A hacked site can serve spam, redirect your visitors, or get flagged with a "deceptive site" warning — and every hour it stays infected costs you traffic, trust and rankings. Below is exactly how to spot it, clean it properly, and stop it coming back. If you want it sorted today, send me a screenshot.
🇬🇧 UK-based, fixing sites remotely for the UK & US. US clients: the time-zone gap means a hack you report tonight is often cleaned by your morning. Free 15-min diagnosis, fixed price from £150 (~$190).
A hack isn't always obvious — sometimes the only clue is a drop in traffic. But the usual tell-tale signs are clear once you know what to look for:
eval() / base64_decode in PHP files.The most common reason a "cleaned" site comes back infected is a missed backdoor — a hidden file or injected line that quietly re-opens the door after you've removed the obvious malware. That's why thoroughness matters more than speed: deleting the spam pages isn't the job, finding everything the attacker left behind is. If you're not confident you've found it all, it's safer to get a second pair of eyes on it.
If the infection keeps coming back, the site is commercial, or you simply can't tell whether it's fully clean — that's the moment to hand it over. To be honest with you: a deep infection that has spread through the database and dropped multiple backdoors can fall into the £300 (~$380) or £500 (~$640) tier rather than the £150 starting price — I'll tell you which after a look, not after you've paid. You get a free 15-minute diagnosis and a fixed price before any work starts. Pay by bank transfer, PayPal or Wise.
Send me a screenshot of the warning or spam, plus your CMS and host. I'll diagnose it free, give you one fixed price, and clean it properly — same day for a straightforward infection, with an honest timeline if it's deeper.
Common signs are spam pages or pharma keywords appearing on your site, unexpected redirects to other sites, a "Deceptive site ahead" warning in the browser, defacement of your pages, or your host suspending the account. You may also spot unknown admin users or recently-modified files you didn't change.
Usually not. Your content is often recoverable from a clean backup, and the priority is removing the infection and closing the entry point rather than wiping anything. Some content may need restoring if the damage is widespread, but data loss is not the typical outcome.
Yes. Once the site is genuinely clean, you submit a security-issues reconsideration in Google Search Console. Reviews typically take a short while, after which the warning is lifted. The key is being fully clean first — a missed backdoor means the warning comes straight back.
A straightforward infection often can be cleaned the same day. A deep compromise may take longer because every backdoor has to be found and removed. You'll get an honest assessment after the free diagnosis, with a fixed price before any work starts.