Remove WordPress Virus
Unknown redirects, new user accounts, warning messages or blocked access may indicate malware in WordPress. I examine the installation, remove identified manipulations and secure the identified access path.
WordPress security and technical support
★★★★★ 5,0 on Google
- Response within 4 hours
- Restoration within 6 hours; half price if exceeded
- Cleanup €280 net at a fixed price
- Money-back guarantee
Report an emergency
I will get back to you within 4 hours.
Typical indications of malicious code
The following anomalies can be caused by malware or by a technical error. An examination of files, the database and logs clarifies the cause. You can find the technically oriented description of the service at Remove WordPress malware.
WordPress access no longer works
A correct password is rejected or the user account suddenly has fewer permissions. In addition to technical errors, an unauthorized change may also be the cause.
Unknown user accounts are present
New administrator accounts or unknown email addresses should be checked. As far as secure operation permits, suspicious accounts remain in place until the current state has been secured, so that times and changes can be traced.
Plugins or themes are unknown
Unknown extensions can be regular components, remnants of previous work or malware. I check their origin, files and activation time before entries are removed.
Deleted files reappear
If a removed file is created again, another process is usually active. This could include scheduled tasks, modified system files, or additional access points, for example.
Visitors are redirected to external sites
Redirects may occur only on certain devices, from certain referrer pages, or during individual visits. As a result, the manipulation can sometimes go unnoticed during a normal check of the homepage.
Browser or search engine displays a warning
A security warning in the browser, in search results or in Google Search Console indicates that harmful content has been detected. After cleanup, a repeat review can be requested.
Foreign subpages appear on Google
Unknown search results with foreign terms or characters may originate from manipulated files or database entries. This content is often not visible in the WordPress backend.
Emails are rejected or classified as spam
If the server sends unauthorized messages, the IP address or domain may end up on blocklists. Where there are corresponding indications, the examination therefore also includes mail scripts, scheduled tasks and relevant logs.
The host has blocked the website
Hosting providers may temporarily disable a flagged installation. Depending on the provider, reactivation requires completed cleanup and technical documentation.
Malware can also be present without any visible disruption. A technical examination is particularly useful if there is a warning message, an unknown access point, a suspicious file or a specific security notice.
Why an update alone is not always enough
Attackers exploit outdated software, compromised access credentials and faulty configurations, among other things. An update can close a known vulnerability, but it does not remove files, user accounts or database entries that were previously modified.
After a specific suspicion, the integrity of the installation should therefore also be checked and the access path traced.
The Review and Cleanup Process
Request and Initial Assessment
You describe the symptoms observed and the access details available. I assess the case and explain whether a review is advisable first or whether cleanup can begin immediately.
Provide Required Access
For the technical work, I generally need SFTP or SSH, database access and a WordPress administrator account. Your company and customer data will be treated confidentially.
Secure the Current State
Before making the first change, I back up the files and database. This preserves the initial state, content, orders and traces relevant to the analysis.
Technically Inspect the Installation
I check WordPress files, the database, user accounts, scheduled tasks and available logs. The findings document detected manipulations and, where traceable, the access route.
Remove Malicious Code
Modified standard files are replaced with clean originals. Custom content and modifications are cleaned up selectively. Unauthorized accounts, malicious tasks and detected backdoors are removed.
Secure the Access Route and Hand Over the Results
I secure the identified access path and renew relevant passwords and security keys. You will receive a summary of the work. If desired, I can also assist with the repeat review by Google or the host.
Services and prices
Malware scan
plus VAT · one-time
- Assessment of files, database and server configuration
- Analysis of available access logs
- Written report with documented findings
- Recommendations for the next technical steps
If you commission the cleanup afterwards, the 50 € will be fully credited.
Cleanup
plus VAT · fixed price, scan included
- Technical assessment included in the price
- Removal of the identified malicious code
- Restoration of normal operation
- Securing the identified access route and renewing relevant access credentials
- Basic hardening of the WordPress installation
- Technical report for the insurance company on request: €200 net
Ongoing support
per month, plus VAT.
- Controlled updates for WordPress, plugins and themes
- Regular checks for malicious code
- Continuous checks for newly reported vulnerabilities
- Cleanup included in the monthly fee during the support period
Further terms and conditions:
- All prices are plus 19 % VAT.
- For work on Saturdays, Sundays or public holidays, a one-time weekend flat rate of €100 is charged.
- The agreed response and restoration times apply Monday to Friday from 8 a.m. to 8 p.m.
- The restoration period begins as soon as all required access credentials are available.
- I will clarify the effort required for multiple websites in one installation, multisite systems and WooCommerce shops with ongoing orders before starting. Additional costs will be agreed before commissioning.
Binding Terms
€280 Fixed Price
The cleanup costs €280 net for the scope of services described. The technical review is included.
6 hours – or half price
As soon as all required access details are available, the website will be cleaned up and made available again within six hours. If it takes longer, the price is reduced by half. This commitment applies Monday to Friday from 8 a.m. to 8 p.m.
Money-back guarantee
If the cleanup or restoration of regular operation is unsuccessful, I will refund the cleanup fee paid.
Required Access
A complete review covers files, the database and server configuration. For this, I generally need the following access details:
- SFTP or SSH access to the webspace
- Access to the database, for example via phpMyAdmin
- An administrator account in WordPress; if access is blocked, the database can be used
- Access to the hoster's customer panel, if DNS or server settings need to be adjusted
If you are missing individual access credentials, I will support you in identifying the appropriate access details with the hosting provider. Once completed, relevant passwords and WordPress security keys will be renewed. Temporarily created accounts can then be removed again.
If the website no longer loads
Even in the event of a blank page, a 500 error, a database error or a hosting provider suspension, an examination via SFTP or SSH is possible.
Secure the current state as far as possible before making your own changes. Rebuilding the site or restoring a backup can overwrite content and traces that are important for analysing the causes.
Frequently asked questions about cleanup
What does “virus” mean for a WordPress website?
The term “virus” is generally used as an umbrella term for websites. Technically, this often involves modified files, malicious database entries, additional user accounts or scheduled tasks on the server. A virus scan of your own computer does not examine these areas of the website.
Can malware on the website endanger visitors or computers used?
Malicious code on a website can redirect visitors or deliver harmful content. In addition, stored website access credentials on a computer in use may be affected. Therefore, existing access points and the accounts used are also taken into account when analyzing the cause.
Is a failed WordPress login an indication of malware?
A failed login can have many causes, including an incorrect password, a technical error or an unauthorized change to the account. User accounts, the database and logs show which cause is present.
How is malware distinguished from a technical error?
A blank page or a 500 error can occur after a faulty update as well as after a manipulation. The server and PHP logs, as well as the most recently modified files, help distinguish between the two.
How much do the examination and cleanup cost?
The examination costs 50 € net. Complete cleanup costs 280 € net at a fixed price; the examination fee will be credited if you subsequently commission the work. If cleanup or restoration is unsuccessful, the cleanup price paid will be refunded.
What role does a security plugin play in the cleanup?
Security plugins help with prevention and detection. To fully investigate a specific infection, I also check the file system, database, user accounts and available logs via server access.
How long does the processing take?
For standard cleanup, a turnaround time of six hours applies once all required access details are available. If it takes longer, the price is reduced by half. This guarantee applies Monday to Friday from 8 to 20. Special circumstances involving large installations, multisite systems or ongoing shop orders will be clarified before starting.
Can I perform the cleanup myself?
Reliable cleanup requires checking files, the database, user accounts, scheduled tasks and available logs. If you make changes yourself, back up the files and database first and document every step. Individual suspicious files should not be removed without checking the rest of the system.
How is a warning from Google or a hosting provider suspension lifted?
After cleanup, a new security review can be requested in Google Search Console. I can take care of this step on request. Google decides how long the review takes and what the outcome is. In the event of a hosting provider suspension, I will submit the required technical documentation.
Can a website be affected again after cleanup?
The access route identified as part of the analysis will be secured. One-time cleanup cannot guarantee permanent protection against new vulnerabilities. Ongoing support from 65 € net per month includes controlled updates, regular checks and cleanup during the support period.
Have suspected malicious code checked
During the free initial consultation, we clarify the symptoms observed, the available access credentials and the sensible next step. If the cause is likely to lie outside WordPress, you will receive an appropriate assessment.
I am available Monday to Friday from 8 a.m. to 8 p.m. Weekend work is available on request for a flat fee of 100 €.
Technical background: Remove WordPress malware · Common cases: WordPress hacked, Site not loading, No longer able to log in · Overview: All topics and regions
Clarify suspected malicious code
During the free initial consultation, you describe the irregularities observed and the available access credentials. I will explain whether the technical review for €50 net makes sense as a first step or whether the cleanup can begin directly.
- Technical assessment with written report€50
- Cleanup of a standard single installation€280
- Ongoing support per monthfrom €65
All prices excl. 19% VAT · Response within 4 hours, Mondays to Fridays from 8 a.m. to 8 p.m.