Should I restore a backup instead?

Only if you know the backup is from before the break-in and you also close the hole that was used. Restoring an infected backup, or a clean one with the same vulnerable plugin, puts you back where you started.

Will my Google ranking recover?

Usually, once the warning is lifted and the spam pages are gone from the index. Requesting a review in Search Console is part of the job.

My host says the whole server is compromised. Can you clean that?

If the attacker has root on a server you control, the honest fix is to rebuild or move, not to clean. We will tell you that up front rather than charge for a cleanup that will not hold.

How to tell if your website is hacked, and what to do first

A hacked site rarely announces itself. More often a customer tells you, Google puts a warning in front of your listing, or your host suspends the account. Here is how to confirm it, what to do in the first hour, and what a cleanup has to include so it does not come back.

The signs

Google shows "This site may be hacked" or "This site may harm your computer" under your listing, or Search Console lists a security issue.
Visitors who arrive from Google get sent to a different site, but it looks fine when you type the address yourself.
Pages you never wrote show up in search results, often in another language or selling pills and designer goods.
There is an administrator account you did not create, or your own password stopped working.
Your host emailed about malware, outbound spam, or a resource limit, or the account is suspended.
Files you did not touch have today's date, or there are new .php files in the uploads folder.
Your domain is on an email blocklist and your messages bounce.

What to do in the first hour

Take a copy of the site as it is, files and database, before anyone cleans anything. The copy is how the entry point gets found.
Change the passwords for the hosting account, WordPress admin and the database, and sign out every session. Do not reuse a password from anywhere else.
Open Google Search Console and read the Security Issues report; it names the pages Google saw.
If the site is sending spam, put it in maintenance mode so the host does not suspend the account.
Do not delete suspicious files one by one and call it fixed. That is how reinfections start.

What a real cleanup includes

Removing the visible malware is the easy part. A cleanup that holds also finds the way in, which is almost always an outdated plugin or theme, a reused password, or a second infected site on the same account. Then it removes every backdoor left behind, not just the one that was noticed, updates the core and every plugin, hardens the obvious weak spots, and asks Google and the host to lift their warnings. The last step is watching the site for a few weeks, because a missed backdoor shows itself quickly.

Why it comes back

Reinfection within a month is the most common complaint people have about cheap cleanups, and the reasons are the same every time: a backdoor was missed, the vulnerable plugin was left in place, or the password that let the attacker in was never changed. Our cleanup carries a 30-day guarantee for exactly that reason. If the same infection returns, we clean it again at no charge.

Questions people ask

Should I restore a backup instead?: Only if you know the backup is from before the break-in and you also close the hole that was used. Restoring an infected backup, or a clean one with the same vulnerable plugin, puts you back where you started.
Will my Google ranking recover?: Usually, once the warning is lifted and the spam pages are gone from the index. Requesting a review in Search Console is part of the job.
My host says the whole server is compromised. Can you clean that?: If the attacker has root on a server you control, the honest fix is to rebuild or move, not to clean. We will tell you that up front rather than charge for a cleanup that will not hold.