WordPress Malware Removal & Hacked Site Cleanup | Yasaf
Hacked website, spam and redirects
WordPress malware removal: investigate, clean up and recover your site
If your site redirects visitors, shows pages you never published, creates unknown administrator accounts, displays security warnings or becomes infected again after cleanup, deleting a suspicious file is not enough. Yasaf investigates files, databases, users, scheduled tasks, plugins and settings to determine the extent of the compromise before restoring the site.
- Suspicious redirects
- SEO spam
- Modified PHP files
- Unknown users
- Database and cron
- Post-cleanup hardening
Common warning signs
A breach does not always look the same to an administrator, Google and a visitor
Some attacks redirect users only on certain devices, from specific sources or with particular user agents. Others create thousands of spam URLs, insert hidden links, change database titles or keep a backdoor in a seemingly legitimate file.
That is why we check the site in multiple ways and compare what appears in WordPress with files, database records, users, available logs and Search Console warnings when access is provided.
Examples of warnings: Japanese or pharmaceutical results in searches site:, unknown pages indexed, “This site may harm your computer”, redirects occurring only through Google or new administrators nobody recognizes.
Investigation scope
Where we look for signs of compromise
Core, plugins, themes and uploads
Modified files, PHP in unusual locations, obfuscated names and differences from trusted sources.
wp-config, .htaccess and server
Redirects, includes, keys, unexpected rules and code injected outside the dashboard.
Posts, options and users
Scripts, URLs, administrators, changed options and spam content stored in the database.
Cron and backdoors
Tasks or files that recreate the infection after the visible symptom is removed.
Credentials and accounts
WordPress, hosting, SFTP/SSH, database and other access points that may have been compromised.
Vulnerable component
Outdated plugin or theme, weak credentials, abandoned software or another cause when it can be identified.
A symptom is not a diagnosis
What certain signs may indicate
| Sign | Possible investigation points | Action after cleanup |
|---|---|---|
| Redirects only some visitors | .htaccess, JS, plugin, theme, database, conditional code. | Test from different sources and devices and review the cache. |
| Spam pages appear on Google | Posts, generated files, sitemap, fake routes, database. | Remove the source, return the correct status and monitor Search Console. |
| Malware returns | Backdoor, cron, compromised credentials or another site in the same account. | Close persistence paths and review the entire environment. |
| Unknown administrator | User table, sessions and entry point. | Remove the account, invalidate sessions and change credentials. |
| Modified WordPress core files | Compare against the official version and loaded extensions. | Restore trusted files and update. |
Cleanup and recovery
We prefer restoring trusted components over “editing malware until it disappears”
During recovery
- Back up before making changes
- Replace core files with trusted versions
- Safely reinstall plugins and themes where possible
- Clean up the database and users
- Review scheduled tasks and persistence
After cleanup
- Change relevant credentials
- Updates
- Remove abandoned software
- 2FA when available
- Backups and monitoring
Google and Search Console
If Google detected the issue, recovery must also address the affected URLs and warnings
The Search Console Security Issues report may identify compromised pages. After fixing the cause, make sure spam URLs no longer serve malicious content and follow the review process when applicable.
If the incident also caused indexing issues, canonical problems or thousands of unwanted URLs, a later stage may include WordPress technical SEO.
Why does malware return?
Reinfection usually means an entry point remains open
Inside WordPress
Vulnerable plugin, outdated theme, compromised user, backdoor, cron task or code that was not removed.
Outside WordPress
Hosting account, FTP/SFTP, another site in the same environment, infected computer or reused credentials.
Questions
Questions about WordPress malware removal
Is changing the password enough?
It helps when credentials have been compromised, but does not remove files, users or backdoors already on the server.
Can a security plugin clean everything?
Scanners help detect signs, but false positives, custom files and persistence require investigation. A scanner alone is not proof.
My site shows Japanese pages on Google. Could it be hacked?
Possibly. SEO spam is a known compromise pattern. We first need to confirm where the content is generated and eliminate the cause before addressing indexed URLs.
Can you restore from a backup?
Yes, if a reliable, compatible backup from before the incident exists. We still need to investigate the likely entry point to avoid restoring a clean site to a vulnerable environment.
Can you guarantee the site will never be hacked again?
No reputable service can promise zero risk. Our work can remove the identified compromise and reduce exposure, but security requires ongoing maintenance.
Related services
After the site is recovered
Is your WordPress site redirecting visitors, creating strange pages or becoming infected again?
Send us the URL and describe the symptoms. If you have a hosting provider or Search Console warning, include a screenshot to speed up the initial assessment.