Signs your site may have been compromised
- Visitors (especially on phones) get redirected to gambling, pharmacy or "you won a prize" pages.
- Google search results show your site with Japanese or pharmaceutical text you didn't write.
- Chrome or Safari shows a red "Deceptive site ahead" warning.
- Admin users you don't recognize appear under Users.
- Your host suspends the account or sends a malware notice.
- Your contact form starts sending spam, or your domain's email lands in junk folders.
Some infections hide from logged-in admins and only show to search engines or first-time mobile visitors, so "it looks fine to me" doesn't rule it out. Try a private browser window on your phone, and search Google for site:yourdomain.com to see what's indexed.
The first hour
- Don't delete the site or start over yet. The files hold clues about how the attacker got in. Wiping them can leave the hole open on the new site.
- Change passwords from a clean device. Start with your hosting account, then WordPress admins, then FTP/SFTP and database passwords. Turn on two-factor sign-in where it's offered.
- Remove unknown admin users, but write down their usernames and the date they were created first.
- Tell your host. Many will share scan results or logs and can confirm whether other sites on your account are affected.
- Find your backups, but don't restore blindly. A backup from before the infection is valuable. A backup from after it just brings the problem back. If you aren't sure when it started, keep the backups and let whoever cleans the site check them.
What a proper cleanup involves
A real cleanup goes beyond running a security plugin once. It usually means comparing WordPress core files against clean copies, inspecting the theme and every plugin for injected code, checking the database for spam content and rogue options, reviewing scheduled tasks, and looking for leftover backdoor files in uploads folders. Then comes the important part: closing the way in. That's often an outdated plugin, an abandoned theme, a reused password, or an old admin account belonging to someone who left.
After cleanup, if Google flagged your site, you request a review through Google Search Console. Google decides the timing, so no one can honestly promise when a warning will disappear.
Why this matters for a Beverly Hills business
For a boutique, medical-adjacent practice, real estate office or professional firm, the website is often the first impression a high-trust client gets. A browser warning or a spam redirect on your homepage can send that visitor straight to a competitor on the same block of Wilshire. It's also worth thinking about what your site collects. If your forms gather inquiries, appointments or client details, talk to your own advisors about any notification duties that may apply. We can help with the technical side, not legal advice.
Reducing the odds of a repeat
Most small business compromises we hear about trace back to things that are dull to maintain: plugins that were never updated, themes nobody uses still installed, shared passwords, and no one checking. Regular tested updates, fewer plugins, unique passwords with two-factor sign-in, a review of who has access, and backups kept off the server all help. None of them makes a site impossible to break into, but together they make it a much harder target.
KeptWeb is based in Beverly Hills. If you think your site has been hacked, send us the URL and what you've noticed. If your site isn't on a plan yet, we start with a free assessment, then give you a one-time cleanup quote starting at $299, separate from any plan. Our security service and WordPress maintenance plans cover scanning, updates and access reviews going forward.
Frequently asked questions
How much does hacked-site cleanup cost?
If your site isn't on a KeptWeb plan yet, we start with a free assessment. Then we give you a one-time cleanup quote, starting at $299, separate from any plan. Email hello@keptweb.com with your URL and what you've noticed; we aim to reply within 1 business day (Mon–Fri, 9 am–5 pm PT).
Should I just restore yesterday's backup?
Only if you're confident the infection started after that backup was made. Many infections sit unnoticed for weeks, so a recent backup may already contain the malicious code. Restoring also doesn't close the hole the attacker used.
Will a security plugin fix it on its own?
A scanner can find many known problems, but it can miss custom backdoors or database injections, and it doesn't tell you how the attacker got in. Treat a clean scan as one useful signal, not proof.
How long will Google's warning stay up?
That depends on Google. Once the site is cleaned you can request a review in Search Console. Timing varies, so be wary of anyone who guarantees a date.
Do I need to tell my customers?
That depends on what data your site handles and where your customers are. Please ask your own legal or compliance advisor; we can explain what we found technically.
This guide is general information. Every site is different, and following these steps doesn't guarantee a particular result. Product names belong to their owners; KeptWeb is not affiliated with them.