Hacked WordPress or WooCommerce site? We’re based in Melbourne and clean sites for businesses anywhere in Australia. We find how they got in, clean the files and database, close the hole and ask Google to lift any warning.
Send enquiryFixed quote before work starts · Open all week, 9 to 5 AET · Content preserved · No lock-in
Australian team
Based here, working your hours, not a timezone away
projects delivered
Over 10+ years building and maintaining sites for Australian businesses
One developer, start to finish
The same person every time: no re-explaining your site
Straight answers, on your terms
We only take work we can finish. Ask us anything first: no obligation
If you’re seeing any of these, it’s worth acting today. The longer malware sits on a site, the more it can spread, and the more chance Google or your host notices before you do.
Not sure? Our guide to checking whether your WordPress site is hacked walks through each sign and how to confirm it.
Finding out your site is hacked is stressful, and the instinct is to start deleting things. Don’t. These five steps keep the evidence intact and stop things getting worse while you wait.
Strange files, unknown admin users and odd plugins are evidence. Deleting them can hide how the attacker got in, and some backdoors are written to reinstall themselves when another copy is removed. Leave everything where it is for now.
Screenshot any warnings, note the pages that redirect, the time you first noticed, and keep any emails from your host, Google or customers. Check the site on a phone using mobile data as well: some malware only shows itself to visitors arriving from Google or on mobile.
This is the one password to change straight away, and turn on two-factor login if your host offers it. The hosting account controls the files, the database and the backups, so it matters most. The rest are rotated in order during the clean-up.
A restore overwrites the evidence and leaves the hole that let them in wide open. The backup may also be infected already. Do find out what backups exist (at your host, in a plugin, off-site) and when they were taken, so we can use them if they’re clean.
Your host may have already noticed, suspended the site or kept access logs that show what happened. If they’ve taken the site offline, that’s fine: it stops the infection reaching visitors while it’s cleaned. Then send us what you’ve noted.
Prefer to do the clean-up yourself? Read our step-by-step guide to fixing a hacked WordPress site, or let us clean it for you.
Removing the visible spam is the easy part. A proper clean-up is nine steps, and you get a written summary at the end: what we found, how they got in, what we changed and what we’d recommend next.
Before we change anything, we take a full copy of the files and database exactly as they are. It’s a record of what happened, and a rollback point if anything in the clean-up ever needs to be undone.
Most infections start with one of a few things: an outdated or nulled (pirated) plugin or theme, a stolen admin password, a compromised hosting account, or a vulnerable form. We use file dates, the plugin list and your host’s logs where they exist to work out which. Cleaning without finding the entry point is how a site gets reinfected a week later.
We work through WordPress core, every plugin and theme, and the uploads folder, which should only hold images and documents but is a favourite hiding place for backdoor scripts. Injected code, backdoor files and fake plugins come out.
Malware doesn’t only live in files. We search posts, pages, settings and widgets for injected scripts, hidden spam links and redirect rules, and check the user list for administrator accounts nobody on your team created.
Rather than trusting a file we’ve cleaned, we replace WordPress core and each plugin with fresh copies from the official source. Nulled plugins are removed, and we’ll tell you what the licensed version costs if you still need it.
WordPress admin accounts, the hosting control panel, the database, SFTP, and the security keys and salts in wp-config.php. Changing the salts signs everyone out, including any session an attacker still has open.
Whatever let them in gets closed: the vulnerable plugin updated or replaced, the form protected, old accounts removed, or your host brought in if the problem sits on their side.
If Google flagged the site, we request a review through the Security Issues report in Google Search Console, which is what clears the Safe Browsing warning Chrome and other browsers show. Google makes the decision once it has re-checked the site.
If the site was used to send spam, your domain or server can land on email blocklists and your own invoices start going to junk. We check the main blocklists and your SPF, DKIM and DMARC records, and help with delisting requests.
We don’t just remove the malware. We close the hole that let it in, then keep an eye on the site so a repeat is caught early.
Malware removal happens entirely online, so where your business is makes no difference to how quickly we can start. We’re based in Melbourne and work with businesses in Sydney, Brisbane, Perth, Adelaide and everywhere else in Australia, from capital cities to regional towns.
We’re open all week, 9 to 5 AET. If you’re in a different time zone, allow for the difference when you contact us. Work outside those hours can be arranged at the after-hours rate below.
To clean a site we usually need a WordPress administrator login and access to your hosting account, or SFTP and database details. We’ll show you how to create separate logins for us so you never have to hand over your own password, and you can remove them once we’re done.
Cleaning a site fixes today. Hardening makes a repeat less likely, and monitoring means you hear about it quickly if one happens.
Every clean-up includes patching the way they got in. Beyond that, our WordPress security service covers the wider hardening: removing plugins and themes you no longer use, two-factor login for administrators, user roles with only the access each person needs, file editing switched off in the dashboard, and sensible file permissions.
A firewall stops a lot of automated attack traffic before it reaches WordPress. We set up and tune Wordfence inside the site, and Cloudflare in front of it for DNS, caching and bot filtering.
Sites tend to get reinfected the same way they were infected the first time: updates stop, a plugin falls behind, and a new vulnerability is published. Our WordPress care plans include updates, weekly off-site backups and monitoring, so when something changes on the site, we’re the ones who notice and respond.
Every job starts with a fixed quote, so you know the cost before any work begins. If we find something the quote didn’t cover, we stop and talk to you before going further.
The full clean-up described above: backup, entry point, files, database, clean copies, passwords, patching, Google review and blocklist checks. Larger or more deeply infected sites are quoted higher, before work starts.
Get help with a hacked siteNot sure it’s a hack? We investigate, tell you what’s actually wrong and give you a fixed quote for the fix. Useful when the symptoms are odd or several problems have turned up at once.
Book a diagnosticFor when the site has to be worked on today: it’s taking orders, sending spam or showing a Google warning to every visitor. Same-day work happens within our hours, open all week, 9 to 5 AET.
Ask about todayFor work outside 9 to 5 AET, on weekends or public holidays. Get in touch and we’ll confirm whether we can start; this is arranged with you, not an always-on emergency line.
Arrange after-hours workSame-day and after-hours rates cover starting the work outside the normal queue; your fixed quote shows the full cost of the clean-up before we begin. Want ongoing protection afterwards? See our care plans.
If your store has been hacked, checkout and customer data come first. Our WooCommerce emergency support looks at payment gateways, order flow and injected card-skimming scripts alongside the clean-up, so you can start trading again safely.
WooCommerce emergency supportA white screen, a 500 error or a “critical error” message is more often a plugin conflict, a failed update or a hosting problem than malware. If there are no signs of a hack, start with our help for a WordPress website that’s down.
Website down helpTell us what you’re seeing and we’ll reply the same business day with next steps and a fixed quote. Melbourne-based, working with businesses across Australia.
Get help nowHacked WordPress site? Melbourne-based, we remove malware for businesses across Australia. Fixed quote before work starts. Clean-up from $299.
Get in touchEvery CloudyWP project runs the same way, whether it is a one-page site or a store with a thousand SKUs. Here is exactly what happens.
A single scoping call, then a written plan: what gets built, what it costs, and when it ships. No discovery-phase invoices, no moving targets.
48 hrs to your quote
Custom WordPress or Shopify on clean code you own outright. Every build ships fast, passes Core Web Vitals, and is handed over documented.
95/100 average PageSpeed
Your site talks to the tools you already run: CRM, invoicing, email, stock. The repetitive admin stops being someone's job and starts running itself.
15 hrs saved every week
