Report · 8 September 2026
WordPress site hacked again? Move out, and leave the malware behind…
You have been here before. A visitor emails to say your site sent them somewhere odd. Google shows a page of yours advertising handbags or casinos in a language you do not speak. The hosting company sends a warning, or suspends the account. You pay someone to clean it, or spend a weekend doing it yourself, and for a while it is fine. Then it happens again.
If your WordPress site has been hacked, and especially if it keeps getting hacked, this page is for you. It is not a guide to malware removal. It is the other option: leave.
Why a WordPress site keeps getting hacked
A WordPress site is a piece of software running on a server, all day, waiting for visitors. It has a login page anyone on the internet can find. It has plugins, often a dozen or more, each one written by somebody else and each one a possible way in. And it has a database, so there is somewhere for a hacker to hide things once they are through.
That is the honest reason the same site gets hacked twice. A clean-up removes what was found. It rarely finds everything. One planted file left in a folder nobody checks, one plugin still a version behind, one password reused from somewhere else, and the door is open again. The people who break into WordPress sites do it in bulk, with software, and they come back to the sites that let them in before.
None of this is your fault. It is what running your own software on your own server involves, and most small businesses never signed up for it knowingly.
What to do today
Before anything else, three plain steps:
- Tell your hosting company. They can see things you cannot, and a good one will help.
- Change every password you use for the site: the WordPress login, the hosting account, the email address the site sends from.
- Do not delete anything yet. You will want your pages, your pictures and your words intact when you decide what happens next.
Then decide. You can have the site cleaned and hope the way in is closed this time. Or you can move the site somewhere the way in does not exist.
What a move changes
When Bernard moves your site, he reads every page of it as a visitor would see it, and rebuilds each one as a plain file. That is the whole trick, and it matters here more than anywhere.
A plain file cannot be logged into. It has no plugins to fall behind, no database to hide things in, and no software running behind it for anyone to break. The WordPress installation, the theme, the plugins, the admin page and whatever the hacker left in the folders all stay on the old server, because none of them is part of a page. Bernard moves the pages.
So the new site is not a cleaned-up version of the hacked one. It is your pages, rebuilt, in a home with nothing to break into. There are no updates to chase, no security plugin to renew, and no morning where the site is suddenly sending people somewhere else.
What Bernard does with the mess
A hacked site usually carries two kinds of damage, and Bernard treats them differently.
The first is hidden. The classic residue of a hacked WordPress site is a block of spam links tucked inside an ordinary page, styled so no visitor sees it and only Google does. Bernard looks for exactly that as he rebuilds each page, strips it, and tells you on moving day: "Spam was hidden on three pages of your old site, a sign it had been hacked. Bernard removed it during the move." He also flags wording that reads like a spam injection, so you can check a page that might be fine but deserves a second look.
The second kind you can see, and so can you. A paragraph you never wrote. A link to a shop you have never heard of. A page at an address that makes no sense. Bernard rebuilds what is on the page, so anything visible comes across for you to judge, and you will meet it in the free show home before you pay a penny. When you want it gone, you say so in plain words and it goes, the same way you make any other change to a bernard site.
Everything you did write comes across as it was: every post, every page, every picture, and every link you have earned, kept and redirected so a search that used to find you still does. The plain version of that is in How to move your website without losing your Google rankings.
What a move does not do
Being straight about the edges is part of the point.
Bernard does not clean your WordPress site. It stays as it is until you switch your web address over to the new one, and after that it can be switched off. If you want the old installation cleaned as well, that is a separate job for your host or a security firm.
If Google has already marked your site as hacked, moving gives Google a clean site at your address, which is the part you can control. The warning is Google's to lift. Once the new site is live, open the Security Issues report in Google Search Console and choose Request Review, describing what you did. Google says most reviews take several days or a few weeks.
And Bernard can only rebuild what he can see. A members area behind a password is not something he can measure from the outside. He tells you at the measuring-up, before you pay anything.
What it costs
£200 a year, in plain pounds, with the move included. That is the whole price. There is no security plugin to subscribe to, no clean-up fee and no hosting renewal waiting to climb. Your web address stays in your own name, the way it always was, and Keep your name and details the same everywhere explains how that works.
If you are weighing it against what WordPress is already costing you, WordPress 2026 pricing, explained - free to start, then the price climbs lays the numbers out, and Monthly website maintenance - what's included, what it costs, and when you need it covers what a maintenance plan buys if you would rather stay.
See your own site moved, free
Paste your web address in and Bernard measures it up. A few minutes later you have a show home: your own homepage, rebuilt clean, next to the original, with the hidden spam already gone if there was any. Nothing to install, nothing to sign, and nobody is charged for looking.
Questions people ask
- My WordPress site has been hacked. What should I do first?
- Tell your hosting company today, change every password you use for the site, and do not delete anything yet. Then decide whether you want that site cleaned or want to leave it. Bernard does the second one: he rebuilds your pages as plain files in a new home, so the malware, the plugins and the login the hacker used are not part of what moves.
- Does Bernard do WordPress malware removal?
- No. Bernard does not clean a WordPress site, and it is worth being clear about that. He moves your site out of WordPress altogether. What he removes is anything the hack hid inside your pages, and he tells you on moving day where he found it. The WordPress installation itself, with whatever is living in it, stays behind.
- Why does my website keep getting hacked?
- Usually because the way in is still there. A WordPress site is software running on a server, with plugins, a theme and a login page, and a clean-up that misses one planted file or one weak password is undone within weeks. The fix is not a better clean-up. It is a site with nothing to break into.
- Will the spam pages come with me?
- The hidden ones are stripped as Bernard rebuilds each page, and your move docket lists where he found them. If the hack left something you can see, a paragraph you never wrote or a link to a shop you have never heard of, you will spot it in the free show home, and you ask for it to go in plain words. Anything that only existed on the hacked server, the planted files and the code that generated new spam, cannot come, because Bernard moves pages, not the machinery underneath.
- Google says my site may be hacked. Does moving fix that?
- Moving gives Google a clean site to find at your address, which is the part you control. The warning itself is Google's to lift. Once the clean site is live, open the Security Issues report in Google Search Console and choose Request Review, describing what you did. Google says most reviews take several days or a few weeks.
- What does it cost?
- £200 a year, with the move included and no security plugin or clean-up fee on top. Your web address stays in your own name. The free show home comes first, so you see your own site rebuilt before you pay anything.