WordPress malware cleanup and recovery for Top End businesses
If your site is redirecting to spam, showing warnings or has vanished, my hacked website repair Darwin service finds the infection, cleans it out and locks the site down so it stays clean.
Some are obvious and some are sneaky
Hacks are not always dramatic. Many are designed to stay hidden so the site can be used for spam for as long as possible.
Visitors from Google land on gambling, pharmacy or scam sites instead of yours.
Chrome or Google search shows a red warning that the site may be harmful.
Searching your domain shows pages in other languages or selling things you never sold.
Unknown accounts appear in WordPress or your own login stops working.
Your hosting company has disabled the site for sending spam or using too many resources.
Mail from your domain lands in spam or is blocked because the server was blacklisted.
A few quick steps before the cleanup
Try not to panic and do not delete the site. Deleting files can destroy the clues needed to find how the hacker got in. It can also remove good content along with the bad.
Change the passwords you can reach safely, starting with your hosting account and email. Then get in touch with me with your web address and any logins you have. I can usually take a first look the same day.
If Google is showing a warning, leave Search Console as it is for now. Once the site is clean I request a review so the warning comes off as quickly as possible.
Clean, fix the hole, then harden
Cleaning the malware is only half the job. If the way in is not closed, the hack usually comes back within days.
1
I take a full copy of the infected site for evidence and scan every file and database table.
2
Malicious code, fake users and spam pages are removed and core files replaced with clean copies.
3
Out of date plugins are updated or replaced, passwords reset and file permissions corrected.
4
Google warnings are cleared, Cloudflare is set up and the site goes on a monitoring plan.
It is almost never personal
Most small business websites are not targeted by a person. They are found by automated bots that scan millions of sites for a known weakness, usually a plugin or theme that has not been updated. A local Darwin tradie site is just as likely to be hit as a big national brand.
Other common causes are weak or reused passwords, old admin accounts belonging to past staff or developers, cheap hosting shared with already infected sites and nulled premium plugins downloaded from dodgy sources.
The good news is that all of these can be prevented with regular care. That is why the Business and Elite maintenance plans include hack recovery and why I recommend one after every cleanup.
Pick the level of protection that suits your site
Ongoing monitoring catches problems early, often before visitors or Google notice anything.
$59 a month
Weekly backups, fortnightly updates and a fortnightly security scan. Good for simple brochure sites.
$99 a month
Daily backups, weekly updates and scans, uptime monitoring and hack recovery included if anything gets through.
$189 a month
Daily security scans, Cloudflare integration and link monitoring for shops and busy sites.
Some sites are not worth patching
Occasionally a hacked site is so old or so badly infected that cleaning it costs more than replacing it. If a site runs on software that can no longer be updated, the same hole will keep reopening.
In that case I will tell you straight. Your content can be rescued and moved into a fresh, secure WordPress build through a website redesign, with redirects so your Google rankings carry across.
Getting a Darwin site back on track
Can’t see your question here? Give me a call or send a message and I’ll get back to you within one business day.
Nick Fritzkowski at Website Design Darwin fixes hacked WordPress websites for Darwin and Top End businesses. He removes malware, closes the security hole, clears Google warnings and sets up monitoring so the site stays clean. Work is done remotely, so no visit is needed.
A hacked Darwin website can usually be assessed the same day it is reported, with most cleanups finished within one to two business days. Badly infected or very old sites take longer. Some are better rebuilt. I will give you a clear timeframe after the first look.
A Darwin website that redirects to spam when clicked from Google has almost certainly been hacked with a conditional redirect. The malware only triggers for search visitors, so the owner often sees a normal site. It needs a proper file and database cleanup to remove.
Hack recovery is included in the Business plan at $99 a month and the Elite plan at $189 a month for Northern Territory websites I maintain. Sites on the Basic or Essentials plans and sites not on a plan at all get a quote for the cleanup first.
Google will remove the warning on a hacked Palmerston website once the site is clean and a review is requested through Search Console. Reviews usually take from a day to a few days. I handle the review request as part of the repair.
A hacked Top End website can sometimes be restored from a backup taken before the infection, which is quicker than a full cleanup. The weakness that let the hacker in still has to be fixed, otherwise the same infection is likely to return.
The best way to stop a Darwin website getting hacked again is to keep WordPress, themes and plugins updated, use strong unique passwords and remove old admin accounts. A maintenance plan with security scans handles this for you, starting at $19 a month.
Send me your web address and a quick description of what you are seeing and I will take a look as soon as possible.
