Site hacked?
Cleaned today.

Stop editing. Every change while a site is compromised destroys evidence and often makes the reinfection worse. Do three things and then stop: (1) put the site into maintenance mode or take it offline at the DNS or CDN layer, (2) rotate the wp-admin, hosting, and database passwords from a clean device, (3) send access to whoever is going to clean it. Do not run a plugin scanner. Do not delete files. Do not restore an old backup blind — most reinfections come from restoring the same backdoor that let them in.

Median first response 11 minutes on WhatsApp during working hours. Median MTTR for a straightforward P1 hack (malware injected in theme files, ghost admin, spam pages) is 42 minutes. Complex cases (rootkit-level compromise, cross-tenant hosting infection, months-old undetected reinfection) run 3–8 hours. You get a fixed quote before I touch anything.

Six phases. (1) Snapshot everything for evidence. (2) Identify the entry vector — which plugin, which theme, which credential, which upload directory. (3) Kill the persistence — ghost admin users, cron-scheduled reinfections, malicious mu-plugins, injected must-use PHP, poisoned wp_options rows. (4) Reinstall WordPress core, all plugins, all themes from clean sources (not from the compromised filesystem). (5) Verify a full-tree diff against known-good hashes. (6) Harden — disable file editing, lock down uploads, add integrity monitoring, patch the entry vector, submit to Google Safe Browsing for review.

No. You have to request review in Google Search Console after the cleanup. I do this as part of every hack recovery. Typical turnaround is 24–72 hours if the cleanup is genuine. If Google finds the same signature again on re-scan, they escalate — so the cleanup has to be complete before submission. That's why the six-phase workflow above exists.

Most recoveries land between $250 and $900, quoted flat before work starts. Complex multi-site or rootkit cases run higher and are quoted after triage. If a site is genuinely unrecoverable (rare — usually old backups solve it) you don't pay and I hand back a written diagnosis you can give the next person.

Two things. (1) Ongoing maintenance: weekly patch cadence, monthly integrity scan, backup verification (not just backup creation), and a 2FA rollout on every admin account. (2) Kill the class of vulnerability the attacker used, not just the instance — if it was an outdated plugin, audit every plugin's update cadence and vendor responsiveness before you keep them. Most reinfections are the same door with a new lock.