Remove malware from WordPress
Malware rarely hides where you first look. It is found in uploads, the database, configuration files or seemingly harmless plugins.
I work through each finding individually and document it in writing.
WordPress expert from Schleswig
★★★★★ 5,0 on Google
- Response within 4 hours
- Site clean again within 6 hours – otherwise you only pay half
- €280 fixed price plus VAT
- Money-back guarantee
Report an emergency
I will get back to you within 4 hours.
Where malware actually resides
The conspicuous file in the root directory is usually only the visible part. These four locations are regularly overlooked during superficial cleanup.
In the database
Injected code in posts, options or serialized fields. A file scanner sees none of this because there is no file there at all.
In the uploads directory
PHP files among images and PDFs. The directory is often omitted during cleanup because there should not actually be any executable code there.
In configuration files
Manipulated .htaccess or wp-config.php files that set redirects or load additional code without a new file being created.
In scheduled tasks
A cron entry restores deleted files within a few hours. As long as it exists, every cleanup effort is futile.
My approach
Comparison against the originals
Core, plugins and themes are compared file by file with the official originals. Every deviation becomes visible, even with cleverly disguised code.
Searching the database
All tables are searched for typical patterns and embedded code, including serialized fields that a simple search overlooks.
Analysis of the logs
The access logs show when and by what means the access occurred. Without this step, the cause remains unclear.
Removal and securing
The malicious code is removed, the entry point is closed and all access credentials are renewed. You receive the list of all locations found.
Transparent costs
Malware scan
plus VAT · one-time
- Complete inspection of files, database and server configuration
- Analysis of access logs
- Written report with all findings
- Strong IT compliance image
If you commission the cleanup afterwards, the 50 € will be fully credited.
Most frequently chosen
Cleanup
plus VAT · fixed price, scan included
- Everything from the scan
- Complete removal of malicious code
- Restoration of normal operation
- Closing the entry point, changing all access credentials
- Security measures
- Report for the insurance company (+200€)
✓ Money-back guaranteeIf I can't clean the site, you pay nothing.
Ongoing support
per month, plus VAT.
- Updates for core, plugins and themes – checked, not installed blindly
- regular malware check
- Ongoing comparison with newly reported vulnerabilities
- Malware removal included free of charge during the support period
The complete fine print:
- All prices are plus 19 % VAT.
- Orders processed on Saturdays, Sundays or public holidays cost an additional one-time 100 € weekend surcharge.
- Response and recovery times apply Monday to Friday from 8 a.m. to 8 p.m. Outside these hours, I will respond as quickly as I can, but without a guarantee.
- The time starts when I have received all the necessary access credentials – not from your first message.
- I discuss special cases such as multiple sites in one installation, WooCommerce with ongoing orders or multisite with you beforehand and tell you the price before I start.
Frequently asked questions
Why doesn't my security plugin find the malicious code?
Such plugins work with signatures of known patterns. Individually written or obfuscated code slips through the net. In addition, the plugin runs within the installation it is supposed to scan and can be disabled by an attacker with administrator privileges.
Do my contents remain intact?
Yes. Only the core, plugins and themes are replaced with clean originals. The malicious code is individually extracted from your own content, so texts, images and orders remain unchanged.
Will I receive documentation?
You receive a written list of all locations found, the suspected entry point and the period. You need this document if a report to the data protection authority is pending or an insurance company is involved.
How much does it cost?
The analysis costs 50 € net and is credited toward a subsequent cleanup. The cleanup costs 280 € net at a fixed price.
Malicious code does not disappear on its own
A call costs you nothing and takes five minutes. If it turns out to be a different problem, I will tell you that too.
Available Monday to Friday from 8 a.m. to 8 p.m. · Related topics: Remove WordPress malware · Remove WordPress virus · Foreign subpages in Google's index · Secure WordPress
Prefer a quick chat
The longer an infection remains undetected, the greater the damage usually becomes. Attackers create additional access points, manipulated pages may be marked as unsafe by Google, and domains can end up on spam blacklists. Even after the technical cleanup, it can take time for such warnings to disappear. That's why it's worth checking early whether an infection is actually present. In a short phone call, it is usually possible to assess what has happened and which next steps make sense.
- Malware scan with written findings50 €
- Fixed-price cleanup, scan included280 €
- Ongoing support, monthlyfrom 65 €
All prices plus VAT · Response within 4 hours, Monday to Friday from 8 a.m. to 8 p.m.