Warning signs
- Visitors are redirected to unrelated sites or fake security pages.
- Google shows spam titles, strange indexed pages, or malware warnings.
- Unknown admin users, plugins, cron jobs, or theme files appear.
- Files change again after being deleted.
- Hosting account sends spam or gets suspended for abuse.
What not to do first
Do not blindly delete everything before preserving logs, backups, and timestamps. Those details help identify how the site was compromised and whether the infection spread to other sites on the same hosting account.
Cleanup help
Cyber Duct Tape provides WordPress malware cleanup for Lakewood, Denver metro, Colorado, and remote clients.