My site is hacked right now. What should I do?

Tell me what you are seeing, and do not delete files or restore old backups yet, because that can destroy evidence of how the attacker got in. I triage incidents during UK business hours and tell you the next step.

Can you guarantee the site will not be hacked again?

No one can honestly guarantee that. I fix what the investigation finds, harden the setup and document what was checked and the risk that remains.

Do you need hosting access?

Usually, yes. WordPress admin access alone hides a lot. If some access is not available, the findings say what could not be checked.

What happens after recovery?

You get a hardening recommendation. Many clients move onto a care plan so updates and monitoring stay on schedule.

Does a care plan include security?

Care plans include security monitoring and updates. Cleaning up malware that was already present before the plan started is quoted separately.

WordPress Security and Recovery

WordPress security assessments and recovery when your site needs attention.

Suspicious behaviour, outdated plugins or an actual compromise can create serious business risk. I investigate the WordPress setup, identify the likely causes and recommend the safest next steps. Recovery and hardening are scoped around what the investigation finds.

Request a Security Assessment Explain an Active Incident

Security assessments and malware recovery are quoted after assessment, once I know the size of the site and what access is available.

Signs it is time

Security warnings or strange redirects. Browsers, Google or customers report something wrong with the site.
Your host has flagged the account. Suspicious files, unusual traffic or a suspended account.
Nobody has reviewed it in years. Outdated plugins, old PHP and admin accounts nobody recognises.
The problem came back. A previous clean-up did not find how the attacker got in.

Two ways to start

WordPress Security Assessment

Quoted per site, based on size and access

Access, plugin and theme review
WordPress and hosting configuration checks within available access
Review of exposed or outdated components
Backup and recovery-readiness assessment
Prioritised findings and recommendations

Malware Investigation and Recovery

Individually quoted after triage

Triage and incident scope
Safe backups and investigation
Remediation where technically feasible
Credential and access recommendations
Post-recovery validation
Follow-on hardening and maintenance recommendation

What is not included

Malware removal within the assessment price
A guarantee of finding every vulnerability
Promises that the site is completely secure or cannot be attacked again: I document what was checked and the risk that remains

Representative work

WA cafe

Security diagnosis and remediation

Securing a WooCommerce ordering site: PHP upgraded, 123 suspicious files removed and vulnerable plugins fixed while online ordering kept running.

Read the case study

Almost Everything

Rescuing a legacy WordPress setup

A seven-year-old WordPress site moved from PHP 7.4 to 8.5, its legacy theme repaired, 12 outdated plugins removed and broken enquiry forms restored without a rebuild.

Read the case study

How it works

1
Tell me what is happening
Share the website, the problem and what a good result looks like.
2
Agree the scope
A proposal with deliverables, price, assumptions and timeline before any work starts.
3
Deliver, test and hand over
Work checked against the agreed criteria, with notes on what changed.

Indicative investment

Security assessments and malware recovery are quoted after assessment, once I know the size of the site and what access is available.

A starting price is a guide, not a quote. I confirm the price after reviewing access and requirements.

Request a Security Assessment

Frequently Asked Questions

Keep exploring

Recent work

All case studies

WA Cafe: WordPress Security Audit & Malware Cleanup

Securing WA Cafe’s WooCommerce website: upgrading PHP, removing 123 suspicious WordPress files, fixing vulnerable plugins and strengthening security while keeping online ordering running smoothly.

Almost Everything: WordPress Security Audit, PHP 8.5 Upgrade & Legacy Theme Repair

Rescuing a seven-year-old WordPress setup: upgrading PHP 7.4 to 8.5, repairing a legacy Themify theme, removing 12 outdated plugins and restoring broken enquiry forms without rebuilding the site.

TQ Legal: Rebranding a Live Barrister’s Website Without Breaking It

A complete rebrand of a live barrister’s WordPress site, shipped as an additive component layer alongside the legacy theme so nothing already live ever broke. A token-driven design system, a fully editable ACF page builder and a measurable enquiry journey, all with a zero-downtime rollout.

Services

All services

Reading

All articles

Worried about your site's security?

Tell me what is happening. I will recommend the next practical step and explain how I would scope the work.