Is your WordPress site redirecting visitors to spam, showing a "This site may be hacked" warning in Google, or suspended by your host? Have unknown admin users or pages you never created appeared? I'll remove the infection, close the hole the attacker used, and harden the site so it's much harder to break into again.

A full scan of your files and database for malware, backdoors and injected code

Removal of malicious files, spam pages, hidden redirects and unknown admin accounts

Fresh copies of WordPress core files, and of any affected plugins and themes

Finding and fixing how the attacker got in, such as an outdated plugin or a weak login

Security hardening: firewall, login protection, an SSL check and safe updates

Help getting Google and browser warnings removed

A short report on what I found, what I fixed and what to do next

You share access to WordPress and your hosting.

I back up the site before changing anything.

I clean, repair and harden it.

You get the report, plus a reminder to change all passwords.

Your WordPress admin login and hosting or SFTP access. Database access helps if your host provides it separately.