Diagnose before deleting
Confirm the symptom, preserve evidence, and determine whether you are looking at a compromise, a false positive, or only one visible part of a larger incident.
Agency field guide · First edition
Give your team a malware investigation process—not another list of scanner commands.
WordPress Malware Removal for Developers & Site Owners turns real WordPress cleanup cases into a repeatable path from first symptom to verified recovery.
PDF · 256 pages · 16 chapters · Published on Leanpub
256pages
16practical chapters
70screenshots & figures
4,500+cleanup cases behind it
Why this book exists
“The scan is clean” is not the same as the incident is over.
A hacked site may look normal while selected visitors are redirected, an administrator remains hidden, checkout code waits for a payment page, or a scheduled task restores deleted malware. A detection list tells you what one tool recognised. It does not automatically explain the scope, the behaviour, or the persistence.
The book teaches the investigation around the finding: what loads it, what writes it, where else it appears, what access remains, and how to reproduce the original symptom after cleanup.
Treat scanner results as evidence—not as the complete diagnosis.
A shared recovery method
Four phases your team can use under pressure.
The chapters follow the order of a real incident, while still working as a reference when you need to investigate one specific symptom.
Clean every affected layer
Work through WordPress files, the database, users, hosting, cron, server configuration, DNS, CDN settings, and neighbouring sites without treating a scanner report as the whole answer.
Follow the behaviour
Trace redirects, SEO spam, fake plugins, hidden administrators, checkout skimmers, suspensions, and blacklist warnings back to the code or data that produces them.
Prove the recovery holds
Remove persistence, close remaining access paths, retest the original trigger, establish a clean baseline, and monitor the recovered site for meaningful change.
Inside the book
See the evidence—not just the final advice.
Real screenshots, decoded code, investigation notes, and recovery decisions show how each conclusion was reached.
Open the Free Sample
Complete Chapter 1 · No email required
Cases, not hypotheticals
The difficult part begins after the first finding.
Each case is used to teach a transferable decision: how far to expand scope, what to decode, what to verify, and what can still bring the compromise back.
Persistence
The hidden system-control restorer
A backup-like component watched the site and restored malicious state after cleanup. The lesson is to investigate what recreates a finding—not merely delete the finding again.
Payment-page malware
The checkout that changed for customers
After a customer reported unusual card activity, the investigation uncovered a WooCommerce skimmer using a remote WebSocket loader and a fake payment interface targeted at checkout.
Hosting suspension
One suspended site versus an infected account
A strict host contained one compromised site. In another account, malware had time to move across several installations. The correct recovery scope depended on what the host isolated—and what it did not.
Recovery verification
The blacklist review that failed
The visible malware had been removed, but a hidden database payload remained. Google rejected the first review, illustrating why delisting starts with complete cleanup, not with the submission form.
Built for real client work
A reference for the desk, the incident, and the handoff.
Use the book cover to cover once, then return to the relevant chapter when a live case puts your team under time pressure.
Onboard a developing investigator
Teach the difference between detecting a suspicious artifact and proving how an incident works.
Give senior developers a field reference
Jump directly to database infections, checkout skimmers, cron persistence, suspensions, redirects, or blacklists.
Make recovery QA repeatable
Use the verification questions to check that the original behaviour is gone and the site remains stable after cleanup.
Explain the work to a client
Communicate why restoration, cleanup, delisting, and monitoring are related—but not interchangeable—parts of recovery.
4,500+hacked WordPress sites investigated and cleaned
Straight answers
Before you open the book.
If your situation is unusual, send the details. You will get a direct answer—not a sales maze.
No. It focuses on malware investigation, cleanup, recovery, and verification. The final chapter introduces the essential hardening and monitoring steps after recovery, but broader WordPress security is intentionally kept outside the main scope.
It is written for WordPress developers, agency support teams, and technical site owners. You should understand the WordPress dashboard and basic hosting concepts. File, database, browser-tool, and code examples are explained in context.
No. Scanner results are useful evidence, but scanners can miss modified payloads, database malware, conditional behaviour, cron jobs, abused legitimate files, and backdoors. The book combines tool output with manual investigation and behavioural testing.
Yes. Chapter 1 is available as a complete PDF with no email signup required.
The 256-page first edition is available through Leanpub. The author page contains the latest book details, sample, and update notes.
Keep the process beside you