Signs your site has been compromised
- Google or your browser shows a "This site may be hacked" or "Deceptive site" warning
- Strange redirects to unfamiliar sites, especially on mobile
- Spam pages, links, or pop-ups appearing that you didn't add
- Your host or email provider has flagged/suspended the site or mailbox
- The site is unusually slow, or admin logins keep failing unexpectedly
- You're blacklisted by Google Safe Browsing or a security scanner
What's included
- Assessment — I check the site to confirm infection, identify how it got in, and scope the clean-up.
- Clean-up — malicious files, injected code, and unauthorised admin users are removed.
- Patch the entry point — the actual vulnerability that let the infection in gets fixed, not just the symptoms.
- Confirmation — a follow-up scan confirms the site is clean, plus a blacklist removal request if Google or another authority has flagged it.
- Recommendations — a short written list of what left the site exposed (outdated software, missing backups, weak passwords, no monitoring) and a clear quote for any follow-up work or ongoing care plan, so you can decide what's worth doing next. No pressure — the clean-up is complete either way.
Why the entry point matters
Deleting infected files without finding and closing the actual vulnerability just invites reinfection. The assessment step specifically looks for how the attacker got in — an outdated plugin, a weak password, a compromised theme file — so it doesn't happen again.