Hacked Client Site? The Agency Malware Response Playbook

A client calls on Saturday morning. Their site redirects to a pharmacy page on mobile, Google is showing a warning in search results, and their host has suspended the account. You did not build the site, nobody has logged in for months, and the client wants it fixed today.

This is the playbook: what to do in the first hour, how to clean a compromised WordPress site properly rather than cosmetically, and how to close the hole so it does not come back. It is written for agency teams — the operational side of WordPress malware removal for an agency matters as much as the technical side, because you are managing a frightened client at the same time.

Hour one: contain, do not clean

The instinct is to start deleting suspicious files. Resist it. You will destroy evidence you need to find the entry point, and you will almost certainly miss a backdoor.

1. Take a full forensic copy. Files and database, downloaded and stored offline, before any change. This is your evidence and your rollback.
2. Put the site into maintenance mode or restrict it at the server level. If it is serving malware to visitors, leaving it public is the bigger harm.
3. Stop the bleeding on payments and data. If it is a store or handles personal data, note the time of discovery — you may have regulatory notification duties, and the clock matters.
4. Rotate credentials from a clean device. Hosting, SFTP, database, all administrator accounts, and any API keys stored in the site.
5. Tell the client in writing. What you know, what you do not know yet, what you are doing next, and when they will hear from you again.

Step five is the one agencies handle worst. A client who hears nothing for six hours assumes the worst. A short factual update every two hours costs you ten minutes and preserves the relationship regardless of how the cleanup goes.

Work out what kind of compromise you have

Different infections need different responses. Identify the type before you plan the fix.

Symptom	Likely type	Priority
Spam pages indexed under the domain	SEO spam injection	Clean plus search index cleanup and reindexing
Mobile-only redirects to another domain	Conditional redirect script in files or database	Find the conditional logic; it hides from logged-in admins
Unknown admin users, scheduled tasks you did not create	Persistent backdoor	Assume multiple backdoors; full rebuild is often faster
Card-skimming behaviour on checkout	Payment page compromise	Treat as a data incident; legal and payment provider involvement
Defacement of the homepage	Opportunistic attack, often via a known plugin flaw	Usually the easiest to clean, but the entry point still matters

Pay attention to the row about unknown admin users. Access control is the difference between one bad plugin and a total compromise, which is why locking down roles at build time — as covered in client-proof WordPress editor roles and permissions — is a security measure, not just a usability one.

Find the entry point before you clean

A cleanup that does not identify the entry point is a delay, not a fix. Reinfection within days is the standard outcome. Look in this order:

• Access and error logs around the first known bad timestamp. Look for POST requests to odd paths, repeated requests to a plugin file, or a burst of activity from one address.
• File modification times. Anything in wp-includes or wp-admin modified after the last core update is suspicious by definition.
• Plugin and theme versions against known vulnerability disclosures. Outdated components remain the leading cause.
• User table and application passwords. Unexpected accounts, changed emails, or tokens nobody created.
• Uploads directory. PHP files in wp-content/uploads have no legitimate reason to exist.
• Scheduled tasks and must-use plugins. Common hiding places that survive a theme reinstall.
• Shared hosting neighbours. On a legacy shared account, another site under the same user can be the source.

Document what you find as you go. That record is what justifies your invoice, and it is what you give the client when they ask whether customer data was exposed.

Clean by replacement, not by editing

The reliable method is to rebuild known-good code around preserved content, rather than picking malicious lines out of infected files.

1. Replace WordPress core with a fresh download of the same version, keeping only wp-config.php after inspecting it line by line.
2. Reinstall every plugin and theme from official sources. Anything nulled, abandoned or not available from a legitimate source gets removed, not reinstalled.
3. Diff custom theme and plugin code against your repository. If there is no repository, review it manually — this is where a custom build with no version control costs the client real money.
4. Clean the database: injected script tags in post content and options, rogue admin users, malicious entries in the options and usermeta tables. Search rather than assume.
5. Empty and reinstate the uploads directory, removing any executable files.
6. Regenerate salts in wp-config.php to invalidate every existing session.
7. Reinstall from a pre-infection backup only if you can date the infection confidently. If you cannot, the backup is probably infected too.

Scanners help, but treat them as a second opinion rather than the method. They find known signatures; a competent attacker’s obfuscated loader in a legitimate-looking file will not match one. When a full rebuild is faster than a clean — which is common on old sites with heavy customisation and no source control — say so, and quote it honestly. Where the diagnosis or the rebuild needs specialist time your team does not have, WordPress security and malware removal is one of the services agencies most often hand to a white label partner, precisely because it arrives at the worst possible moment.

Recovery: get the site trusted again

Removing the malware is halfway. The site also has to be re-trusted by browsers, search engines and the host.

• Request a review in Google Search Console under Security Issues, with a short description of what was found and fixed.
• Remove indexed spam URLs and resubmit a clean sitemap.
• Ask the host to lift any suspension and confirm their scan is clear.
• Check blocklist status with the major reputation services.
• If email deliverability was affected by spam sent from the account, review SPF, DKIM and DMARC records.
• Monitor logs daily for two weeks. Reinfection, if it happens, usually happens fast.

Prevention is a retainer conversation

Almost every compromise traces back to something mundane: an unpatched plugin, a reused password, an administrator account belonging to a former contractor, or no backups worth restoring. All four are subscription problems, not project problems.

Use the incident as the moment to change the arrangement. A client who has just watched their site go dark understands the value of monthly patching far better than they did during the original proposal. Package it plainly: updates on a schedule with staging verification, off-site backups tested by restoring them, uptime and file-integrity monitoring, least-privilege user accounts, and an agreed response window when something goes wrong. Our WordPress maintenance and support service exists to sit behind exactly that offer under your brand, and the hardening basics in our WordPress security hardening guide are worth applying to every site in your portfolio, not only the one that just got hit.

If you are packaging that as a recurring service rather than a favour, the pricing patterns in WordPress maintenance retainers for agencies will save you inventing a number under pressure. And if security incidents are becoming a recurring drain on your team, having standing capacity is the structural answer — the model is set out in the white label WordPress development guide for agencies.

WordPress malware removal as an agency service: what to charge and what to say

Emergency work is not standard work. Price it as an incident response with a defined scope: forensic copy, entry-point investigation, cleanup, hardening and a written report. Charge for the investigation separately from the fix, because the investigation is where the hours are and it is the part clients most want to skip.

Be careful with promises. Never guarantee that a site cannot be compromised again, and never state that no data was accessed unless the logs actually support it. Say what you found, what you cannot determine, and what you have done to reduce the risk. Overclaiming during an incident is how an agency turns a technical problem into a liability problem.

Frequently asked questions

Can we just restore a backup?

Only if you can date the infection and the backup predates it, and only if you fix the entry point at the same time. Restoring to a point before the malware but after the vulnerability was introduced puts you back where you started within days.

How long does a cleanup take?

A straightforward infection on a well-documented site can be contained and cleaned within a day. Sites with heavy custom code, no version control and no logs take considerably longer, mostly because verifying the custom code is clean is slow manual work.

Is a security plugin enough on its own?

No. Security plugins add useful monitoring, blocking and hardening defaults, but they cannot compensate for outdated components, weak credentials or a host that does not isolate accounts. They are one layer among several.

Should we tell the client’s customers?

That is the client’s decision and, depending on jurisdiction and whether personal data was involved, potentially a legal obligation with a short deadline. Your job is to give them accurate technical facts quickly so they can take advice. Do not make the notification call for them.

Who pays when a site we built gets hacked?

It depends entirely on what your contract said about maintenance. If the client declined a maintenance plan, the cleanup is chargeable work. This is much easier to discuss if the declined plan is documented in writing at handover.

If you are dealing with a compromised client site right now and want another set of hands on the cleanup, tell us what you are seeing and we will start with the containment steps above.

You can see how this is priced on the dedicated developer plans page — monthly hour blocks, NDA on every tier, month to month.