Hacked WordPress sites · UK
Hacked WordPress site? We clean it, secure it and get it back online.
Redirects to strange sites, a red browser warning, spam going out in your name, or a host that has suspended your account. Whatever you are seeing, the first steps are below and none of them needs technical knowledge. When you are ready, tell us what is happening and we take it from there.
We reply within 10 minutes. Clean-ups from £195 for a single site, with the fee agreed in writing before any work starts. Based in Nottingham, working with site owners across the UK. You keep your current hosting.
The first hour
What to do now, and what to leave alone
You do not have to fix anything yourself. These steps stop things getting worse and keep the information needed to work out what happened.
Do these first
Write down what you are seeing
Screenshot any warning, redirect or page you do not recognise, and note when you first spotted it. Two minutes now saves guesswork later.
Switch to a device and email account you trust
If your usual email or laptop might be affected too, contact your host and us from different ones.
Tell your hosting company
Ask them to keep the server logs. If visitors are being redirected or shown malware, ask them to restrict access to the site rather than delete anything. A “back soon” page hides the problem from visitors, but it does not lock an attacker out.
Find out what backups exist
Note where they are kept and the date of each one. Do not restore one yet.
Change two passwords: your hosting account and your email
Do it from the trusted device. It will not remove an attacker on its own, but those two accounts control everything else. Leave the rest until the site is clean.
Leave these for now
Do not delete files, plugins or the whole site
Deleting things removes the evidence of how the attacker got in, and it does not reliably remove their way back.
Do not restore a backup blind
The backup may already contain the problem, the gap that let them in is still open, and anything added since (orders, enquiries, posts) is overwritten.
Do not take a clean scan as the all-clear
A security plugin can help find problems, but a scan that comes back clean does not mean the site is clean.
Do not send passwords by email, chat or our form
We agree a safe way to share access after we have spoken.
If the site holds customer details
For a shop, a membership site or anything else that stores personal data, UK organisations may need to report a breach to the Information Commissioner's Office within 72 hours of becoming aware of it. You do not need to settle that in the first hour. We tell you plainly what we find, so you can decide with your insurer or legal adviser if it comes to that.
Signs to look for
Hacked, or just broken?
These are the usual signs that someone else has been in your site.
- Visitors are sent to another website, sometimes only on phones or only when they arrive from Google.
- Google shows “This site may be hacked”, or the browser shows a red warning page.
- Your host has suspended the account, or emailed you about malware or spam.
- There are admin users, pages or posts that nobody on your team created.
- Search results for your site show pages or wording you did not write.
- The site is suddenly very slow, or shows a blank page or an error, and nothing was changed.
Not every broken site has been hacked. A failed update, an expired domain or a full disk can look much the same. We check for the simple explanation first, and tell you if that is all it is.
The clean-up
How we clean and secure a hacked site
The order matters. If the way in is not found and closed, the same thing can happen again.
Agree the work first
You tell us what you are seeing. We confirm what we will do, the access we need and the fee, in writing, before we touch anything.
Take a full copy
Files, database and whatever logs your host still has are copied and kept separate, so nothing is lost and there is a record of the site as we found it.
Find how they got in
We look for the out-of-date plugin, stolen login or leftover file that let them in, and for everything they changed: added files, altered code, extra admin users, scheduled tasks and database content.
Clean it
WordPress, your plugins and your theme are replaced with fresh copies from their original sources. Your own content, uploads and database are checked and the injected parts removed. If a backup is the better route, we check it predates the break-in before using it.
Lock it down
We close the gap that was used, update what is out of date and remove what is not needed. Passwords and security keys are reset, everyone is signed out, admin access is reviewed, and login protection and firewall rules are set up to suit the site.
Test it and bring it back
We check the pages that matter to you (forms, logins, checkout) and watch for the problem returning before the site goes back to normal. If Google or your host flagged it, we ask them to review it.
We work on your current hosting. If the hosting is part of the problem we will say so, and whether to move is your decision.
When we finish
What you have at the end
- A clean, working site
- Checked on the pages and journeys that matter to you, not just the home page.
- A written summary in plain English
- What we found, how they most likely got in, what we changed, and anything we could not confirm.
- The way in closed
- The weakness that was used is fixed, with new passwords and keys and a list of who now has access.
- A fresh backup of the clean site
- Taken once the work is done, so you have a known-good copy to fall back on.
- Review requests sent
- If Google or your host flagged the site, we ask them to look again. How quickly a warning clears is up to them.
- Advice for keeping it clean
- What to keep updated, what to back up and who should have access. If you would rather someone did that for you, our WordPress care plans cover it. There is no obligation.
Price
What it costs
Clean-ups from£195for a single site.
The first conversation is free, and the work and the fee are agreed in writing before anything starts.
Who does the work
OpsHelp is based in Nottingham and works with site owners across the UK. Looking after WordPress sites and the servers they run on is our everyday work, including news sites with large audiences. The person who replies to you is the person who does the clean-up.
Not WordPress, or a wider problem with email or a server? Our security service covers those too.
From a client whose sites were infected
A friend recommended OpsHelp when some of our sites were infected with malware and our old host refused to help (although we paid them a lot of money for managing our WordPress sites). OpsHelp were extremely helpful and managed to swiftly move all of our websites to a new host without any downtime. They've been brilliant at servicing our sites ever since and are very quick to reply whenever we have any questions. We cannot recommend them highly enough!
Common questions
Questions about a hacked WordPress site
- Can I just restore a backup?
- Sometimes that is the right answer, but only once we know the backup predates the break-in and the gap that let them in has been closed. Restored blind, a backup can bring the problem straight back and overwrite anything added since.
- Will my site be offline while you work?
- It depends on what the site is doing. If it is redirecting visitors or showing them malware, it should be restricted until it is clean. If it is not, the work can often be done while the site stays up. We agree that with you first.
- Do I have to move to different hosting?
- No. We work on the hosting you already have. If the hosting itself is the weak point we will tell you, and the choice is yours.
- My host has suspended my account. Can you still help?
- Yes. Ask the host why the account was suspended and how they give access for a clean-up, then send us what they say.
- Google is showing a warning. How long until it goes?
- Once the site is clean we ask Google to review it. The warning comes off after Google has rechecked the site, and that timing is theirs, not ours.
- How long does a clean-up take?
- It depends on the size of the site and how long the attacker had access. We tell you what to expect when we agree the work, before you commit to anything.
- Will it happen again?
- No one can promise that a site will never be attacked. What we do is close the route that was used, remove what does not need to be there, and tell you what to keep up to date.
- I am not sure it is hacked. Should I still get in touch?
- Yes. A failed update or a hosting problem can look the same from the outside. Tell us what you are seeing and we will tell you which it is.
Get help now
Tell us what you are seeing.
Your site address, what is happening and when you first noticed are enough to start. Send it from an email account you trust, and leave passwords out.
- When you will hear back
- We reply within 10 minutes.
- Prefer to talk?
- Leave your number in the message and we will call you.
- Evenings and weekends
- Messages are read 24 hours a day, seven days a week.