Malware cleanup starts with a confirmed finding
A scanner alert is useful evidence, but its wording matters. A modified file can be a legitimate customisation, and an unfamiliar account may belong to a previous developer. Equally, a site that looks normal may still contain unwanted changes. We review findings in context rather than treating every alert as a reason to delete something.
Files are only part of the picture
WordPress content and configuration are spread across files and a database. A cleanup scope may need to consider both, alongside installed plugins, themes and user access. Removing a suspicious page without understanding how it was created can leave the underlying problem unresolved. The investigation should identify the components actually examined and any areas that could not be reached.
Repair, replace or restore?
There is no single cleanup method that suits every website. Replacing a damaged component may make sense when a trustworthy replacement is available. A custom theme may need a more careful comparison to avoid losing legitimate work. Restoring a backup can be appropriate, but the restore date and any newer orders or content need discussing first. We agree the approach before proceeding.
Keep the business consequences in view
Tell us which parts of your site matter most: enquiries, payments, membership access, booking availability or a particular landing page. These priorities help define the checks after cleanup. Recovering the appearance of a page is a different result from confirming that the agreed customer journey works. Any test that could submit data or create a transaction needs a suitable test arrangement.
Why a security plugin is not the whole service
A plugin may provide useful findings and controls, but installing one does not explain an incident by itself. WebWasp’s role is to interpret the evidence, carry out the agreed work and identify follow-up actions. A basic public website audit is different again: it does not inspect private files and cannot provide a malware-free certificate.
What the cleanup quote should explain
Expect a defined website and scope, the access needed, proposed work and a clear price. Hosting issues, unsupported components, premium licences and substantial rebuilding may require separate work. If the investigation changes our understanding of the job, we explain that before expanding the agreed scope.
After the unwanted content is removed
Cleanup should end with a record of the work and next steps, not an unexplained all-clear. If the source of the problem remains uncertain, that uncertainty belongs in the handover. If Google or a hosting company raised a warning, their own review or reinstatement process may also need attention.