Hacked Site Rescue
Hacked website repair, any platform, not just WordPress.
PixelRidge Web cleans hacked websites and web apps on any platform, including WordPress. We find how the attacker got in, remove the malware, backdoors, hidden admin users and SEO spam pages, recover a hijacked domain or DNS, clear Google's hacked-site warnings, and harden the site so it doesn't happen again. If the old setup can't be trusted, we move it to safer hosting or rebuild it on accounts you own.
Signs of a hack
How to tell your site was hacked.
Strange results in Google
A site: search for your domain shows Japanese, pharmacy, casino or replica-goods pages you never made.
Visitors sent somewhere else
People arriving from Google or on phones land on a scam or adult site, while you see your normal site.
Warnings from Google or your browser
"This site may be hacked", "Deceptive site ahead" or a Security Issues message in Search Console.
Accounts and files you didn't add
New admin users, a new owner in Search Console, unknown plugins, or PHP files in your uploads folder.
Your host suspended the site
The hosting company found malware or spam being sent from your account.
Domain or email stopped working
DNS records changed, the domain moved to another account, or your email is marked as spam.
What we clean
Any platform, including WordPress.
Malware and backdoors
Infected files, injected scripts and the hidden backdoors attackers leave so they can come back after a quick clean-up.
SEO spam and the Japanese keyword hack
Thousands of auto-generated spam pages, often shown only to Google (cloaking), so the owner never sees them.
Spam redirects
Code that sends visitors from search or mobile to scam sites, hidden in files, the database or .htaccess.
Domain and DNS hijacks
Getting the domain back through the registrar's recovery process, restoring DNS and email records, and locking the account.
Google Search Console clean-up
Removing attacker-added owners, asking Google to drop spam URLs and requesting a review once the site is clean.
Hardening
Updates, removing unused plugins and themes, new passwords and two-factor login everywhere, file permissions and security headers.
How it works
Five steps, from first reply to a clean Google listing.
Step 1
Reply and contain
We reply within 2 working days with next steps and a fixed price. First we back up the site as it is and lock every account with new passwords and two-factor login.
Step 2
Find the way in
We check files, database, users, plugins and Google results to map the damage and find how the attacker got in. No findings, no fee: if we find no sign of a hack, you don't pay for the check.
Step 3
Clean
We remove malware, backdoors, hidden admin users, spam pages and redirects, and recover a hijacked domain or DNS.
Step 4
Close the hole and harden
We fix what let the attacker in, update or remove unsafe plugins and code, and add security headers and tighter permissions.
Step 5
Recover in Google
We clean up Search Console, ask Google to drop spam URLs and request a review so the hacked-site warning comes off.
30-day reinfection promise
If the site is hacked again within 30 days of our clean-up through the same way in we closed, we clean it again at no charge. This applies when the clean-up included hardening and the passwords and two-factor login we set up are still in place. A new hole, such as a plugin added later, is quoted as new work.
If the old setup can't be trusted
Some sites keep getting hacked because of old hosting, abandoned plugins or code nobody maintains. Once the site is clean, our Rescue & Migration service can move it to safer hosting or rebuild it on accounts you own, keeping your content, email and search rankings. Afterwards, Launch Care keeps updates, backups and monitoring running every month.
Clean-up items start at $30. Try our pricing calculator for an estimate. Every clean-up gets a fixed written price before paid work starts.
Questions
Common questions about hacked websites
My website was hacked. What should I do first?
Don't delete everything, and don't pay anyone who contacts you out of the blue offering a fix. Take a full backup of the files and database as they are now, change the passwords for your hosting, site admin, database, FTP or SFTP and email, turn on two-factor login, and check for admin users or Search Console owners you don't recognise. Then find how the attacker got in before cleaning up, or the hack usually comes back.
How do I know if my website has been hacked?
Common signs are spam pages in Google when you search site:yourdomain.com, visitors being redirected to other sites, a "This site may be hacked" label in search results, browser security warnings, admin users or files you didn't add, a suspension notice from your host, or changed DNS records.
What is the Japanese keyword hack?
An SEO spam hack that creates thousands of pages in Japanese, usually selling fake brand goods, on your domain. Attackers often add themselves as an owner in your Google Search Console so they can control how the pages are indexed. Cleaning it means removing the pages and the code that generates them, removing the rogue Search Console owner, and asking Google to drop the spam URLs.
Why does Google show spam for my site when my site looks normal to me?
This is called cloaking. The hacked code checks who is visiting and shows spam only to Google's crawler or to visitors arriving from search, so you see a normal site when you type the address. Search Console's URL Inspection tool shows the page the way Google sees it.
Can you clean a hacked WordPress site?
Yes. WordPress hacks usually come in through an outdated or nulled plugin or theme, or a reused password. We replace core files with clean copies, check every plugin, theme and upload for injected code, remove rogue users and database spam, and update or remove what let the attacker in. We also clean sites and apps built on other platforms, such as custom PHP, Next.js, React and Supabase.
Will restoring a backup fix a hacked site?
Sometimes, but often not on its own. The backup may already contain the backdoor, and restoring does not close the hole the attacker used. A backup from before the hack is a good starting point, as long as the entry point is also fixed and every password is changed.
How do I remove the "This site may be hacked" warning from Google?
Clean the site completely first, then open the Security Issues report in Google Search Console and request a review, explaining what was fixed. Google removes the warning once it confirms the site is clean. Spam URLs that are gone can be removed from results faster with the Removals tool.
My domain or DNS was hijacked. Can you help?
Yes. We help you through your registrar's account recovery, restore your DNS and email records, and then lock the domain with two-factor login and a transfer lock. Getting a stolen domain back depends on the registrar's process and your proof of ownership, so the sooner you start, the better.
Should I move to new hosting or rebuild the site after a hack?
Only if the current setup can't be trusted or keeps getting hacked. Many sites just need a proper clean-up and hardening. If moving or rebuilding makes more sense, our Rescue & Migration service moves the site to safer hosting or rebuilds it on accounts you own, keeping your content and search rankings.
How much does hacked site repair cost?
Each part of the clean-up is priced separately, so you only pay for what your site needs. Tick the items in our price calculator for an instant estimate. We confirm a fixed price in writing before paid work starts.
What if the site gets hacked again after you clean it?
If it happens within 30 days through the same way in we closed, we clean it again at no charge. This applies when the clean-up included hardening and the passwords and two-factor login we set up are still in place.
Do you only fix WordPress sites?
No. We clean hacked sites and apps on any platform: WordPress, custom PHP, Next.js, React, Supabase and sites on other hosts. If your site is not on WordPress, we can still clean it.
Do you need my passwords?
Never send passwords by email. We arrange access through your host's or platform's own user invites, or a temporary account you remove afterwards. We only work on sites you own or are authorised to manage.
Tell us what you see
Share the site's address and what is happening: spam in Google, redirects, a warning or a host suspension. We reply within 2 working days with next steps and a fixed price. Please don't send passwords.