In this guide:
- A direct, side-by-side comparison of DIY cleanup and professional removal against the same criteria.
- When attempting it yourself is reasonable, and when it usually isn’t.
- What we’d check first, and the point at which we’d tell a business to stop and get help.
- What a professional WordPress malware removal service should actually include.
- A short decision checklist to work through before you start.
This is for UK business owners and site managers who’ve found malware on their WordPress site and are trying to decide whether to fix it themselves or pay someone to do it. It won’t teach you how to remove the malware step by step; it’s here to help you make the DIY-or-professional decision with a clear head, before you’ve spent an evening in the file manager.
Why This Decision Is Harder Than It Looks
Removing the malicious code itself is usually the easy part. Most infections show up as injected scripts, spam links, unfamiliar admin users, or files that don’t belong in your theme or uploads folder, and a scan will often point straight at them. The hard part is finding every way the attacker got in and made sure they could get back in, which can include a hidden file elsewhere in the site, a modified core file, or a scheduled task hidden in the database. In our experience, sites that get “cleaned” and reinfected within a week almost always had one of these missed rather than a fresh attack. That’s the risk you’re weighing up when you decide whether to do this yourself.
DIY vs Professional WordPress Malware Removal: Side by Side
Both routes can get a site clean. They differ in how much time and risk you’re taking on, and what happens if something is missed.
| Criteria | DIY cleanup | Professional service |
|---|---|---|
| Technical skill needed | Comfortable with file managers, phpMyAdmin or a database tool, and reading PHP well enough to spot what doesn’t belong | Handled by someone who does this routinely and knows what’s normal versus injected |
| Typical time investment | Several hours to a full day for a straightforward case; longer if the entry point isn’t obvious | Often same-day to 24 to 48 hours, depending on the size of the site and infection |
| Tools required | A malware scanning plugin, a clean copy of WordPress core to compare against, and a tested backup | Provider’s own scanning and forensic tools, plus access to your hosting and admin |
| Risk of missing a backdoor | Higher, particularly on a first attempt, since backdoors are deliberately disguised to look like normal files | Lower, because checking for backdoors and re-checking after cleanup is part of the process |
| Downtime and business impact | Site is often left live or only partially offline while you work through it | Site can usually be isolated and worked on with less disruption to visitors |
| Cost | No direct fee, but your own time has a cost, and a wrong step can mean a full rebuild | A one-off fee; see our WordPress malware removal cost guide for what typically affects the price |
| Prevents reinfection afterwards | Only if you also harden the site properly once it’s clean, which is easy to skip when you’re relieved it’s working again | Usually included as part of the service, or available as ongoing monitoring |
| Best suited to | A simple, low-stakes site with a clear, single point of infection and a confident admin | Any site taking payments, holding customer data, generating enquiries, or where you can’t find the entry point |
When DIY Cleanup Is Worth Attempting
DIY is a reasonable option when all of the following are true: you have a recent, tested backup taken before you start; the infection looks contained, such as a single injected script or a handful of spam pages, rather than affecting the whole site; you’re able to compare your WordPress core files against a known-clean copy to spot what’s changed; and the site isn’t taking payments or storing customer data that would raise the stakes if you get it wrong. The WordPress.org hardening handbook recommends taking a full backup of the site as it stands, infection included, before you touch anything, precisely so you have a fallback if a cleanup step goes wrong.
When You Should Stop and Bring in a Professional
We’d recommend treating a DIY attempt as a single, time-boxed try rather than an open-ended project. Stop and get professional help if any of these apply:
- You’ve spent a few hours and still can’t identify how the attacker got in.
- The site is infected again shortly after you cleaned it, which usually means a backdoor was missed rather than a new attack.
- The site processes payments, stores customer or staff personal data, or generates enquiries you can’t afford to lose.
- You’re not confident distinguishing a legitimate WordPress core file from a modified one.
- Search engines or your host have already flagged or suspended the site, and you need it back up quickly.
If you recognise your own site in the why does my WordPress site keep getting hacked pattern, that’s usually a sign a previous cleanup, DIY or otherwise, missed the actual entry point, and repeating the same steps is unlikely to fix it this time either.
What a Professional WordPress Malware Removal Service Should Include
Not all “malware removal” is the same scope. Before paying for one, check whether it normally includes:
- Identifying and removing the malicious files, database injections and unauthorised users, not just the visible symptom.
- Finding and closing the entry point, so the same vulnerability can’t be used again.
- Checking for backdoors left behind for future access.
- Removing any Google or browser security warnings once the site is verified clean.
- A written summary of what was found and fixed.
It’s worth being clear about what malware removal doesn’t cover. A cleanup fixes an active infection; it isn’t a full security audit or a guarantee the site won’t be targeted again, particularly if the same outdated plugin or weak password that let the attacker in the first time isn’t also addressed. Our own WordPress malware removal service covers cleanup and hardening together for this reason, and a rolling WordPress care plan is the usual next step if you want ongoing monitoring so you’re not making this decision again in six months.
If Customer or Staff Data May Have Been Affected
If your WordPress site stores personal data, such as a customer database, order history, or form submissions, and you think the hack may have exposed it, this becomes a data protection question as well as a technical one. Under UK GDPR, if a personal data breach creates a likely risk to people’s rights and freedoms, you must notify the Information Commissioner’s Office, where feasible, within 72 hours of becoming aware of it, and you must also tell the affected individuals without undue delay if the risk to them is high (ICO, UK GDPR data breach reporting). The ICO provides a self-assessment tool if you’re unsure whether a specific incident meets that threshold. Separately, the National Cyber Security Centre defines a cyber incident as unauthorised or attempted unauthorised access to your systems, which includes malware infections, and its Small Business Guide sets out a five-step response and recovery process; if you’re dealing with a live attack right now, its 24-hour line is 0300 123 2040 (NCSC, Small Business Guide: Response & Recovery). This is general information rather than legal advice; if you’re unsure whether your incident needs reporting, use the ICO’s self-assessment tool or speak to a professional.
Decision Checklist: Which Route Should You Take?
Work through these before you start. As an illustrative example, a brochure site with no customer data, a single injected script, and a confident admin who has a tested backup leans toward DIY; an ecommerce site with a database-level infection and no idea how the attacker got in leans firmly toward professional help.
- Do I have a recent, tested backup taken before I start?
- Does the site store customer data, staff data, or take payments?
- Can I identify how the attacker got in, not just what they left behind?
- Has this site been hacked before, or cleaned once already and reinfected?
- Do I know how to check WordPress core files against a clean copy?
- Can the business afford the site being down or degraded while I work on it?
- Am I confident I can also harden the site afterwards, not just remove the infection?
Answering “no” or “not sure” to two or more of these is a reasonable point to bring in a professional rather than pushing on.
Frequently Asked Questions
Can I remove WordPress malware myself for free?
Yes, using a scanning plugin and manual checks against core files, provided you have a backup and the infection is contained. It costs your time rather than money, but a missed backdoor can mean redoing the work or, worse, losing data.
How do I know if the malware is actually gone?
A clean scan result on its own isn’t enough, since scanners rely on recognising known malware patterns and can miss custom or well-hidden code. Check that unfamiliar admin users are gone, core files match a clean copy, and the site stays clean for several days rather than reappearing.
Will a professional guarantee my site won’t be hacked again?
No reputable provider should promise that. What a proper service can do is remove the current infection, close the specific vulnerability that was used, and put monitoring in place so any repeat attempt is caught quickly rather than sitting undetected.
Is it cheaper to fix it myself?
Usually in direct cost, yes, but not always in outcome. If a DIY attempt misses the entry point and the site is reinfected, or you end up needing a professional afterwards anyway, you’ve spent your own time and still pay for the fix. Our WordPress malware removal cost guide sets out what professional cleanup typically costs in the UK.
Not sure which way to go?
Tell us what you’re seeing and we’ll give you a straight answer on whether this is a DIY job or one worth handing over.
There’s no universally right answer here, only the right answer for your site, your data and your confidence level. If in doubt, the safer default is to treat customer-facing or data-holding sites as a professional job, and reserve DIY for low-stakes sites where a mistake costs you an evening rather than your customers’ trust.