Express Diagnosis
Immediate callback: symptoms, available access (FTP, hosting, wp-admin), backups, and emergency measures to apply right away.
French Leader — WordPress Security
Hacked WordPress Cleanup within 2 hours
15+ years of experience — 500+ WordPress sites restored
- Complete virus removal, database repair, and Google blacklist removal
- 500 error, white screen, SEO spam, or inaccessible wp-admin: we intervene now
- Immediate callback — no obligation, no online payment
Critical incident? Call now+33 7 82 70 38 30
or leave your contact details:
An expert will call you back in under 5 minutes
Describe the incident in one sentence. We'll call you back and tell you what to do immediately — free and no-obligation.
150+
audited companies
SINCE 2016
72 h
first response
INCIDENT RESPONSE
1 247
vulnerabilities reported
ALL AUDITS
Inclus
re-test after correction
ALL OFFERS
Act immediately
Your WordPress is probably compromised if…
Don't panic: most compromised WordPress sites are recoverable. Offline, hacked, or critical error: every hour costs traffic, trust, and sometimes revenue. If you recognize these signs, rapid intervention limits the damage.
- Redirects to spam, casino, or illegal content on your domain name.
- Google Search Console alert or "dangerous site" browser warning, sharp drop in rankings.
- Unknown WordPress administrator accounts, plugins, or themes installed without your consent.
- Multilingual SEO spam pages indexed, suspicious PHP files in wp-content or wp-includes.
- White screen, 500 error, inaccessible wp-admin, or site suspended by the host.
This page is intended for businesses and managers of WordPress sites (showcase, WooCommerce e-commerce, professional blog).
Express Intervention
What we do within the next 120 minutes
No-obligation diagnosis within 120 minutes of callback — followed by targeted analysis and cleanup on WordPress (core, plugins, theme, and database) depending on the infection's scope.
In-depth Analysis
Search for backdoors, malicious plugins, database injections (wp_posts, wp_options), suspicious admin accounts, and .htaccess redirects.
Cleanup & Relaunch
Eradication of malicious code, clean restoration if a healthy backup exists, relaunching the site and critical user journeys (ordering, contact).
Hardening & Handover
Updates, wp-config hardening, permissions review, anti-recurrence recommendations, and a summary for your management or insurance.
While Waiting for Callback
First Steps on WordPress
- Do not restore a backup without expert advice — it may reintroduce the malware.
- Change all WordPress admin and hosting passwords from a clean device.
- Keep logs, screenshots, and the discovery time — do not delete suspicious files.
- Put the site in maintenance mode if possible, without abruptly shutting down the server.
- Notify your host and check Search Console for security alerts.
What our clients say
We don't rate ourselves.
Reviews published on our Google listing by companies that have actually been audited. Verifiable, one by one.
GOOGLE
We hired White-Hat to conduct a cybersecurity audit of all our servers, and we are very satisfied with the quality of their work. Philippe demonstrated professionalism, responsiveness, and excellent communication skills throughout the entire process. The recommendations provided were clear, relevant, and immediately actionable to strengthen our security. We highly recommend their services.
GOOGLE
Excellent experience with White-Hat for a comprehensive security audit of our SaaS platform. The quality of service was truly outstanding: Philippe took the time to understand our application's architecture before starting the tests, which made all the difference to the relevance of the results. The report was detailed, with vulnerabilities categorized by criticality, concrete evidence of exploitability, and recommendations directly applicable by our technical team. The post-delivery follow-up to verify the patches was a real bonus. Professional, rigorous, and attentive: exactly what you need to secure a SaaS product.
GOOGLE
We hired White-Hat for a comprehensive audit/advanced penetration test on our website, and it's clearly the direct contact with Philippe that makes all the difference. No salesperson between us, no unnecessary jargon: we communicate directly with someone who understands our challenges and can clearly explain the vulnerabilities found. The report was precise, with concrete evidence and recommendations that we were able to implement quickly. A truly trustworthy relationship; I highly recommend them.
GOOGLE
Professional work. Thank you.
GOOGLE
We urgently contacted White Hat following a suspected compromise of several servers. The team was extremely responsive and addressed our request within minutes, with clear communication at every stage. Their vulnerability analysis was conducted very rigorously, resulting in a detailed report and concrete, easy-to-implement recommendations to strengthen our security. The investigation of the compromised servers allowed them to quickly identify the source of the attack and contain the incident without any major disruption to our services. Professional, knowledgeable, and readily available, I highly recommend this provider for any cybersecurity intervention, especially in emergency situations.
Scope
What we handle on WordPress
WordPress Compromises Handled
Defaced sites, SEO spam, malicious redirects, PHP backdoors, infected plugins or themes, compromised admin accounts, injected database (wp_posts, wp_options), 500 errors post-infection, and sites blacklisted by Google.
WooCommerce & Multisites
Showcase sites, professional blogs, WooCommerce, and multisite installations: we adapt the scope to traffic, active plugins, and production constraints.
First Emergency Response
Upon requesting an immediate callback, we aim for contact as soon as possible depending on availability. Full cleanup depends on the infection's scope and available access.
Remote Intervention
OVH, o2switch, Ionos, Infomaniak, Kinsta, WP Engine, Plesk, cPanel, VPS, or dedicated server — via SFTP, file manager, hosting access, or wp-admin, depending on what you can securely provide.
Outside Emergency Scope
No graphic redesign, no post-incident functional development, no full GDPR or legal audit, no technical debt recovery beyond security. These topics are subject to a separate quote after the site is back online.
Google blacklist removal
Residual malware code verification, assistance with Search Console review requests, and documentation for hosting providers or insurers. Google's review time is often 24 to 72 hours after submission.
Dedicated Contact
Philippe Bécué WordPress & Incident
SEO spam, Google alert, unknown plugin, or wp-admin going haywire: for WordPress emergencies, you don't need an anonymous ticket — you need an expert who knows the field. Philippe Bécué has been managing your interventions at White-Hat for over 15 years: WooCommerce, professional showcase sites, multisites, and shared or cloud hosting. He has restored hundreds of compromised WordPress sites — backdoors, database injections, pirate accounts — with clear explanations for your teams and management, not jargon to impress.
Hacked WordPress FAQ
Frequently asked questions
Do I need to pay online to initiate an intervention?
No. The callback and initial diagnosis are free and require no online payment. After qualification (symptoms, FTP/hosting/wp-admin access, backups), a detailed quote will be provided before any paid mission.
Can my WordPress be fully recovered?
In the vast majority of cases, yes — with a recent and clean backup, or manual cleaning of files and database. During the initial exchange, we will assess the extent of the infection without making unrealistic promises.
How long does it take to get a WordPress site back online?
Express initial diagnosis possible within 2 hours of callback. Full cleaning often takes a few hours to a day depending on the malware's scope. Google's alert removal can take an additional 24 to 72 hours.
What should I do while waiting for the expert's callback?
Do not blindly restore a backup, change admin passwords from a clean device, keep logs and screenshots, put the site in maintenance mode if possible, and notify your hosting provider. Do not delete suspicious files before analysis.
What access do you need?
Depending on the situation: SFTP or file manager, hosting access (cPanel, Plesk, OVH…), wp-admin with an admin account, phpMyAdmin or SQL export, server logs. We limit privileges to the strict minimum required.
Should I notify Google, my host, or the CNIL?
In parallel with the cleanup, we help you prioritize: request a Search Console review if blacklisted, notify your host, your cyber insurer if you have a policy, and the CNIL in case of personal data breach within 72 hours.
Act now
Hacked WordPress — request a callback
Describe the incident in one sentence. We'll call you back and tell you what to do immediately — free and no-obligation.
Free, confidential, no-obligation — no online payment.