Malware Cleanup Is the Easy Part
When a site gets hacked, the visible problem is dramatic: pharmaceutical spam in the search results, a redirect to somewhere unpleasant, a browser warning scaring off every visitor. Naturally, the client wants that gone today.
Cleaning it is the easy part. Here's the rest.
What actually happens in a cleanup
Contain first. Take the site offline or into maintenance mode. Every hour it's live and infected is more damage to your search presence and more risk to visitors.
Get a forensic copy before you change anything. Files and database, preserved. If you clean first and investigate later, you've destroyed the evidence that tells you how they got in.
Find the entry point. Access logs around the first sign of trouble, file modification times, recently added admin users, scheduled tasks that shouldn't exist. The infection is a symptom; this is the diagnosis.
Replace rather than clean, wherever possible. Core files, themes, and plugins get reinstalled fresh from source instead of picked through. Cleaning malware out of a file by hand is how you leave a backdoor behind.
Then the database and uploads, which have to be cleaned by hand because they contain real content. Injected scripts in post content, rogue admin accounts, PHP files hiding in the uploads folder.
Why "just restore the backup" often isn't enough
The instinct is reasonable and frequently wrong for one reason: you usually don't know when the compromise happened. Restoring to last Tuesday restores the backdoor if it arrived the Tuesday before.
Worse, a restore rolls back the vulnerability fix along with everything else — so the site comes back exactly as exploitable as it was.
Restores are part of the answer. They aren't the answer alone.
The part that matters most
Once it's clean, the question that determines whether you're doing this again in six weeks: how did they get in?
In our experience it's nearly always one of four things.
- An out-of-date plugin with a publicly known vulnerability. Overwhelmingly the most common.
- A weak or reused admin password, with no second factor.
- A compromised local machine — the credentials were stolen from someone's laptop, not from the server.
- Shared hosting cross-contamination, where a neighbouring site on the same account was the way in.
Afterward
Rotate every credential — admin users, database, FTP/SSH, hosting panel, and any API keys stored in the site. Force a logout of all sessions. Turn on two-factor for every administrator.
Then request a review through Search Console if you were flagged, and watch for reinfection for a fortnight. Reinfection within days means you missed the entry point, and it's back to the logs.
The cheaper version of this article
Keep things updated. Use unique passwords with two-factor. Take backups you have tested restoring. Remove plugins you don't use.
That's most of it. Security work is boring, and the boring part is the part that works.