Website Malware Removal UK

Types of website malware we remove

• Backdoors and web shells: small scripts that let attackers back in after you clean up. They hide in plugin folders, uploads, fake image files and even legitimate-looking core files.
• SEO spam: thousands of pages or hidden links for pharma, casino or counterfeit goods, often only shown to search engine crawlers. Also called the Japanese keyword hack.
• Malicious redirects: code that sends visitors, often only on mobile or on their first visit, to scam sites. Usually injected into JavaScript files, .htaccess or database options.
• Card skimmers: JavaScript on checkout pages that copies payment details as customers type them.
• Cryptominers and spam mailers: scripts that use your server's resources or send spam from your domain, getting the host to suspend you and your email blocklisted.

Our malware removal process

1. Snapshot: copy the infected site so evidence is kept and nothing is lost.
2. Scan files: compare core files to official checksums (for WordPress, wp core verify-checksums), search for obfuscation patterns such as eval(, base64_decode, str_rot13 and preg_replace with the /e modifier, list recently modified files and look for PHP in folders that should only hold images.
3. Scan the database: search posts, options, widgets and config tables for injected <script> tags, iframes and encoded payloads. On Magento we check core_config_data, a common skimmer hiding place.
4. Check the server: cron jobs, .htaccess and .user.ini files, and other sites in the same hosting account that could reinfect yours.
5. Remove and replace: delete malicious files, replace core and plugins with clean copies, clean the database.
6. Patch and reset: update the vulnerable component and reset every password and secret key.
7. Verify: rescan, check the site as a search engine and mobile visitor, and request reviews from Google and other blocklists.

Why automated scanners are not enough

Security plugins and host scanners are useful for spotting infections, but they often miss obfuscated backdoors and database injections, and some "clean" by deleting files, which can break the site. Others clean the visible symptoms while the backdoor remains, so the infection returns days later.

Manual review alongside scanning finds what tools miss. It also tells you how the attacker got in, which is the only way to stop it happening again. Patchstack's State of WordPress Security report found 46% of WordPress vulnerabilities disclosed in 2025 had no patch available at disclosure, so sometimes the right fix is removing a plugin entirely rather than waiting for an update.

Email and reputation clean-up

If malware was sending spam, your server's IP or domain may be on email blocklists, and customers may stop receiving your emails. After cleaning, we check major blocklists, request delisting where appropriate and make sure SPF, DKIM and DMARC records are in place. See email deliverability. If your site was flagged in Google, see hacked website repair for the review process.

Shared hosting and cross-contamination

One of the most common reasons a cleaned site gets reinfected is another site in the same hosting account. Many businesses have an old test site, a forgotten microsite or an abandoned WordPress install in a subfolder. If any of those is infected, it can rewrite files in your main site because they run as the same user.

We list everything in the hosting account, clean or remove old installs, and recommend separate accounts or isolated hosting for sites that must stay. If your host cannot isolate sites from each other, that is worth knowing. See abandoned website support for old sites nobody looks after.

Prices

Malware removal is £45 an hour + VAT, with a 30-minute minimum then 15-minute blocks. Heavily infected sites, or hosting accounts with many infected sites, are quoted after an initial assessment. To keep the site clean afterwards, our Essential plan at £25 a month + VAT includes updates applied and checked, daily off-server backups, uptime monitoring and security monitoring. See website security or get in touch.

What it costs

Support plans from £25 a month + VAT, or £45 an hour + VAT for one-off fixes. Pick a plan if you want it looked after every month, or pay by the hour for a one-off job.

Related