Incident response
WordPress and WooCommerce cleanup for hacked sites
Revitt is a Sheffield, UK dev shop run by Max Revitt; we build and run production software systems.
Max Revitt
Sheffield-based developer. Public evidence first, private access only with permission.
Public signals
What we can review without private access
Start here. These are the observable traces that do not require us to log into your hosting, database, or admin area.
Share Search Console reports, search result screenshots, customer reports, or server logs you already have. We use this to assess scope before any deeper discussion.
Approach
Remediation process
We follow a deliberate sequence. Each phase is scoped to what you authorise. We document what was found and what was changed.
Confirm the indicators using public sources and any materials you choose to provide. We map what is visible without credentials.
Advise immediate practical steps you can take yourself: password rotation for known accounts, review of public user lists, temporary restrictions on new registrations or orders if warranted.
Remove unauthorised changes to files, database entries, and users. We work from a defined scope and only on systems you authorise.
Update WordPress core, themes, and plugins to current versions. Address known vulnerable extensions that were in use.
Apply configuration changes for file permissions, login hardening, plugin allow-lists, and security headers appropriate to a WooCommerce store.
Set up or advise on file integrity checks, login monitoring, and Search Console alerts so issues surface early.
From a completed job
What we found in a live WooCommerce store
A UK retailer, trading throughout, with no idea anything was wrong until the spam pages started ranking. The original breach predated their current hosting by years and sat dormant across a migration before it was used. Details are anonymised; the figures are from our remediation log.
- 7,460
- injected spam posts
- UK gambling and casino pages, all published in a single burst. Purged in full, with zero remaining and every injected URL now returning 410 Gone.
- 3 of 6
- administrator accounts were malicious
- Attacker-created admins sitting alongside genuine staff accounts, plus over a thousand fake customer registrations.
- 4
- malware plugins active
- Two doorway-spam engines, a loader that hid the injected content from the site owner, and a plugin providing raw database access.
- 2
- security plugins installed, and neither stopped it
- Both a well-known firewall plugin and a malware-scanning service were active and licensed throughout. A plugin is not a security posture.
Cleaning the site is the fast part. Reputation takes longer.
This is the part nobody warns store owners about. Once the injected pages have been removed and the backdoors closed, security vendors and blocklist operators still carry the old rating — sometimes for months. Corporate networks and antivirus products keep warning your customers away from a site that is already clean. Expect to work through delisting with each vendor separately, and budget attention for it. We will tell you honestly where that stands rather than declaring victory when the malware is gone.
Where a store keeps getting reinfected, the platform underneath is usually the real problem. See how we rebuild WooCommerce stores →
Store specifics
WooCommerce considerations
A compromised WooCommerce site affects real transactions and customer data. We pay particular attention to these areas during assessment and remediation.
How we work
Public review first, explicit permission always
We can begin with a review of public signals and materials you send us. No hosting login, database access, or admin panel credentials are required for the initial conversation.
We do not access private systems without permission. If a cleanup engagement proceeds, we define scope in writing, use least-privilege access for the minimum time needed, and return or destroy credentials on completion.
You stay in control of every step. We document findings and actions so you have a clear record for your own team, hosting provider, or payment processor.
Need a safe second look?
Book a call to walk through the indicators you have seen, or send a brief with the public signals and timeline.