answer
Fix it yourself only if you have a clean backup from before the hack, access to hosting and files, and time to find how the attacker got in. Otherwise pay for a cleanup that includes the root cause, a full password reset, hardening and a Google review request, not just a malware scan.
First: contain it before you decide who cleans it
Whoever does the cleanup, a few steps cannot wait. Our guide to what to do when your website is hacked covers the first hour in detail; the short version is below.
- Change the passwords for your hosting account and every WordPress administrator, from a clean computer.
- Take a full backup of the hacked site (files and database) and label it clearly as infected.
- Ask your host whether it has clean backups from before the hack and how far back they go.
- Check Google Search Console's Security Issues report for what Google has detected.
- If customer data could be affected, start a PDPA data breach assessment.
When DIY malware removal is realistic
Google's Help, I've been hacked guide notes that fixing a malware issue needs the ability to read code and possibly web server configuration, and suggests building a support team if that is beyond you. That is a fair test.
DIY is realistic if
- You have a clean backup from before the infection
- You can use the hosting file manager, FTP or SSH
- You know which plugins and themes the site should have
- The site is a brochure site with no customer accounts or payments
- You have a few uninterrupted hours
Pay for help if
- There is no clean backup, or you do not know when the hack started
- Google or your host has flagged or suspended the site
- The site takes payments or stores customer accounts
- It has been reinfected after a previous cleanup
- You cannot tell which files belong to WordPress and which do not
If you go ahead yourself, WordPress's own hardening guide is the reference for what to lock down afterwards.
What a WordPress cleanup service must deliver
Cleanup offers vary a lot. Some only run a scanner and delete the files it flags. Use this list to compare quotes and to check the work afterwards.
Ask for all of these
Ask what happens if the site is reinfected within a set period, and whether that is covered by the price. Be wary of anyone who promises the work without asking for hosting access.
Why hacked WordPress sites get reinfected
When a site is reinfected after a quick clean, the cause is usually one of these.
| Cause | Why it brings the attacker back | Fix |
|---|---|---|
| Entry point still open | The vulnerable plugin or theme is still installed | Update or remove it; check it against a vulnerability database |
| Back door left behind | A hidden file or admin user lets them straight back in | Replace core files, review users and scheduled tasks |
| Old passwords | The attacker kept a copy of credentials | Change every password and key, including database and salts |
| Nulled or pirated plugins | Free copies of paid plugins often contain malware | Delete them; buy or replace with official versions |
| Shared hosting neighbours | Another infected site on the same account reaches yours | Clean or remove every site on the account |
WordPress's hardening guide warns against getting plugins and themes from untrusted sources, and says old versions of WordPress are more open to attack because the details of fixed vulnerabilities become public. The WPScan vulnerability database catalogued 89,103 WordPress core, plugin and theme vulnerabilities when we checked in October 2026.
Google warnings, blacklists and how long recovery takes
If Google has flagged the site, visitors may see a warning in Chrome and in search results. Google's Security Issues report help page says to fix every listed issue on all pages, then select Request Review and describe the fixes. It says a review can take from a few days to a few weeks, and that you should not resubmit before you get a decision.
Confirm the site is clean
Check the example URLs Google lists, using a clean device. Hackers sometimes show malware only to search engines or mobile users.
Request a review in Search Console
Explain what was found, what was removed and how the entry point was closed.
Check other blocklists
Your host, antivirus vendors and email providers keep their own lists. Most have a request form once the site is clean.
Check your email domain
If the hack sent spam from your server, your domain's email may be blocked. Test whether your emails are reaching customers.
If a WordPress update caused the problem rather than a hack, see our guide to fixing a site broken by a WordPress update.
Keep it from happening again
Once a vulnerability is fixed and published, the details are public, which is why WordPress's hardening guide stresses updates. Prevention is routine work, not expensive work.
- Turn on automatic updates for WordPress core and well-maintained plugins, and check the rest monthly.
- Remove plugins and themes you do not use, including deactivated ones.
- Use two-factor login for every administrator and give editors only the access they need.
- Keep daily off-site backups, and test a restore at least once.
- Monitor the site so you hear about problems before customers do.
Our checklist of what website maintenance should cover turns this into a monthly routine.
Do it yourself or get help?
If you have a clean backup and know the site well, a careful DIY restore plus the hardening steps above is realistic. If not, or if the site handles payments or customer accounts, get help.
Malware clean-up of an infected site is quoted after we see it, because the work depends on how deep the infection goes. Once the site is clean, our Website Security Hardening (S$290) applies updates, removes unused plugins and users, adds admin two-factor login, a web application firewall, security headers and off-site backups. A single small task fits a Quick Fix (S$119), and Care Plus (S$349 a month) adds monthly updates, daily backups and a quarterly security review for sites the business relies on.
Frequently asked questions
Sometimes. It is realistic if you have a clean backup from before the hack, access to your hosting files and database, and time to find how the attacker got in. Without a clean backup, or if the site has been reinfected before, a professional cleanup is usually faster and less likely to leave a back door.
Usually because the original entry point was never closed, a hidden back door or admin user was left behind, or passwords were not all changed. Common entry points are outdated plugins, nulled or pirated plugins, reused passwords and other infected sites on the same hosting account.
Rarely on its own. Scanners help find suspicious files, but they can miss back doors, malicious database entries and rogue admin users, and they do not tell you how the attacker got in. Use a scanner as one tool, then replace core files, review users, change every password and close the entry point.
Google says a security review can take from a few days to a few weeks after you request it in Search Console. Fix every listed issue on all pages first, explain the fixes in your request, and do not resubmit before you get a decision, as that can slow the next review.
If personal data such as customer details may have been accessed, you must assess whether it is a notifiable data breach under the PDPA, and notify PDPC and affected people where required. You can also report incidents to SingCERT, and to the police if there was fraud or extortion.