What a Real Hack Cleanup Actually Involves

Owners ask me a fair question before a cleanup starts: what am I actually paying for? From the outside it can look like deleting some bad files. From the inside, a proper cleanup is a methodical search of the whole property, because a hack is never just the page you can see. Here is the honest walkthrough of how I do it.

Step one: find every infection point

The visible spam page is the beginning, not the list. I go through:

• The files. Core WordPress files, themes, and plugins, compared against clean originals so altered and added files stand out.
• The database. Redirects, injected content, and rogue settings like to live here, where file scans miss them.
• The admin users. Every account gets checked. Fake administrators are how hackers stroll back in.
• Scheduled tasks. Cron jobs on the server can quietly rebuild an infection after every file is cleaned. Miss one and the site is dirty again by morning.
• The uploads folder and odd corners. Places where executable files have no business being.

Step two: remove, replace, and close the door

Infected core and plugin files do not get patched, they get replaced with clean copies from the source. Malicious files get deleted. Then the important half: figuring out how they got in and closing it. Usually it is an outdated plugin, a theme nobody maintains, or a weak password. Leaving that open turns a cleanup into a subscription the hacker holds.

Passwords get reset after the cleaning, not before, in the right order: hosting, WordPress admins, database, FTP. Reset them before and the infection just watches you type the new ones.

One more thing lives on this list that owners never think of: the site itself sometimes tells on the hacker. Error logs, recently modified files, and login records all carry timestamps. Read in order, they usually show the day it started and the first file touched, and that trail matters, because an infection that began three months ago needs a wider net than one that started Tuesday.

Step three: rescan and get the warning lifted

After the work, the whole site gets scanned again, top to bottom, because the first pass teaches you where this particular hacker liked to hide. Then, if Google flagged the site, we file the review request in Search Console with the cleanup documented. The full picture of that process is in my post on what to do when Google says your site is hacked.

If you are still at the stage of wondering whether it is real, start with the signs of a hacked website, checked in order. If the signs are there, do not sit on it.

Why cleanup is a flat job, from $499

Hourly billing punishes thoroughness. The owner watches the clock, the cleaner feels rushed, and the one hiding place nobody checked gets skipped. A cleanup has a known shape, so I price it flat, from $499 depending on the size of the site and how deep it goes. You know the number before we start. It takes what it takes, the site gets scanned until it is clean, and the work carries a 30-day warranty: if the same infection comes back in that window, I clean it again. Emergencies that cannot wait go through emergency website help so we start same day.

And like everything I do, the cleanup happens live on a screen share while you watch. You see every infected file I find, every account I question, every door I close. No black box, no trust me. When your site is clean, you will know it is clean, because you watched it happen.