Maintain & recover
A hacked WordPress recovery is complete only when the malicious persistence path is removed, the site is updated and hardened, legitimate functionality is verified, and search engines receive the correct status for injected URLs.
Discuss the requirementDirect answer
WordPress malware recovery should restore a clean, supported production site and make hacked or injected URLs disappear permanently instead of redirecting them to unrelated pages.
Current facts
Permanent removal still requires the page/content to be removed or otherwise blocked appropriately.
Source: GoogleA public vendor example only; not a universal project price.
Source: SucuriAnswer scope
The first task is to preserve evidence and stop continued changes. Credentials, administrator accounts, plugins, themes, uploads, scheduled tasks and hosting access may all need review depending on the compromise.
A visual cleanup is not enough if the attacker’s persistence mechanism remains active.
WordPress security guidance emphasizes keeping core, plugins and themes current. Recovery should distinguish legitimate custom code from injected files and remove abandoned or vulnerable components that are no longer required.
Where a clean known-good copy exists, comparison is safer than guessing which obfuscated file belongs.
Old hacked URLs should not redirect to the homepage. If the page is permanently gone, a real 404 or 410 response lets search engines process that removal. Known spam patterns can use 410 while random nonexistent paths can remain normal 404s.
Canonical tags are not a replacement for removing a hacked URL that should no longer exist.
Google’s current documentation says a Removals request is temporary, lasting about six months. The permanent fix must still remove or update the content or otherwise make the URL unavailable to Google.
After cleanup, submit only the clean canonical sitemap and monitor whether new injected paths continue to appear.
Hardening can break AJAX, REST requests, forms, checkout, cron or integrations if rules are applied too broadly. Recovery acceptance should therefore include important customer actions as well as a security scan.
A secure site that cannot process a lead or order is not a successful recovery.
Questions
No. Unrelated redirects can confuse users and search engines. Permanently removed injected pages should normally return a genuine 404 or 410.
Google currently describes Removals requests as temporary, about six months. A permanent technical removal is still required.
No. Recovery should also address persistence, credentials, vulnerable components, database changes, scheduled tasks and the search-index cleanup path relevant to the incident.
Evidence
First-party platform documentation and clearly labelled public market benchmarks used for factual claims on this page. A source link does not imply endorsement.
Current WordPress security guidance, including the importance of keeping core, plugins and themes updated.
Hardening guidance for authentication, file access and common attack paths.
Permanent removal requirements and the temporary nature of Search Console removal requests.
Current canonical URL guidance for protocol, duplicate, filter and accidental URL variants.
Public malware-removal plan pricing used only as a current market example, not as a universal project price.
Start a conversation
Send the current setup and the result you need. I will review the problem and suggest the most practical next step.