Clean up a hacked website and keep it clean
We remove the malicious code, clear the spam pages from Google and close the gap the attacker used.
In plain English.
A hack is not always obvious. Sometimes the site looks normal to you, but Google shows thousands of Japanese or pharmacy spam pages under your domain, or visitors on mobile are redirected to a scam site. Other times Chrome shows a red warning screen, or your host suspends the account.
Deleting the visible damage is the easy part. Attackers usually leave backdoors, extra admin users and scheduled tasks that let them back in a week later. We search the files, the database and the server for all of these, and compare core files against clean copies.
Once the site is clean, we deal with the fallout. That means requesting a review in Google Search Console, removing spam URLs from the index, checking your domain is off blocklists, and fixing the weakness that let the attacker in, whether that was an outdated plugin or a reused password.
It suits you if.
- Google results show spam pages you never created
- Chrome or your antivirus warns visitors away from your site
- Your host has suspended your account for malware
- Mobile visitors get redirected to other sites
- You found admin users you do not recognise
What we do.
Full file and database scan
We check every file against known clean versions and search the database for injected scripts, hidden links and rogue users.
Backdoor removal
Hidden PHP shells, often tucked into upload folders, are found and removed, along with any malicious cron jobs on the server.
SEO spam clean-up
We identify spam URLs, make sure they return the right status code, and use Search Console to request their removal from results.
Credential reset
All passwords, database credentials and WordPress security keys are changed, so stolen details stop working.
Security review request
We submit the reconsideration request in Search Console and check Google Safe Browsing until the warning clears.
Hardening afterwards
The weakness that let the attacker in is patched, and we add protections such as two-factor logins and a firewall.
How it runs.
- 01
Free call and quick look
Tell us the symptoms. We check public signs such as search results and Safe Browsing, then give you a price.
- 02
Contain the damage
We take a copy for evidence, put up a maintenance page if needed and lock out the attacker by changing access details.
- 03
Clean and patch
Malicious code is removed, core software reinstalled from trusted sources, and the original weakness fixed.
- 04
Recover your reputation
We request Google reviews, track spam pages dropping out of results and confirm warnings have been lifted.
Questions people ask.
How long does a clean-up take?
Most sites are clean within a day or two of us getting access. Google can take longer to process a security review and drop spam pages from results, often several days to a few weeks. We keep checking until it clears.
How much will it cost?
We quote a fixed price after a quick look at the symptoms and the size of the site. Heavily infected sites with large databases take longer, and we tell you that before you commit, not halfway through.
Will my rankings come back?
Removing the spam and the warning gives your normal pages the best chance of recovering. We cannot promise a ranking, but we track how traffic and indexed pages change in Search Console and report back.
Do I need to tell anyone about the hack?
If the attacker could have accessed personal data, such as customer details, you may need to report it to the ICO within 72 hours. We help you work out what was exposed so you can make that decision with the facts.
Your next chapter starts with a conversation.
Nottingham & Derby / UK-wideLet’s build
what’s next.
15 minutes with Garreth.
A real conversation about your business.