A cleanup should identify and remove the malicious changes, help recover the website and address the security issues found during the review. A scanner result or restored backup alone does not explain whether the cause has been handled.
Keep a clear account of the symptoms.
Record what visitors see, when the problem started and whether it changes by page or device. Save relevant hosting alerts and screenshots. Do not keep experimenting on production if each attempted fix makes recovery harder.
Contact the hosting provider and the person responsible for the site. Access may need to be restricted while the issue is investigated. Use an agreed secure method for sharing credentials rather than placing them in an ordinary enquiry form.
Understand what is being cleaned.
A WordPress compromise can involve files, database content or unauthorized accounts. The scope should say which parts of the site and hosting will be reviewed. Ask how a copy of the affected environment will be preserved where possible.
Restoring a backup can be useful, but its condition and age matter. The same weakness may still exist after a restore. Recovery and preventing a repeat incident are connected tasks.
Check the website after recovery.
If a browser or search engine has shown a warning, the cleanup does not automatically remove that provider's warning at the same moment. Its review process may be a separate step.
- Confirm the important public pages and login behavior.
- Check authorized users and review changes to access.
- Verify forms and other business-critical actions.
- Understand any updates or replacements still required.
- Review backup arrangements and responsibility for future alerts.
Leave with a practical next-step list.
In the For One Life project, our work included malware removal, recovery and hosting-security changes. The full case study explains what was handled for that website.
Your own recovery handover should describe the work completed, remaining limits and who will handle updates and monitoring. No website can be promised permanent immunity from every future attack. What matters is understanding and maintaining the protections in place.