Key takeaways
- A proper malware removal service does four jobs: cleans every infected file and database entry, closes the way the attacker got in, hardens the site, and watches it afterwards.
- Cheap clean-ups often stop at “scan and delete”. They miss backdoors and rogue admin users, so the infection comes back.
- Sucuri found backdoors on 49% of the hacked sites it cleaned, and malicious admin users in 55% of infected databases.
- Before you hire anyone, ask how they find the entry point and what happens if the site is reinfected.
A proper malware removal service doesn’t just delete the files a scanner flags. It finds every piece of the infection, including hidden backdoors and fake admin accounts, then fixes the weakness that let the attacker in. Finally it hardens the site and keeps watching it. Cheap clean-ups often skip the last three steps, which is why so many sites are reinfected within weeks.
What does a malware removal service actually do?
When a website is infected, attackers rarely leave just one file behind. A typical infection includes the visible symptom (spam pages, a redirect or a warning in Google), plus the tools the attacker uses to get back in. A malware removal service is paid to find and remove all of it, not just the part you can see.
If you haven’t confirmed a hack yet, start with our checklist on has my website been hacked. If Google is already showing a warning, our guide to “this site may be hacked” explains that label.
Why do cheap malware clean-ups fail?
Sucuri’s 2023 report on the sites it cleaned shows what a quick scan tends to miss (Sucuri):
- 49.21% of compromised sites had at least one backdoor at the time of clean-up. A backdoor is a hidden file or snippet that lets the attacker back in, even after you change passwords.
- 55.2% of infected WordPress databases had malicious admin users. Delete the bad files but leave the fake admin, and the attacker simply logs in again.
- 39.1% of sites ran an outdated CMS when they were infected. Clean the site without updating it, and the same hole stays open.
There’s another trap. Patchstack found that 46% of WordPress vulnerabilities disclosed in 2025 had no fix available at the time (Patchstack). “Just update everything” isn’t always enough. Sometimes a plugin has to be replaced or removed.
Cheap clean-up vs a full clean, harden and monitor service
| Step | Quick “scan and delete” | Full clean, harden and monitor |
|---|---|---|
| Files flagged by a scanner | Removed | Removed |
| Hidden backdoors | Often missed | Hunted down by hand and removed |
| Database (posts, options, users) | Often not checked | Checked for injected code and rogue admins |
| WordPress core files | Left as they are | Replaced with clean official copies |
| Passwords and security keys | Left to you | All reset: hosting, database, admin users, keys |
| How the attacker got in | Not investigated | Found and fixed |
| Google and antivirus warnings | Left to you | Review requests sent |
| After the clean-up | Nothing | Hardening, updates and ongoing monitoring |
What should a proper malware clean-up include?
Here’s what a thorough clean-up should cover. It lines up with WordPress.org’s own guidance for hacked sites (WordPress.org).
- Snapshot the infected site. Keep a copy of the files, database and logs before changing anything. It’s the evidence for finding the entry point.
- Scan files and the database. Use more than one scanner, plus manual review of recently changed files.
- Replace core files. Swap WordPress core folders for clean copies of the same version, and check files attackers often target, such as
.htaccessand theme files. - Remove backdoors and rogue users. Search for hidden scripts, scheduled tasks and admin accounts nobody recognises.
- Reset every access point. Change hosting, SFTP, database and WordPress passwords, and regenerate the security keys so everyone is logged out.
- Close the way in. Update, replace or remove the vulnerable plugin or theme, and fix weak logins.
- Request reviews. Ask Google and any antivirus vendors that flagged the site to review it.
- Harden and monitor. Add two-factor login, tighten file permissions and keep watching for changes.
What questions should I ask a malware removal provider?
- Do you check the database and user accounts, or only files?
- How do you find out how the attacker got in?
- Will you request removal from Google and antivirus blocklists?
- What happens if the site is reinfected next month?
- Who keeps the site updated afterwards?
- Are you in Australia, and can I call a real person?
If the answers are vague, the clean-up probably will be too.
How much does malware removal cost with WMS?
Our hacked website repair is part of Maintain & Protect. A standard setup is a one-off $120, $240 or $360 + GST, depending on the plan. For a site that’s already compromised, the setup fee doubles, because we clean it before we lock it down. For example, Essentials is a $240 + GST setup, then $40 a month + GST.
From then on, your site stays on one of our website maintenance plans, so the same problem doesn’t come back. If the site has outgrown its hosting, moving it to secure web hosting in Australia is often part of the fix. For the bigger picture, read our full recovery guide for when your website is hacked.
Frequently asked questions
How long does website malware removal take?
It depends on how deep the infection goes, how many sites share the hosting account and whether clean backups exist. Getting off Google’s blocklist adds time after the clean-up. Google says reviews can take from a few days to a few weeks once you request one.
Can I remove malware from my website myself?
You can try, and WordPress.org publishes a guide. The hard part is finding everything: backdoors, rogue admin users and injected database code are designed to stay hidden. If you’re not confident reading code and server logs, a professional clean-up is usually faster and cheaper in the end.
Why did my site get reinfected after it was cleaned?
Usually because something was missed. That might be a backdoor, a fake admin user or the original weak point, such as an outdated plugin. Reinfection within days or weeks is a strong sign the first clean-up only removed the visible symptoms.
Will a security plugin remove malware for me?
Security plugins are good at spotting known malware, and some can remove it. But a plugin runs inside the hacked site, so it can be fooled or disabled. It also can’t tell you how the attacker got in. Use one as part of a clean-up, not as the whole clean-up.
Do I lose my content when malware is removed?
Not with a careful clean-up. The aim is to remove only what the attacker added and keep your pages, products and orders. Taking a full snapshot before any changes protects you if something goes wrong. Restoring an old backup can lose recent content, so it’s a judgement call.
Sources
- 2023 Hacked Website & Malware Threat Report, Sucuri, June 2024
- State of WordPress Security in 2026, Patchstack, accessed 13 November 2026
- FAQ My site was hacked, WordPress.org, last updated 26 July 2026