Services
Hacked WordPress site recovery
Site hacked, redirecting to spam or flagged by Google? We fix hacked WordPress sites for Canadian businesses: contain the damage first, clean the files and the database, find and close the way in, then harden the site so it does not come back next week.
Price
Fixed price, quoted before work starts
Every cleanup is different, so we look at the site first, free, and give you one fixed price before we start. It does not change unless the job does.
Who this is for
- A business whose site redirects visitors to spam, casino or pharmacy pages
- An owner who has a Google or browser warning, or a host suspension notice
- A store or lead site that cannot afford days of downtime
- Anyone whose site came back infected after an earlier cleanup
What's included
- Containment first: forensic backup, credentials changed, infection stopped from spreading
- File cleanup against clean copies of WordPress core, your theme and your plugins
- Database cleanup: injected scripts, spam posts, rogue options and hidden admin users
- Root cause found and fixed: the outdated plugin, weak login or hosting gap that let them in
- Hardening: least-privilege accounts, two-factor login, file permissions, firewall rules
- Google Search Console security review requested once the site is clean
- A written report of what we found, what we removed and what we changed
Scope: what is in and what is usually separate
A fixed-scope quote only works if the scope is clear. This is how we usually draw the line; anything in the right column can be added and priced separately.
| Included in a typical quote | Quoted separately or not included |
|---|---|
| Containment, file and database cleanup | Rebuilding a theme or plugin that is abandoned and cannot be patched (quoted separately) |
| Removing rogue users, backdoors and malicious cron jobs | Hosting migration if the host itself is the problem (quoted separately) |
| Finding and fixing the entry point | Restoring content that was never backed up and was destroyed by the attacker |
| Hardening and a written report | Legal or breach-notification advice (we can tell you what data was exposed; a lawyer advises on duties) |
| Requesting the Google security review | Ongoing monitoring after the job (available on a care plan) |
Our process, step by step
- Call or send the details. Phone us or use the short form with your site address and what you are seeing. We look from the outside first and reply within the day, usually much sooner during business hours. You get: a first read of what is wrong and a fixed price for the cleanup.
- Contain. We take a forensic backup, change every password and key, and stop the infection spreading, putting the site into maintenance mode if visitors are being redirected. You get: a site that is no longer hurting visitors or your reputation.
- Clean. Core, theme and plugin files are checked against clean copies and replaced; the database is searched for injected scripts, spam content, rogue options and hidden admin users; malicious cron jobs and drop-ins are removed. You get: a clean site, checked file by file.
- Close the hole. We trace how the attacker got in, usually an outdated plugin, a reused password or a hosting gap, and fix that cause. You get: the entry point closed, not just the symptom removed.
- Harden and hand back. Two-factor login, least-privilege accounts, file permissions, firewall rules and update discipline, then the Google review request and a written report. You get: a hardened site and a record of everything done.
What you receive at handover
- A written incident report: what was found, removed and changed
- A clean backup taken after the cleanup
- Updated, unique credentials for every account we touched
- The Google Search Console review request, if a warning was shown
- Recommendations to stop it happening again
Cleanup, restore or rebuild
Not every hacked site needs the same job. We tell you which of these fits before you pay for anything.
| Option | When it fits |
|---|---|
| Restore a clean backup | There is a backup from before the infection and little has changed since. Fastest, but the hole must still be closed or it happens again. |
| Full cleanup | No clean backup, or the infection is older than the backups. The usual job. |
| Cleanup plus care plan | The site was hacked because nobody was updating it. The plan keeps it patched afterwards. |
| Rebuild | The site runs on an abandoned theme or plugins that cannot be patched. Quoted separately. |
Technologies we use
- WP-CLI (core and plugin checksum verification)
- SSH and SFTP
- MySQL
- Google Search Console
- Server and access logs
- A web application firewall
What sets the price of a cleanup
We give a fixed price after looking at the site, before any work starts. These are the things that move it.
- How deep the infection goes. Files only is quicker than files plus database plus server-level persistence.
- Whether a clean backup exists. A good backup can turn a cleanup into a restore plus a fix.
- Site size. A store or a site with many plugins has more to verify.
- Reinfection. A site that came back after an earlier cleanup usually has a backdoor someone missed.
- Hosting access. Without server or log access the root cause takes longer to find.
See the pricing page for how we scope and quote, or send a brief through the contact page for a written estimate.
How long it takes
Hacked and down sites go to the front of our queue, and containment starts as soon as we have access. Cleanup time depends on how deep the infection goes; you get the expected timeline with the fixed price. The Google warning review then takes as long as Google takes.
- How quickly we get hosting and admin access
- Whether a clean backup exists
- How many sites share the same hosting account (they are often all infected)
Risks and how we manage them
- Destroying the evidence. We back up the infected site first, so the entry point can still be traced.
- A hidden backdoor brings it back. We check users, cron, drop-ins, uploads and the database, not just the files a scanner flags.
- The cleanup breaks the site. Changes are made against a backup and tested before the site is reopened.
Why choose us
- We contain first, so a rushed cleanup does not destroy the evidence of how they got in
- We clean the database as well as the files; many reinfections hide in wp_options and cron
- We fix the cause, not just the symptom
- Fixed price agreed before the cleanup starts
Questions
Frequently asked questions
How much does it cost to fix a hacked WordPress site?
We quote a fixed price after looking at the site, before any work starts, and the price does not change unless the job does. What moves it is how deep the infection goes, whether a clean backup exists and how big the site is.
How quickly can you start?
Call +1 (365) 440-1786. Hacked and down sites go to the front of our queue, and containment starts as soon as we have admin and hosting access. You get the expected timeline with the fixed price.
Will my site be down while you work?
Only if it is actively harming visitors. If it is redirecting people to spam, we put up a maintenance page while we clean; otherwise it stays up.
Can you remove the Google warning?
Google removes it, not us. Once the site is clean we request a review in Search Console and show you the request. Reviews usually finish within days, but the timing is Google's.
Is it safe to delete the strange files myself?
It is risky. Deleting files removes the symptom and the evidence, and usually leaves the backdoor. If you want to try, our guide on fixing a hacked WordPress site has the commands; if the site takes payments or leads, call us first.
Do you fix sites you did not build?
Yes. Most hacked sites we see were built by someone else. We need admin access and, ideally, hosting access.
How do I know if my WordPress site is vulnerable?
Run our free WordPress vulnerability scanner. It makes one passive request for your homepage and shows your WordPress and PHP versions, plugins with known vulnerabilities and missing security headers. It cannot see malware already on the server, so if the site is acting strangely, ask us for a free look.
Hacked WordPress site recovery
Get a fixed quote in 24 hours
Tell us what is wrong or what you need. Within 24 hours you get a written, fixed price or the questions we need answered to give you one.
- A reply within 24 hours
- Fixed price agreed before any work starts
- You own the code, content and accounts
Site down or hacked right now? Call +1 (365) 440-1786 or email info@fourcents.ca.
Request your fixed quote
Fields marked with an asterisk are required. Phone and budget are optional.
Thank you
We have received your details and will reply within 24 hours.