Clean Hacked WordPress SEO Spam

Project Title: WordPress Malware Removal, Security Cleanup & SEO Spam Recovery

I need an experienced WordPress security specialist to clean and secure a doctor’s website affected by malware and large-scale SEO spam. Unwanted URLs associated with the website are appearing in Google Search Console.

No cleanup has been performed yet. I need a thorough investigation, removal of malicious content, and security improvements to prevent reinfection while preserving the existing website.

Scope of work

1. Backup and investigation
• Take a complete backup of the current website files and database before making changes.
• Preserve relevant logs for investigation.
• Inspect WordPress core, themes, plugins, uploads, must-use plugins and the current database.
• Review saved code snippets, header/footer scripts, administrator accounts, scheduled tasks, redirects and server configuration.
• Investigate the likely entry point and identify any mechanisms that could recreate the infection.

2. Malware and spam removal
• Remove malicious code, hidden backdoors, injected links, cloaked pages and confirmed SEO spam.
• Inspect the hosting account for related infections and coordinate with hosting support where necessary.
• Preserve legitimate website content, images, patient enquiries and other business data.

3. Repair and security hardening
• Replace affected WordPress core and plugin files with trusted official copies.
• Review and repair the custom theme without changing the design.
• Update software after checking compatibility.
• Configure appropriate permissions, firewall protection, security monitoring and login protection.
• Assist with password changes, session invalidation and security-key updates.
• Configure alerts to reach an email address we control.
• Discuss any additional paid tools before purchasing or installing them.

4. Google Search Console and SEO cleanup
• Remove injected spam content and links.
• Ensure confirmed spam URLs return genuine 404 or 410 responses while legitimate pages remain accessible.
• Review the sitemap, robots.txt, canonical tags and redirects.
• Submit a clean sitemap and guide us through Search Console checks.
• Assist with security reviews or reconsideration requests if applicable.

5. Testing and handover
• Test the homepage, service pages, navigation, mobile layout, images and enquiry forms.
• Run a reputable security scanner after cleanup and share the results alongside manual-review findings.
• Provide a brief report explaining what was found, what was changed, any remaining risks and recommended preventive measures.
• Deliver a clean post-cleanup backup.

Important requirements

The website uses a custom Dronainfotech theme and depends on Advanced Custom Fields Pro (ACF Pro). The existing design, content and functionality must be preserved. Do not replace the theme, deactivate essential plugins or restore an old backup without discussing the impact first.

All credentials and patient enquiry data must remain confidential. Do not upload sensitive files or database backups to public services.

Acceptance criteria

• Identified malware and mechanisms for reinfection removed, supported by manual review and a post-cleanup scan.
• Confirmed spam URLs return appropriate 404/410 responses.
• Legitimate pages and enquiry forms remain functional.
• Agreed security measures implemented.
• Cleanup report and clean backup delivered.
• At least 30 days of support for recurrence of the same infection, with coverage and exclusions agreed in writing.

I understand that Google controls re-crawling, de-indexing and ranking recovery. Instant removal of search results or guaranteed rankings is not expected.

Please include in your proposal:
• Your approach to investigation, cleanup and prevention.
• Relevant experience with hacked WordPress websites and large-scale SEO spam.
• Estimated start time and turnaround time.
• A fixed-price quote, proposed milestones and any additional costs.
• Access required and any assistance needed from the hosting provider.
• Your post-cleanup support terms.

Necessary access will be shared securely after the project scope and terms are agreed.