WordPress Security and Hacked Site Recovery

// Who is WordPress security for?

WordPress security is for sites that have been hacked, show a Google warning, or run outdated plugins and fear it is only a matter of time. An attack usually comes through a plugin that has not been updated for months or a weak password, and cleaning the visible damage without closing that door means the attacker is back within days. If any of the following sounds familiar, you are on the right page.

• The site redirects visitors to strange pages or shows spam content
• Google or the browser shows a "this site may be hacked" or "deceptive site" warning
• The host suspended the account for malware
• Plugins have not been updated for months and there is no login protection

We use the same method on a one-page brochure site and a 40-plugin store; only the cleanup time changes.

// What is included and what is not

The service comes as emergency recovery or a monthly security plan. The table below lists what each includes and what stays outside, line by line. Recovery is not considered finished until the site is verified clean with an independent scan and the entry point is closed; that rule is written in the quote so a cleanup that lasts a week is never handed over.

Regular updates that prevent most attacks are part of WordPress maintenance and updates; the two plans are often combined.

// How does it work and how long does it take?

Emergency recovery takes 4 to 24 hours for a typical site; heavily infected stores can take 2 business days, which we tell you in writing after the first scan. Urgent cases get a first response within 4 hours. Google warning removal depends on Google's review and takes 1 to 3 days after the clean site is submitted. The monthly plan then runs as a continuous cycle.

// How is the price determined?

Three variables set the price: how far the infection has spread, whether a clean backup exists and whether the entry point is on the site or the server. A single injected script and a store with 4,000 infected files and no backup do not take the same time, so we quote after the first scan rather than from a fixed list. The first scan is free and the quote is fixed once it is done.

If the site is reinfected within 30 days through the same entry point, we clean it again at no charge. Customers on the monthly security plan get emergency recovery included; the monthly plan has no contract.

// Results we have delivered

The three cases below represent different attack types. We do not share client names without permission, so sector and scale are given instead; figures come from Zep Bilisim recovery reports and Search Console. In all three the entry point was found and closed, and none was reinfected in the 6 months that followed.

• Online store, 900 products — A redirect injection through an outdated slider plugin; 3,200 infected files cleaned in 9 hours, the plugin replaced and the Google warning lifted in 2 days
• Law firm, 30 pages — Spam pages injected through a weak admin password; cleaned in 4 hours, two-factor authentication enforced and 1,400 spam URLs removed from the index within 3 weeks
• Non-profit — Host suspended the account for malware; a backdoor in the theme was removed, the account reinstated the same day and off-site backups set up

Cleaning a hacked site without finding the door it came through is repainting a wall while the window is still open.

// The team behind the work

The work is carried out by Caner Zep Çelik, founder of Zep Bilisim. As founder and technical consultant he has worked on WordPress infrastructure, server configuration and security since 2020 and has been involved in more than 100 projects. He reads the server logs and finds the entry point himself and does not outsource the cleanup.

The recovery report is written by the same person: how the attacker got in, what was removed, what was changed and what you should do next. The report stays with you even if you later work with another team.

// When is it not needed?

If the site is up to date, has login protection and a firewall, and an independent scan comes back clean, emergency recovery is unnecessary; we say so plainly in the first scan. A "site may be hacked" warning that refers to an old, already-cleaned incident only needs a Google review request, and we describe that step rather than selling a cleanup.

If the site is abandoned and no longer needed, taking it offline is cheaper than cleaning it; we say so too.

WordPress's official hardening guide explains from the official source the measures we apply during hardening.

// Frequently Asked Questions