VI

Hacked · Blacklisted · Slow

Your WordPress site is broken. I find out why, then fix it.

Malware cleanup, blacklist recovery and speed work — starting with a read-only audit, so you see what is actually wrong before anything is touched. You get the written report whether or not you hire me for the fix.

Ask for a free diagnosis See the work first

  • Read-only audit before any change
  • Fixes made on a copy, never blind on production
  • Written report either way
wp-audit.sh 
$ ./wp-audit.sh -p /var/www/html
[CRITICAL] 1 core file differs from the official release
             wp-includes/load.php
[CRITICAL] Executable PHP inside wp-content/uploads
             uploads/2026/03/wp-cache-min.php
[CRITICAL] Image file containing PHP code (polyglot)
             uploads/2026/03/sunset.jpg
[CRITICAL] .htaccess directives typical of a backdoor
             php_value auto_prepend_file ...
[HIGH    ] Unexpected file inside wp-admin/
             wp-admin/wp-admin.php
[OK      ] salts unique · registration closed · xmlrpc off

CRITICAL 6   HIGH 3   MEDIUM 5   LOW 3   OK 5
Real wp-audit.sh output from a lab copy infected on purpose — verbatim from the case study.
0files changed during an audit — the tool only reads
6CRITICAL findings caught on the lab copy
2.9smobile LCP after the work, down from 4.7s

Three things, done properly

from$150

Security audit & report

A read-only scan of the whole install — core files against official checksums, uploads, cron, users, headers — then every finding opened by hand before it reaches your report. False positives are removed, not shipped.

About 2 hours. Stands alone, and the price comes off the cleanup if you go ahead.

from$250

Malware cleanup & hardening

The entry point gets closed first, then the files — the other order is why “cleaned” sites are reinfected inside a week. Persistence goes too: cron events, auto_prepend_file, rogue admins. I re-run the audit afterwards and attach the clean output.

3–6 hours. Add 50% for a 24-hour emergency turnaround.

from$250

Speed optimization

A Lighthouse baseline first, because the thing costing you the seconds is rarely the thing people assume. Then the fixes, then the same measurement again — numbers you can re-run yourself the day after I hand over.

4–8 hours. Reported as Core Web Vitals, not as a list of techniques.

Maintenance retainer — $60–150/month. Updates tested on staging before they touch production, a weekly scan, off-site backups, and a restore actually tested every quarter. This is the part that keeps a site out of trouble instead of pulling it back out.

Work you can read before you decide

Two write-ups with real numbers and real output. No client names, no invented before/after.

CRITICAL 6HIGH 3MEDIUM 5LOW 3OK 5

Anatomy of a WordPress webshell

An isolated copy infected on purpose, then audited. The write-up walks through how each finding was traced and removed — the shell in uploads, the cron event rebuilding it, the loader patched into core — in that order.

Read the case study →

How a job runs

  1. Read access. SFTP or SSH, plus one line of written authorisation. I do not audit what I cannot read, and I do not scan a site without the owner’s say-so.
  2. Read-only audit. Nothing is written except the report. One to five minutes of scanning, then the slow part: opening every critical and high finding by hand.
  3. The report and the plan. You see what I found and what I propose before anything changes. If the honest answer is “this needs a rebuild, not a cleanup”, you get that answer instead of a quote.
  4. The fix, on a copy. Entry point first, then infection and persistence, then hardening — with a backup I have already restored once.
  5. Proof of completion. The audit is re-run and the clean output goes to you with the handover notes.

What I will not tell you

Worth reading before you hire anyone for this kind of work, me included.

  • That your site is clean. Nobody can prove that. I will tell you exactly what I checked, what I found, and what I could not rule out.
  • That a scanner result is a verdict. base64_decode() lives in perfectly ordinary plugins. Findings are signals; a report that has not been verified by hand is worth nothing.
  • That it cannot come back. If the entry point was a plugin you must keep running unpatched, I will say so, and we will talk about what to do instead.

Start with a free diagnosis

Tell me the symptom — the redirect, the host’s warning, the Google notice, the load time — and your URL. You get a plain-language first read on what is probably happening and what it would take to fix, before any money moves. If it is something you can fix yourself in ten minutes, I will tell you that too.

    Scroll to Top