WordPress site hacked?
We'll help you get it back.
If your WordPress site has been hacked, fill in the short form: on weekdays between 8:00 and 18:00 we reply within 4 hours, by phone or email. After the first check you get a fixed price, and cleanup starts only when you approve it in writing. We have dealt with malware that reinstalled itself from the database, hidden plugins and fake admin accounts.
We respond within 4 hours
Monday to Friday, 8:00 to 18:00 Budapest time, by phone or email, whichever still works for you. Outside those hours, as soon as we can.Hacked-site cleanup
Experience with real attacks
We have dealt with malware that reinstalled itself from the database, hidden plugins and fake admin accounts.See example casesIs your site hacked? These are the signs.
- Chrome shows a red "Dangerous site" warning before your site loads.1
- Google search results show a warning that your site may be hacked.2
- Your site redirects visitors elsewhere, often only on mobile or only when they arrive from Google.3
- A
site:yourdomain.comsearch shows Japanese, pharma or casino pages you never created.4 - An admin user you don't recognise has appeared in WordPress.
- Your checkout shows a different card form, or a "Connect Wallet" prompt appears on a site with nothing to do with crypto.5
- Your host or Google Ads has suspended the site or your ads.
More on each sign, and on what not to do: Hacked WordPress site: symptoms and first steps
The attack is almost never personal.
Most WordPress attacks are mass and automated. Wordfence blocked more than 55 billion password attacks in 2024.6 Patchstack found that in 2025 the weighted median time from disclosure to mass exploitation was 5 hours for heavily exploited vulnerabilities.7 So the attackers were not looking for your business. They were looking for a vulnerable plugin or a leaked password. That is good news: the hole can be found and closed.
What to do now, while you wait for our reply.
Don't delete anything.
Infected files and odd users show how the attacker got in. Deleting them in a hurry removes the evidence and leaves the backdoor.
Write down what you saw, and when.
Date, time, which device, which page. Note any recent updates or installs.
Change your hosting and WordPress admin passwords
from a clean computer, and turn on two-step login where you can.8
Tell your hosting provider.
On shared hosting the infection can reach other sites in the same account.8
Don't request a Google review yet.
It only helps once the whole site is clean.9
How we recover the site.
Secure access.
We agree how you share access. We never ask for passwords by email.
A full backup before we touch anything.
We keep samples of the malware as evidence.
Diagnosis and a fixed price.
We find what is infected and how much work the cleanup is. Then you get a fixed price in writing.
Cleaning files and the database.
We compare WordPress core, the theme and plugins against the official wordpress.org packages. We remove hidden plugins, web shells, fake admins and the scheduled jobs that copy the malware back.
Closing the way in.
We check every admin account by hand, sign out every login, and update or replace the vulnerable plugin.
Checking nothing comes back.
We load the site repeatedly and scan it again.
Google review.
If Google shows a warning, we request a review in Search Console. Google says this takes from a few days to a few weeks.9
What we found on real hacked sites.
On the hacked sites we have cleaned, the attacks were built to stay hidden: a plugin hid itself from the admin, fake admin accounts used the site's own domain, and malicious scripts showed only to visitors, never to logged-in admins. In the worst case the malware lived in the database and rewrote its files within minutes of being deleted. One site ran a Web3 card skimmer.
See the example casesWhat does the cleanup price depend on?
You get the exact price in writing after the first check, and work starts only when you approve it. Four things drive it:
- how many sites share the hosting account;
- whether the malware also lives in the database or only in files;
- whether a clean backup from before the infection exists;
- whether Google shows a warning that needs a review request.
Common questions
Who can help if my WordPress site has been hacked?
nstudio can. We reply within 4 hours on weekdays between 8:00 and 18:00 after you fill in the form, and Tamás Nagy owns the cleanup. We have dealt with malware that reinstalled itself from the database, hidden plugins and fake admin accounts.
Will my site stay online during the cleanup?
It depends on whether it harms visitors. If it redirects them or could steal card data, we recommend maintenance mode while we clean it. If not, it can stay up. We decide on the first call.
Are my login details safe with you?
We never ask for passwords by email or on the form. We agree how to share access on the first call, and at the end we recommend changing every password.
Other sites share the same hosting. Are they infected too?
Possibly. On shared hosting an infection can spread to other sites in the same account.8 So we check every site on the account, and the quote shows that separately.
What if the infection comes back?
At the end of the cleanup we load the site repeatedly and scan it again to confirm nothing returns, and we close the way in.
What if the site turns out not to be infected?
Then we tell you so in writing, along with what might be causing the problem.
How long until Google removes the warning?
Google says a review takes from a few days to a few weeks, and should only be requested once the whole site is clean.9 We submit the request in Search Console.
Do I have to report the breach to the data protection authority?
If personal data may have leaked, GDPR requires notification within 72 hours of becoming aware, unless the breach is unlikely to put people at risk.10 The decision is the data controller's; this is not legal advice.
How much does hacked-site cleanup cost?
You get a fixed price in writing after the first check, and work starts only once you approve it. The price depends on how many sites share the hosting, whether the malware lives in the database, whether a clean backup exists, and whether a Google review is needed.
Sources
- Google Chrome Help: warnings about dangerous sites
- Google Search Help: "This site may be hacked"
- Google Search Central: what is a hacked site
- web.dev: fix the Japanese keyword hack
- Sucuri: SiteCheck malware trends report 2024
- Wordfence: 2024 Annual WordPress Security Report (April 2025)
- Patchstack: State of WordPress Security in 2026
- WordPress.org: FAQ, my site was hacked
- Search Console Help: Security Issues report and review requests
- GDPR, Article 33: notification of a personal data breach
Checked on 16 October 2026.