WordPress Security and Malware Cleanup in Kenya: Staying Off Google's Blacklist

The worst part of a hacked website is rarely the website. It is the Google warning that appears next to your business name, telling every customer who searches for you that the site may harm their computer.

Getting that removed takes days. Preventing it takes a few hours of work you can do this week. This is how WordPress sites in Kenya actually get compromised, how to tell whether yours already is, and what a proper clean-up involves.

How WordPress Sites Actually Get Hacked

Almost never because somebody targeted your business. Bots scan the whole internet for known weaknesses and take whatever they find. In order of how often we see it:

1. An out-of-date plugin or theme. Patchstack recorded 11,334 new vulnerabilities across the WordPress ecosystem in 2025, with 91% of them in plugins.
2. A weak, reused or shared admin password, with no two-factor authentication and no limit on login attempts.
3. An abandoned plugin, deactivated but never deleted, whose files still sit on the server.
4. An unsupported PHP version, or a server the host has not patched.
5. A compromised supply chain, where a legitimate plugin update itself carries malicious code.
6. A stolen hosting or FTP credential, often from a developer's infected laptop.

What Has Been Happening Lately

Four incidents from recent weeks, each illustrating a different route in:

The PHP one matters most this month, and we have written it up separately in what the PHP security alert means for Kenyan websites.

Signs You Are Already Compromised

• Administrator accounts you did not create
• Visitors arriving from Google being redirected somewhere else, while direct visits look normal
• Pages you never wrote appearing when you search site:yourdomain.co.ke, often about pharmaceuticals, loans or gambling
• New PHP files in wp-content/uploads, where no PHP file belongs
• Your host suspending the account, or warning about unusual outbound email
• A warning in Google Search Console under Security Issues
• Customers reporting warnings that you cannot reproduce on your own phone

Blacklists, and What They Cost You

Once Google's Safe Browsing system flags a site, the damage spreads fast. Chrome, Firefox and Safari show a full-page red warning. Your Google ads may stop. Some email providers start treating mail from your domain as suspicious. And the warning is visible to everyone who searches your business name, including customers who were never going to visit the site.

Getting removed requires cleaning the site properly and then requesting a review through Google Search Console. A review usually takes a few days, and a failed review because the site was not fully cleaned restarts the clock. This is the main reason a rushed clean-up costs more than a careful one.

A Proper Clean-Up, in Order

The step people skip is the fourth one. Restoring last week's backup without finding the entry point means the same bot returns within days, and the second compromise is usually worse because the first one left a door open.

Hardening So It Does Not Happen Again

The WordPress project's own hardening guidance, plus what we apply on every site we maintain:

• Update core, plugins, themes and PHP on a schedule, tested on a staging copy first.
• Delete what you do not use. A deactivated plugin is still code on your server.
• Two-factor authentication on every admin, plus limits on failed logins.
• Least privilege: files 644, directories 755, wp-config.php tighter, and only wp-content writable by the web server.
• Disable the file editor with define( 'DISALLOW_FILE_EDIT', true ); so a stolen admin login cannot edit code directly.
• Block PHP execution in the uploads folder, which stops the most common backdoor outright.
• Daily off-site backups, with a restore you have tested at least once.
• A firewall in front, and monitoring that tells a person when something changes.

When to Call Someone

Do it yourself if the site is small, you have a clean backup from before the problem, and you can find the entry point. Call for help when any of these is true:

• The site takes payments, holds customer data, or is your main sales channel
• Google has already flagged it, or your host has suspended the account
• You cannot find how they got in, or the infection returns after cleaning
• You have no backup from before the compromise
• It has happened more than once this year

We clean and harden hacked WordPress sites, and malware removal is included in every maintenance plan from KES 5,000 a month rather than billed as an emergency. If you are not on a plan, send us the site and the hosting login and we will quote the clean-up before starting.

Frequently Asked Questions

How do WordPress sites actually get hacked?

Almost never because somebody targeted your business. Bots scan the internet for known weaknesses. In order: an out-of-date plugin or theme, a weak or reused admin password with no two-factor, an abandoned plugin that was deactivated but never deleted, an unsupported PHP version, a compromised plugin update, or stolen hosting credentials.

How do I know if my website is infected?

Look for admin accounts you did not create, visitors from Google being redirected elsewhere, pages you never wrote appearing when you search site:yourdomain, new PHP files in your uploads folder, your host suspending the account, or a warning in Search Console. Always test in a private window from a phone, arriving through a Google search, because malware often hides from the logged-in owner.

What happens when Google blacklists my site?

Chrome, Firefox and Safari show a full-page warning to anyone visiting, the warning is visible to everyone searching your business name, ads may stop and email deliverability can suffer. Removal requires cleaning the site properly and requesting a review in Search Console, which takes days, and a failed review restarts the clock.

Can I just restore a backup?

Not on its own. If you do not find how they got in, the same bot returns within days and the second compromise is usually worse. Preserve logs, find the entry point, rebuild from clean sources, remove persistence such as unknown admins and backdoor plugins, rotate every credential, patch everything including PHP, and only then go back online.

What recent WordPress incidents should I know about?

A WordPress core flaw fixed in version 7.1.2 on 22 September 2026 that was being exploited within hours. A Rank Math PRO supply chain compromise where a malicious version was live for about eleven hours on 15 and 16 October. An UpdraftCentral key compromise on 18 and 19 October that installed backdoor plugins. And the critical PHP flaws of 21 October, which are fixed by the host updating PHP rather than by updating WordPress.

Do you clean hacked websites?

Yes. Malware removal is included in our maintenance plans from KES 5,000 a month rather than billed as an emergency. If you are not on a plan, send us the site and hosting login and we will quote the clean-up before starting.