Redirects to spam or scam sites
Visitors, often only on mobile or from Google, get sent to pharmacy, casino or fake prize pages.
WordPress malware removal
Hacked WordPress site? We’ll clean it up and lock it down.
Malware, spam redirects, a Google warning or a locked-out admin: we remove the infection, close the hole and get you back in Google’s good books, then keep your site updated, backed up and watched. Australian support on 1300 797 130.
Sound familiar?
Signs your WordPress site has been hacked
Hacks are rarely obvious. If you’re seeing any of these, act now: the longer malware sits on a site, the more damage it does to your visitors, your email and your Google rankings.
A warning in Google or the browser
"This site may be hacked", "Deceptive site ahead" or strange Japanese or pharmacy titles in your search results.
Pages and links you didn’t add
Thousands of spam pages in your sitemap, hidden links in the footer, or new posts nobody wrote.
Locked out, or admins you don’t know
Your password stops working, or new administrator accounts appear in WordPress.
Host suspension or email blacklisting
Your host takes the site offline for malware, or your emails start bouncing and landing in spam.
Suddenly slow or crashing
High server load, errors and timeouts from hidden scripts sending spam or mining in the background.
Malware removal
How we fix a hacked WordPress site and remove malware
- STEP 1
Contain the damage
We take a full copy of the site as it is, lock down every login and stop the attacker getting back in while we work.
- STEP 2
Find and remove every infection
Every file and the database are scanned and compared with clean copies. Malware, backdoors, rogue admins and spam are removed; your pages, products and orders stay.
- STEP 3
Close the way in
We find how they got in, whether an outdated plugin, a pirated theme, a weak password or an old site on the same hosting, fix it and reset every password and security key.
- STEP 4
Restore your reputation
We ask Google and blacklists to remove their warnings, check your email records, and send you a plain-English report of what happened and what we did.
Emergency help
Website hacked? What to do right now
Call us on 1300 797 130 or send the form below. We start the same business day: first we stop the damage, then we clean the site properly. Most hacked WordPress sites are clean and back to normal within one to two business days, and we tell you up front if yours needs longer.
What we need from you
- WordPress admin login: or we can create one if you are locked out.
- Hosting access: cPanel, Plesk or SFTP for the files and database.
- Domain or DNS access: only if the hack has touched your domain or email settings.
Your site doesn’t have to be hosted with us. We fix WordPress sites on any host, and if your current host keeps getting you hacked, we can move you to our Australian hosting once it is clean.
Until we start
Don’t delete the site or restore an old backup yet: the attacker may already be in those backups, and we need the evidence to find how they got in. Change your WordPress and hosting passwords if you can, and let us take it from there.
Ongoing maintenance
WordPress maintenance plans: what’s included
Most hacks come through updates that were never done. A care plan means someone is looking after your site every week, not just when it breaks.
Updates done safely
WordPress, plugins and themes kept up to date and checked afterwards. If an update breaks something, we roll it back and fix it.
Daily off-site backups
Your files and database copied every day to separate storage, with a restore whenever you need one.
Malware scanning and firewall
Regular scans for malware and suspicious changes, with a firewall and login protection to block attacks before they land.
Uptime and speed monitoring
Your site is checked around the clock. If it goes down we know straight away, usually before you do.
SSL and hardening
A valid SSL certificate, two-factor logins for admins, unused plugins and users removed, and WordPress settings locked down.
Monthly report and small changes
A short report on what we updated and checked, plus help with small content changes when you need them.
Fix it once, then keep it safe
Hacked site repair and maintenance plans
Start with a one-off clean-up, or put your site on a care plan so updates, backups and security are handled for you.
Hacked site clean-up
Fixed quote
For a site that has already been hacked. We quote a fixed price before we start.
- Malware and backdoor removal
- Files and database cleaned
- Way in found and fixed
- Passwords and keys reset
- Google and blacklist reviews
- Plain-English report
Most popular
WordPress Care
Ask for a quote
Keeps a healthy site updated, backed up and watched.
- Safe weekly updates
- Daily off-site backups
- Malware scanning
- Uptime monitoring
- Monthly report
WordPress Care Plus
Ask for a quote
Everything in Care, with stronger protection and priority help.
- Everything in Care
- Firewall and login protection
- Hack clean-up included
- Small content changes
- Priority support
Works with WordPress sites hosted anywhere, not just ours.
Site hacked right now? Get help today.
Call 1300 797 130Prevention
Why WordPress sites get hacked
WordPress itself is secure when it is kept up to date. Almost every hack we clean up comes down to one of these:
- Outdated plugins and themes. Attackers scan millions of sites for known holes within days of them being published.
- Pirated ("nulled") themes and plugins. Free copies of paid software very often come with malware built in.
- Weak or reused passwords. Especially admin accounts without two-factor login.
- Old or forgotten sites. A test site or old install on the same hosting account can infect every site beside it.
- Cheap shared hosting. Poor isolation between accounts, no firewall and no backups to fall back on.
A care plan deals with all five. Sites on our Professional hosting and above also come with SSL and daily backups.
Hacked WordPress site FAQs
How do I know if my WordPress site has been hacked?
Common signs are redirects to spam sites, a "This site may be hacked" or "Deceptive site ahead" warning, spam pages or links you didn’t add, admin users you don’t recognise, a suspension notice from your host, or emails suddenly bouncing. Some malware only shows to visitors arriving from Google or on mobile, so a site can look fine to you and still be infected. If in doubt, call us and we’ll check.
How quickly can you fix a hacked website?
We start the same business day you contact us and stop the damage first. Most hacked WordPress sites are fully cleaned within one to two business days. Heavily infected sites, or ones with many plugins, can take longer, and we tell you before we start.
Will I lose my content, products or orders?
No. We clean the site in place, so your pages, posts, images, products and orders stay. We take a full copy before we touch anything, so nothing is lost even if something unexpected turns up.
My site isn’t hosted with Galaxy Internet. Can you still help?
Yes. We clean and maintain WordPress sites on any host. We just need access to WordPress and to your hosting. If your host is part of the problem, we can move the clean site to our Australian hosting.
Why does my WordPress site redirect to a spam site?
A redirect hack. Malicious code hidden in a plugin, theme, the .htaccess file or the database sends some visitors, often only mobile users or people arriving from Google, to scam, pharmacy or casino sites. Deleting one bad file rarely fixes it because these hacks usually leave several backdoors. We remove every copy and close the way in.
What is the Japanese keyword hack?
A common SEO spam hack that creates thousands of pages in Japanese (or pharmacy and casino pages) on your domain to rank for the attacker. You see them in Google search results for your site, often with a different title to your real pages. We remove the pages and the code that creates them, then help Google drop them from its index.
How long until the Google warning disappears?
Once the site is clean we request a review through Google Search Console. Google usually reviews within a few days, and the warning is removed when the review passes. Spam pages in search results drop out over the following weeks as Google re-crawls the site.
Can I just restore an old backup?
Sometimes, but it often fails. Malware can sit in a site for weeks before you notice, so recent backups are usually infected too, and restoring doesn’t close the hole the attacker used. They simply come back. We find and fix the way in, then clean or restore as needed.
Why did my site get hacked?
Usually an outdated plugin or theme, a pirated theme or plugin, a weak or reused password, or another old site on the same hosting account. Our report tells you exactly how yours got in and what we changed.
Do I need a care plan after the clean-up?
It’s not required, but a site that was hacked once is a known target. A care plan keeps updates, backups, scanning and monitoring going every week, so the same thing doesn’t happen again.
What should I do right now?
Call 1300 797 130 or send the form on this page. Don’t delete the site or restore old backups yet. Change your WordPress and hosting passwords if you can, and we’ll take it from there.