WordPress Malware Removal: a nulled theme or plugin was

When the request is wordpress malware removal, we look at the live site first. The check we expect to matter is: a nulled theme or plugin was installed to save a license fee.

A specific fault, not a slogan

• A nulled theme or plugin was installed to save a license fee
• The site was hacked and then only the homepage was restored
• A plugin update is months behind and the vendor is gone
• Two people share one admin password

What gets checked

If the site is already compromised, cleanup comes before the lock-down. Locking a site that still has a strange admin user just hides the problem.

• Every user with administrator rights
• A backup that is not stored only on the same account
• Whether the host or a plugin is already blocking logins
• Recently modified files outside the uploads folder

What you can send first

We need host access and a note about when the warning or the redirect started. If a backup from before that date exists, tell us. We will not trust it until we look.

Cleanup is a file list: what was added, what was changed, and what we removed. A screenshot of a green badge is not the cleanup.

If you are outside Toronto, the call is the same. We say what we found and what the work is before we change the site.

Call 905-426-1784. We look at the site and tell you what the work is before it starts. The service page for this is WordPress security.