You remove an unfamiliar file, the website starts working again and then the same warning or redirect returns. If your WordPress website keeps getting reinfected, repeating the last quick fix is unlikely to explain what is happening.

I would treat the recurrence as evidence to investigate. It does not automatically prove a new attack or identify who was responsible. The distinction matters when you are deciding what work to authorise and whether the original recovery was complete.

Has the infection returned, or is an old result still visible?

Start by being precise about the symptom. A newly recreated malicious file is different from an old Google result that has not yet changed. So is a host locking the same infected file again after its permissions were changed.

Record what you saw, where you saw it and when. Ask the person investigating to compare that with the previous findings. If the problem is mainly search results, the guide to Japanese spam in Google explains why search clean-up and website recovery are connected but separate tasks.

A visible symptom can be only part of the compromise

A backdoor is an unauthorised way to access or control a site. Removing an obvious spam page does not establish whether one remains elsewhere. Wordfence’s guide to finding and removing backdoors explains why these can coexist with other malware.

That is why I want a recovery report to say what was investigated, rather than simply “the bad file was deleted”. If the original entry point cannot be established from the available evidence, that uncertainty should be recorded rather than replaced with a confident guess.

Check software, accounts and the wider hosting space

Outdated or untrusted software, unnecessary access and weaknesses outside the main WordPress installation all deserve attention. The WordPress hardening handbook covers trusted software sources, updates, limited access, backups and the hosting environment. Its aim is risk reduction, not a promise of perfect security.

An abandoned copy of a website can matter too. Wordfence warns that an old, publicly accessible WordPress installation in a subfolder may remain vulnerable even when the main site is maintained. Its clean-up guide recommends looking beyond the live installation and comparing affected software with trusted originals.

For a business owner, the practical question is: “Does the agreed investigation cover the relevant hosting account and access routes, or only the pages I can see?” The answer should be reflected in the scope and cost.

An infected backup can put the problem back

A recent archive is not automatically a clean recovery point. In my work on Tori Bond Celebrant’s website, the downloaded archive contained malicious files. Restoring that whole archive would have reintroduced those files.

We also worked through missing WordPress files and regained dashboard access. That was useful progress, but it did not establish that every security check had been completed. The final scan, affected software replacements, credential changes and original entry point still needed confirmation.

This is an important distinction in any recovery conversation: “I can log in again” describes functionality. It is not the same statement as “the investigation and clean-up have been verified”.

A scanner is a tool, not the whole recovery process

Check whether the scan actually finished and whether any areas were skipped. Wordfence describes its plugin as detection and clean-up support, not an automatic restoration of everything an attacker may have changed. Database content and other installations can need additional investigation. See Wordfence’s explanation of its capabilities and limits.

Useful handover questions include:

What was found, and what was removed or replaced?
Which checks completed, and which were limited or outstanding?
Which accounts and access routes were reviewed?
Which backup is now suitable for recovery?
Who will handle updates and respond to new alerts?

Agree the next stage rather than repeating the same fix

I offer WordPress hack recovery with a clear scope, hourly work and costs agreed before proceeding. If further investigation is needed, we discuss it before expanding the job.

Ongoing security support and maintenance are separate options. You do not have to take a monthly contract to ask for help with recovery.

If your host has blocked the site, also read what to do after a hosting suspension.