An infected WordPress site shows symptoms you cannot ignore: redirects to foreign sites, pop-up ads, spam subpages in Google, the "This site may harm your computer" warning, or account suspension by the hosting provider. At such moments a fast, orderly response matters: isolation, password changes, scanning, cleaning files and database, hardening the site and notifying Google. WordPress malware removal usually costs from 400 PLN net (simple infections) to 1,500–2,500 PLN net (extended, multi-stage compromises) — and the most expensive part is often not the repair itself, but the time the site is blocked or excluded from search results. This guide covers the full procedure — and how to prevent a repeat.
Najważniejsze: Infection symptoms: redirects, SEO spam, pop-up ads, strange admin accounts, slowdown, Google warnings and hosting suspensions. Procedure: isolate and back up → change all passwords (hosting, WP, database, FTP) → scan (Wordfence, hosting malware scan) → clean files (theme, plugins, uploads) and database (wp_options, wp_posts) → remove backdoors → harden (2FA, permissions, updates) → notify Google (Security Issues) → post-repair monitoring. Cost: from 400 PLN net, extended cases 1,500–2,500 PLN net.
How do you know the site is infected?
- Redirects — the site opens foreign content (often only for Google visitors or on mobile).
- SEO spam — subpages you did not create appear in Google's index (pharmaceuticals, casinos, links).
- Pop-up ads and strange scripts on the site.
- New administrator accounts and changes you did not make.
- Slowdown and server overload — malware often sends spam or mines cryptocurrency.
- Warnings — Google's "This site may harm your computer", blacklists, hosting emails about account suspension.
One symptom is already a signal — infections rarely "sit quietly"; they usually spread to more files and databases.
Malware removal step by step
- Isolation — if possible, put the site into maintenance mode or restrict access; pause campaigns driving traffic to infected pages.
- Forensic and working backups — a copy of the infected version (for analysis) and a copy of the "last healthy" state, if you have one.
- Change all passwords — hosting/panel, WordPress (all accounts), database, FTP/SFTP, API keys. Every professional starts here — old passwords are an open door.
- Scan — a security plugin (e.g. Wordfence, Sucuri) plus a hosting-side malware scan (many hosts offer detection).
- Clean files — WordPress core (overwrite with a clean version), theme and plugins (compare with originals), the
uploadsdirectory (web shells hidden in "images"),.htaccessandindex.phpfiles. - Clean the database —
wp_options(injected scripts and redirects),wp_posts(spam content),wp_users(unknown accounts), backdoor leftovers. - Remove backdoors — hidden accounts and files that let attackers return; without this, the infection comes back within a week.
- Harden — update everything, 2FA for administrators, login attempt limits, correct file permissions, disable file editing in the panel.
- Notify Google — Search Console > Security Issues: after the repair, request a review; remove spam URLs.
- Monitor — for several weeks watch logs, scans and the index; a returning infection means something was missed.
Why is "an antivirus plugin alone" not enough?
Security plugins help with detection, but an infection must be removed from files and the database — and that is manual work: comparing files with originals, analysing database entries, hunting backdoors. Automatic "one-click cleaning" often removes symptoms while leaving the return mechanism. That is why malware removal is a project, not a plugin installation.
How much does WordPress malware removal cost?
| Scope | Cost (net) |
|---|---|
| Simple infection (a few files, no backdoors) | from 400 PLN |
| Standard (file + database cleaning, hardening) | 600–1,200 PLN |
| Extended infection (backdoors, many accounts, SEO spam) | 1,500–2,500 PLN |
| Recovery after a Google blacklist + content rebuild | quoted after analysis |
| Ongoing security care (prevention) | from 300 PLN/month |
The cost of an infection is not just the repair: redirects damage reputation, Google lowers rankings, customers lose trust, and paid campaigns send traffic to infected pages (and burn budget).
How to prevent a repeat?
- Updates — regular, with security fixes immediately (WordPress updates).
- 2FA and strong passwords — for all administrative accounts; separate accounts for vendors.
- Minimum plugins — from maintained sources; abandoned plugins are the most common hole.
- Backups — with restore tests, stored off-server.
- Monitoring — detecting infections in hours, not weeks (WordPress administration).
- Care — packages with scans and incident response (WordPress website care).
In practice, most "de-malwaring" jobs end with implementing ongoing care — because the cause of the infection (missing updates, weak passwords) returns without it.
Frequently asked questions
How much does WordPress malware removal cost?
- Simple infections: from 400 PLN net. Standard (file and database cleaning with hardening): 600–1,200 PLN net. Extended cases with backdoors and SEO spam: 1,500–2,500 PLN net. Quotes always follow an initial analysis — the scope of infection varies widely.
Can I remove WordPress malware myself?
Simple cases (an infected plugin file, a redirect in .htaccess) are within reach of a technical person. Infections with backdoors, database spam and multiple accounts require experience — incomplete cleaning ends with malware returning. If unsure, commission the analysis.
How long is the site blocked after an infection?
Repair usually takes from a few hours to 2–3 days (depending on scale). Add the time for Google to review after the warning is removed — from a few days to a few weeks. That is why a fast response has real value.
What should I do when Google flags the site as "may harm your computer"?
After removing the infection and hardening the site: in Search Console > Security Issues, request a review. Make sure all infected URLs and redirects are removed — re-submitting after an incomplete repair prolongs the process.
Will the hosting remove malware for me?
Some hosts offer scans and assistance, but responsibility for the site's cleanliness lies with the owner. Hosting can suspend the account to protect the server — extra motivation for a fast response and prevention.
Do I need a new site after malware removal?
Usually not — if the infection was fully removed and the site hardened. A new site makes sense when the compromise was repeated or the system is so outdated it cannot be safely maintained. The decision follows an analysis, not "just in case".
Sources and tools
- WordPress News — security
- Google Search Console — Security Issues
- OWASP — web application security
- Wordfence — scanner documentation
- Google Search Central — security
👉 Has your site been infected? Describe the symptoms via the contact form or at kontakt@informatix.com.pl — analysis, cleaning, hardening and post-repair monitoring. See also WordPress development & care in my offer.
👉 Prefer prevention over repair? Check WordPress website care, WordPress administration and WordPress updates.
📖 See also: WordPress developer, WordPress website development and e-commerce store development.