Technical Assistance with a Security Incident

Remove WordPress malware

Redirects, security warnings, unknown administrator accounts or locked access may indicate a compromised WordPress installation. I examine files, the database and server configuration, remove identified malicious code and secure the access route identified.

Elias Arndt, WordPress expert from Schleswig
Elias Arndt

WordPress security and technical support
★★★★★ 5,0 on Google

  • Response within 4 hours
  • Restoration within 6 hours; half price if exceeded
  • Cleanup €280 net at a fixed price
  • Money-back guarantee
0157 57244734
Fill out the form

Report an emergency

I will get back to you within 4 hours.

Possible Signs of a Compromise

The following anomalies may be due to malware or a technical error. A technical review clarifies the cause and scope of the issue. You can find an easy-to-understand description at Remove WordPress Virus.

You can no longer access the backend

A correct password is rejected or the role of a user account has been changed. The cause may be a technical error or an unauthorized change.

Administrators you never created

Unknown accounts with administrator rights should be reviewed and placed in a timeline. Before removing them, I secure the current state so that relevant changes remain traceable.

Unknown plugins or themes

Unknown extensions may be legitimate components, outdated remnants or malicious code. Their origin, files and activation time must be reviewed before deletion.

Files keep coming back

If removed files are created again, another process is usually active. Possible causes include scheduled tasks, altered system files or additional access points.

Visitors end up elsewhere

Manipulated redirects may appear only on certain devices, from specific referring pages or during individual visits. As a result, they can go unnoticed during a normal website check.

Google is warning about your site

Warnings in the browser, search results or Google Search Console indicate detected harmful content. After cleanup, a new review can be requested.

Foreign subpages in the Google index

Unknown search results containing foreign terms or characters may originate from manipulated files or database entries that are not visible in the WordPress backend.

Your emails are no longer getting through

Unauthorized mail sending can cause an IP address or domain to end up on blocklists. If there are indications of this, I check mail scripts, scheduled tasks and available logs.

The hoster has shut it down

Hosting providers may temporarily deactivate suspicious installations. Depending on the provider, reactivation requires completed cleanup and technical documentation.

Malicious code can be present without any visible disruption. A review is particularly advisable if there is a security warning, an unknown change or a specific suspicion.

Why an update alone is not always enough

Attackers use outdated software, compromised access credentials and incorrect configurations, among other things. An update can close a known vulnerability, but it does not remove files, accounts or database entries that were previously altered.

After a specific security incident, the integrity of the installation should therefore also be checked and the access route traced.

Have your site checked now – 50 €

The Review and Cleanup Process

1

Request and Initial Assessment

You describe the symptoms observed and the access details available. I assess the case and explain whether a review is advisable first or whether cleanup can begin immediately.

2

Provide Required Access

For the technical work, I generally need SFTP or SSH, database access and a WordPress administrator account. Your company and customer data will be treated confidentially.

3

Secure the Current State

Before making the first change, I back up the files and database. This preserves the initial state, content, orders and traces relevant to the analysis.

4

Technically Inspect the Installation

I check WordPress files, the database, user accounts, scheduled tasks and available logs. The findings document detected manipulations and, where traceable, the access route.

5

Remove Malicious Code

Modified standard files are replaced with clean originals. Custom content and modifications are cleaned up selectively. Unauthorized accounts, malicious tasks and detected backdoors are removed.

6

Secure the Access Route and Hand Over the Results

I secure the access route identified and renew relevant passwords and security keys. You receive a summary of the work performed. Upon request, I can also assist with a new review by Google or the hosting provider. A technical report for insurance purposes is available for an additional fee.

Services and prices

Malware scan

50 €

plus VAT · one-time

  • Assessment of files, database and server configuration
  • Analysis of available access logs
  • Written report with documented findings
  • Recommendations for the next technical steps

If you commission the cleanup afterwards, the 50 € will be fully credited.

Fixed price

Cleanup

280 €

plus VAT · fixed price, scan included

  • Technical assessment included in the price
  • Removal of the identified malicious code
  • Restoration of normal operation
  • Securing the identified access route and renewing relevant access credentials
  • Basic hardening of the WordPress installation
  • Technical report for the insurance company on request: €200 net
Money-back guarantee: If the cleanup or restoration is unsuccessful, the cleanup fee paid will be refunded.

Ongoing support

from €65

per month, plus VAT.

  • Controlled updates for WordPress, plugins and themes
  • Regular checks for malicious code
  • Continuous checks for newly reported vulnerabilities
  • Cleanup included in the monthly fee during the support period

Further terms and conditions:

  • All prices are plus 19 % VAT.
  • For work on Saturdays, Sundays or public holidays, a one-time weekend flat rate of €100 is charged.
  • The agreed response and restoration times apply Monday to Friday from 8 a.m. to 8 p.m.
  • The restoration period begins as soon as all required access credentials are available.
  • I will clarify the effort required for multiple websites in one installation, multisite systems and WooCommerce shops with ongoing orders before starting. Additional costs will be agreed before commissioning.

Binding Terms

€280 Fixed Price

The cleanup costs €280 net for the scope of services described. The technical review is included.

6 hours – or half price

As soon as all required access details are available, the website will be cleaned up and made available again within six hours. If it takes longer, the price is reduced by half. This commitment applies Monday to Friday from 8 a.m. to 8 p.m.

Money-back guarantee

If the cleanup or restoration of regular operation is unsuccessful, I will refund the cleanup fee paid.

Required Access

A complete review covers files, the database and server configuration. For this, I generally need the following access details:

  • SFTP or SSH access to the webspace
  • Access to the database, for example via phpMyAdmin
  • An administrator account in WordPress; if access is blocked, the database can be used
  • Access to the hoster's customer panel, if DNS or server settings need to be adjusted

If you are missing individual access credentials, I will support you in identifying the appropriate access details with the hosting provider. Once completed, relevant passwords and WordPress security keys will be renewed. Temporarily created accounts can then be removed again.

If the website no longer loads

Even in the event of a blank page, a 500 error, a database error or a hosting provider suspension, an examination via SFTP or SSH is possible.

Secure the current state as far as possible before making your own changes. Rebuilding the site or restoring a backup can overwrite content and traces that are important for analysing the causes.

Call now

Frequently asked questions about cleanup

Can I remove the malware myself?

Reliable cleanup requires checking files, the database, user accounts, scheduled tasks and available logs. If you make changes yourself, back up the files and database first and document every step. Individual suspicious files should not be removed without checking the rest of the system.

Security plugins help with prevention and detection. To fully investigate a specific infection, I also check the file system, database, user accounts and available logs via server access.

A rebuild may make sense if the installation is no longer economically feasible to restore. Before making this decision, content, orders, forms and existing integrations should be backed up and the access route clarified. Otherwise, the same vulnerability could also affect the new installation.

For standard cleanup, a turnaround time of six hours applies once all required access details are available. If it takes longer, the price is reduced by half. This guarantee applies Monday to Friday from 8 to 20. Special circumstances involving large installations, multisite systems or ongoing shop orders will be clarified before starting.

After cleanup, a new security review can be requested in Google Search Console. I can take care of this step on request. Google decides how long the review takes and what the outcome is. In the event of a hosting provider suspension, I will submit the required technical documentation.

An existing clean backup can make restoration easier, but it is not a prerequisite. I will check whether the backup date is suitable. If no usable backup is available, standard components will be replaced and individual content will be selectively cleaned.

Whether a reporting obligation exists depends on the individual case and the data that may be affected. If personal data may have been accessed, the incident should be promptly assessed from a data protection law perspective. I provide the technical information on the findings; legal advice is not part of the service.

The access route identified as part of the analysis will be secured. One-time cleanup cannot guarantee permanent protection against new vulnerabilities. Ongoing support from 65 € net per month includes controlled updates, regular checks and cleanup during the support period.

Yes. The technical examination and cleanup are carried out remotely and are therefore possible nationwide. Coordination takes place by telephone or in writing.

You will receive a written report stating the scope of the examination and the irregularities identified. If no malicious code is found, the charge remains 50 € net. The report contains information on sensible further technical checks.

Have a security incident checked promptly

During the free initial consultation, we clarify the symptoms observed, the available access credentials and the sensible next step. If the cause is likely to lie outside WordPress, you will receive an appropriate assessment.

Call now: 0157 57244734
Emergency form

You can reach me Monday to Friday from 8 a.m. to 8 p.m. Weekend assignments are available on request for a flat fee of €100.
Easy-to-understand description: Remove WordPress Virus · Related cases: Remove Malware, Foreign Pages in the Index, Secure WordPress · Overview: All Topics and Regions