Hacked WordPress Site Cleanup and Malware Removal

What people usually come with

• Spam in Google results. Pages in Japanese or Chinese appearing on your domain. This is the japanese keyword hack
• Visitors redirected to another site, often only on mobile or only when arriving from search
• Defacement: someone else's page instead of your homepage
• Spam sent from your server, after which the host blocks outgoing mail
• A Google warning shown as a red interstitial before visitors reach the site
• Hidden code with no visible symptoms: the site seems fine but server load has grown

What the work includes

1. A copy in the current state before anything is touched, both as insurance and as evidence for the diagnosis.
2. Diagnosis: what happened, when, and how they got in.
3. Closing access: passwords, security keys, unknown users in WordPress and in Search Console.
4. Cleanup: core, plugins and themes are reinstalled; the rest is cleaned by hand - uploads, .htaccess, wp-config, the theme and the database.
5. Finding every way back in: backdoors in other folders, scheduled tasks that restore deleted files.
6. Fixing the cause: updating or replacing the vulnerable plugin, otherwise it happens again.
7. Search cleanup: spam URLs return 410, the attacker's sitemap is removed, and a review request is filed in Search Console.
8. Prevention: what to change so it does not repeat.

How long it takes

The cleanup itself is usually a few hours depending on the size of the site and how deep the infection goes. After that comes the slow part, which is out of anyone's hands:

• Google's review after the request: usually a few days;
• spam pages dropping out of the index: a week to several weeks;
• rankings recovering: a month or more.

So the earlier you act, the smaller the damage. A site spamming for two days and a site spamming for six months are cleaned the same way, but the consequences for rankings are not the same.

What to send for an estimate

• the site address;
• what you noticed and when;
• whether you have hosting and Search Console access;
• whether a pre-infection backup exists.

That is enough to judge the scale. An initial check is possible even without access, since some symptoms are visible from outside.