Injected code, spam pages turning up in Google, redirects to somewhere you have never heard of, admin users you did not create, or your host suspending the account. Whatever the symptom, the job is the same: find how they got in, clear what they left, and close the hole.
What it usually looks like
- Pharma, casino or replica-goods pages indexed under your domain
- Visitors redirected somewhere else, often only on mobile or only from Google
- Google Search Console flagging the site, or a browser warning in front of it
- Admin accounts nobody recognises
- Your host suspending the site or emailing about outbound spam
- Files with recent modified dates you cannot account for
What I check first
- Core, theme and plugin files against official checksums, so modified files stand out immediately
- The mu-plugins directory, which is where a lot of persistence gets hidden
- Every admin and editor account, and when each was created
- The database for injected script tags, particularly in options and post content
- Scheduled tasks, since reinfection is often a cron job you cannot see
- .htaccess and any recently written PHP in the uploads folder
Cleaning is the easy half
Removing the malware takes hours. Working out how it got in takes judgement, and skipping it is why sites get reinfected a fortnight later. Most of the time it is an out of date plugin, sometimes one that has not been used for years but is still installed and still executing.
I have done this on a multinational charity site where exactly that was the way in. The write-up is here.
What it costs
Diagnosis is a fixed £150. You get the actual cause in writing, whether anything is recoverable, and what fixing it takes. The repair is quoted after that, once I know what I am dealing with. Nothing gets touched before there is a verified backup. More on how it works.