WordPress Maintenance and Malware Removal

What does WordPress maintenance include?

It covers the routine work that stops a site from breaking or being hacked: tested updates, backups you know can be restored, uptime checks and a regular review of what is installed.

• Updates tested before release. Core, plugin and theme updates go to a staging copy first. I click through forms, login, search and checkout, and only then update production.
• Backups with restore tests. Files and database are copied off the server on a schedule. A backup that has never been restored is only a hope, so I restore one into a test environment and confirm the site loads.
• Uptime checks. An outside monitor requests your homepage and one key page and alerts me when the response or the expected text is wrong. A hosting panel that says the server is up does not prove the site works.
• Housekeeping. Unused plugins and themes come off, administrator accounts are reviewed, and old revisions and spam comments are cleared from the database.

I agree maintenance as an ongoing arrangement after seeing the site, because a small brochure site and a busy shop need different attention. Alerts reach me and I respond during my working day in India Standard Time.

How do you remove malware from a hacked WordPress site?

I follow the same eight steps every time, because cleaning visible symptoms without finding the entry point is how sites get reinfected within days.

1. Isolate and snapshot. I limit public access, usually by IP allow-list or maintenance mode, and copy all files and the database before changing anything. That gives me evidence and a way back.
2. Scan. I run server-side and WordPress-aware scanners, then search by hand for typical code such as eval(base64_decode(, gzinflate and recently modified PHP files.
3. Check the usual hiding places. wp-content/uploads should hold no PHP files. wp-content/mu-plugins loads automatically and is easy to miss. wp-config.php, .htaccess and .user.ini can carry injected code or an auto_prepend_file line. I list every administrator account, since attackers add their own, and search the database for injected scripts in posts and in wp_options.
4. Replace core and plugin files from fresh copies. I compare against official checksums and reinstall instead of hand-editing infected files.
5. Rotate secrets. New keys and salts in wp-config.php log everyone out. Then new passwords for WordPress admins, the database, the hosting panel, SFTP and any API keys.
6. Close the entry point. From logs and file dates I find the likely way in: an outdated plugin, a nulled theme, a stolen password, or another infected site on the same account. Until that is fixed, the site will be hit again.
7. Harden. I disable the built-in file editor, block PHP execution in uploads, correct file permissions, add login protection and remove unused code.
8. Monitor. I watch for file changes, rescan after a day and after a week, and check Google Search Console for security warnings.

The checksum comparison in step 4 uses WP-CLI. The plugin check covers plugins hosted on wordpress.org only:

wp core verify-checksums
wp plugin verify-checksums --all

What causes common WordPress problems, and what do you do?

Most problems have a short list of usual causes. I start with those and confirm them from logs before changing anything.

Can you migrate my WordPress site to a new host?

Yes. I copy files and database to the new host, test the site there before DNS changes, and switch at a quiet time. URL changes go through a tool that understands serialized data, such as wp search-replace, because a plain find-and-replace in SQL corrupts theme and plugin settings. Afterwards I check permalinks, SSL, email delivery, scheduled tasks and forms. For larger server projects, see server migration and backup.

Do you build custom WordPress plugins?

Yes. I have built more than 50 WordPress plugins, from small admin utilities to WooCommerce extensions and connections to outside systems, including WHMCS. A plugin is the right home for custom logic because it survives a theme change, which code pasted into functions.php does not. I use nonces and capability checks on every action, sanitize input, escape output, run queries through $wpdb->prepare() and clean up on uninstall. For a WordPress site that talks to a billing system, see WHMCS API integration.

How do you approach speed work?

I measure real page timings first and change one thing at a time. Typical wins are page caching, correctly sized images, fewer or lighter plugins and a smaller database autoload. I do not promise a particular score, because results depend on your host, theme and plugins.

What can I not do for a WordPress site?

There are cases where I decline the work or limit what I promise.

• I do not install, clean around or keep nulled themes and plugins. They are a common entry point for infections. I replace them with licensed versions or alternatives.
• If the site was heavily altered and no clean backup exists, I cannot promise full recovery. I rebuild from what can be verified as clean and tell you what could not be saved as soon as I know.
• I cannot control how fast Google lifts a warning. I submit the review and Google decides.
• I cannot protect a site on a hosting account shared with other infected sites. The account has to be cleaned or the site moved.

What does it cost?

I quote a fixed price within one business day of the scoping call and a first look at the site, or work hourly at $55 to $65 per hour. Maintenance is quoted as a recurring arrangement once I know what the site needs. If the site sits on your own VPS, server security hardening closes the gaps at server level. The terms are on how I work.