Virus & malware removal
If your WordPress has been hacked — or we detect it before you noticed yourself — we clean out the entire infection, harden the holes the attacker used, and make sure it doesn't recur.
Of course not what you want to need
But it happens. Hacked WordPress sites aren't rare — Sucuri reports that 96% of compromised websites they investigate are WordPress-based, usually through an outdated plugin. When it happens, it isn't "run three antivirus tools and hope". It takes methodical removal, and hardening of what the attacker exploited.
Signs your site might be infected
- Google Safe Browsing warning — visitors see a red "This site may harm your computer" warning.
- Search engines show strange text under your site — e.g. "buy cheap meds online" or Japanese/Chinese characters.
- Visitors get redirected to a different domain when clicking certain links.
- New admin users you didn't create showing up in WP-admin.
- Unknown PHP files appearing in wp-content/uploads, wp-content/plugins, or in the WordPress root.
- Sudden high server load — site being used as a proxy or crypto-miner.
- Hosting has shut the site down after an abuse report.
Not sure? Reach out — we'll take a look at no cost. Better to confirm everything is fine than let an infection spread.
How the cleanup works
- Isolation. We immediately take a forensic snapshot of the site before we start cleaning. That lets us go back and see what actually happened.
- Scanning. We run multiple scanners (our own + external like Sucuri and the Wordfence database) against the entire installation. This catches both known malware signatures and suspicious anomalies.
- Manual review. A human reads through the results — automated tools produce false positives, and they miss smart attackers. We walk through
wp-content/uploads, plugin files, theme files, the database, and WordPress core file signatures. - Cleanup. Malicious code is removed. Tampered core files are replaced with clean versions. Backdoors (typically base64-encoded PHP files in uploads) are removed.
- Hardening. We close the hole the attacker came through — update vulnerable plugins, change all passwords, regenerate API keys and salt keys (
wp-config.php), and tighten file permissions. - Verification. We rescan, remove the site from blocklists (Google Safe Browsing, Yandex, etc.), and monitor for 30 days for re-infection.
How long does it take?
For a typical infection: 4–24 hours from when we begin until the site is clean. For complex cases (where the attacker has been resident for a long time, or the database is tampered with across many tables) it can take up to a week.
During that time we help you communicate with Google Search Console, the hosting provider, and any payment providers that have flagged the issue.
What's included in the hardening?
- Every active plugin updated to latest version (or replaced if abandoned).
- WordPress core updated to the latest minor version.
- All user passwords regenerated and communicated securely.
- All API keys and salts in
wp-config.phpregenerated. file editingin WP-admin disabled (DISALLOW_FILE_EDIT).- PHP execution disabled in the uploads directory.
- Rate-limiting on
/wp-login.phpand XML-RPC. - Two-factor authentication enabled for admin users.
- Web Application Firewall (WAF) at the edge if the hosting permits.
What this isn't
- It's not an antivirus subscription for your local machine. This applies to your WordPress installation on the server.
- It's not a guarantee you'll never be hacked again. No system is 100% secure. But after cleanup + ongoing Oden management, the risk drops dramatically.
- It's not recovery of data the attacker deleted. That's Backup & restore — which is why we run backups before we start cleaning.
Which plans include it?
Virus and malware removal is included in Pro and Enterprise at no extra cost — as often as needed (rarely, if you have Oden from the start). For Basic customers, an emergency cleanup is billed per engagement; but since security updates already ship in Basic, the risk of infection is low.
- Basic: Cleanup as needed — one-time fee per quote.
- Pro: Cleanup included, however many times needed.
- Enterprise: Cleanup included + 30 days extended monitoring + forensic report.
What to do if you suspect an infection right now
- Don't take the site offline yourself — we need to be able to see it for diagnosis.
- Email security@oden.cam with the URL and as much info as you have (when you noticed, what you saw, anything you've already done).
- We respond within 30 minutes 24/7 and start work.