Updated: 2026-10-27
A hacked site can be cleaned, and usually re-secured, by removing the injected code, clearing the spam out of Google’s index, and closing the way in — but a fix that skips the backdoor hunt is how sites get re-hacked.
Your site redirects visitors somewhere you never linked. Or Google shows pages you never wrote, in a language you don’t speak. Either way, the site is no longer fully yours, and every day it stays that way the mess in the index grows.
I run a team of AI agents that does hacked website repair end to end: find what was injected, remove it, get the spam out of Google’s index, and close the door it came in through. A human reviews every job before it is handed back. No ranking promises; just the work and the numbers.
Most hacked sites are not special targets — they are ordinary sites with an unpatched hole. In Sucuri’s 2023 Hacked Website Report, 49.21% of compromised websites were found with at least one website backdoor at the point of infection, which is why removing the visible damage without finding the backdoor so often fails (Sucuri, 2023 Hacked Website Report).
“Hacked content is any content placed on a site without permission, due to vulnerabilities in a site’s security.”
— Google Search Central, Spam policies for Google web search
What you get
A hacked website fix has three parts, and skipping any one of them is how sites get re-hacked a month later.
- Cleanup. Injected code, spam pages, rogue admin users and modified core files removed. On WordPress my agent replaces core folders with clean copies of the same version and checks the files attackers like most:
.htaccess,index.php, the theme’s header and footer,functions.php. - De-indexing. Spam URLs return
410 Gone, removal requests are filed in Search Console, and the sitemap is cleaned and resubmitted so it lists only your real pages. - Hardening. Passwords and secret keys rotated for every access point (admin, hosting panel, FTP/SFTP, database), outdated plugins and themes updated or removed, and the likely entry point named in the report.
- A written report of what was found, what was removed, and what is still on your side to do, plus a recovery check 30 days later.
If the site runs on WordPress and the problem is mostly injected code, you may only need to remove malware from WordPress. If Google is showing Japanese product pages under your domain, that is a specific pattern with its own cleanup steps; the guide to the Japanese keyword hack on WordPress walks through how it works.
How the agents do it
Here is the flow for a typical hacked website cleanup:
Access → snapshot → scan → clean → de-index → harden → human review → report
- Snapshot first. Before anything is touched, the infected site is backed up. WordPress.org’s own advice is the same: keep one copy of the compromised state, because a cleanup that goes wrong needs something to go back to (WordPress.org, “FAQ My site was hacked”).
- Scan files, database and the index. My agent compares files against clean copies, looks for unknown users and injected database rows, and checks what Google actually holds for the domain. The index check matters: the files can be clean while hundreds of spam URLs still sit in search results.
- Clean. Remove, replace, reinstall. Anything uncertain gets flagged for the human reviewer instead of guessed at.
- De-index. Google’s Removals tool hides a URL for about six months; it only stays gone if the page returns 404 or 410, sits behind a password, or carries noindex (Google Search Console Help, Removals tool). So the spam URLs get a real 410, not just a request.
- Review request. If Search Console’s Security Issues report lists a hack, it is answered only after every affected page is fixed, with a plain account of what was done. Google says resubmitting while the problem remains only drags things out, and reviews take days to weeks (Google Search Console Help, Security Issues report).
Your credentials are used only for the job and removed after delivery.
If the damage is past cleaning (the files are gone, or the host wiped the account), the same pipeline can rebuild the site from your backups or from public archive snapshots, keeping the old URL structure.
When to hire, and when to do it yourself
Do it yourself if:
- You have a clean backup from before the hack and know roughly when it happened.
- Google shows no spam pages under your domain (search
site:yourdomain.comand look). - You are comfortable with SFTP, the database and Search Console.
For that case, start with our walkthrough for a hacked WordPress website and finish with WordPress hardening. Both are free and complete.
Hire it out if:
- Spam pages are already indexed and you need them gone from search, not just from the server.
- The hack keeps coming back after you clean it. That usually means a backdoor is still in place.
- The site redirects visitors (a “website hacked redirect”) and you cannot find where the redirect lives.
- You have no clean backup.
A reinfected site is the expensive outcome. Cleaning twice costs more than cleaning once.
Hacked-repair options compared
Where a dedicated hacked-site repair sits next to the best-known WordPress security tools. Scope and pricing change, so check each provider’s own site before you buy.
| Option | What it is | Human review? | Cost |
|---|---|---|---|
| Sucuri | Security platform: malware cleanup plus a website firewall | Yes — analyst-assisted cleanup | See vendor |
| Wordfence | WordPress security plugin (firewall + scanner); paid site-cleaning service | Via paid service | See vendor |
| MalCare | WordPress security plugin with one-click automatic malware removal | Mostly automated | See vendor |
| Wayback Press (waybackpress.com) | Full hacked-site repair: clean, de-index spam, harden, and rebuild from backups or archive snapshots when a site is past cleaning | Yes — a human reviews every job | See pricing |
What I will not promise
- Rankings. I remove the spam, fix the index and file the right requests. Whether and when lost rankings come back is Google’s call.
- That your host is clean. On shared hosting the infection can come from a neighbour account. If that is the case, the report says so and tells you what to ask your host.
- Turnaround. Hack cleanup has a fixed price, not a fixed time.
Proof
No client reviews, no client logos and no repair case study yet, and I won’t pretend otherwise. Wayback Press is new; the two case studies so far are internal restore tests. Client deliveries become case studies only with the client’s written consent. What I can show you is the process above and one more first-hand fact: this site was built end to end by the same agent pipeline that does the repairs.
Price and next step
Hack cleanup is a fixed price per site: $79. Jobs that also need pages rebuilt use the restore tiers, from $49 for up to 300 URLs, with a custom offer for larger sites; see prices for the current tiers.
To start, send the domain and what you are seeing through the contact page. If any part of the repair involves restoring old content, you confirm you have the rights to it; the terms spell that out.
The attacker had a key to your house. The job is to change the locks, not just tidy the living room.
Wayback Press (waybackpress.com) is an independent restoration service. Not affiliated with the Internet Archive, the Wayback Machine, or the Shift8 open-source tool of the same name.