Case study · Malware removal
Clean Experts
A Swiss cleaning company's hacked website, cleaned and back online after a hosting suspension
Malware cleanup for a Swiss cleaning company's hacked WordPress site: backdoors and spam removed, site back online and hardened.
- Client
- Clean Experts
- Service
- Malware removal & recovery
- Industry
- Professional Services
- Timeline
- Sep 18 – 19, 2026
- Role
- Cybersecurity Specialist · Web Developer · WordPress Developer
Overview
Clean Experts is a Swiss cleaning company based in Gossau ZH that cleans facades, floors and terraces for clients across Switzerland. Its WordPress website had been hacked. Visitors were being redirected to spam, browsers were showing a security warning, and the hosting provider had suspended the account, taking the site offline. I was brought in to remove the infection, close the way in, and get the site back online safely.
What was done
- Diagnosis of the outage, including a check of the domain's DNS and hosting setup
- Removal of malicious redirects and spam content
- Cleanup of injected code in infected files
- Removal of hidden backdoor files
- Removal of admin accounts the owner never created
- Security hardening after the cleanup
- The site restored and back online
Tech review
I handled the full recovery, working in the hosting account, the site's files and the WordPress database.
Key highlights
- 01
Diagnosis first
With the site offline, I started by comparing the domain's DNS and hosting setup with a working site on the same server. That separated hosting issues from problems inside WordPress itself, so the cleanup could focus in the right place.
- 02
Backdoors and fake admins removed too
Spam and redirects are what visitors see, but attackers usually leave more behind. Alongside them, I removed injected code from infected files, hidden backdoor files that would have let the attackers back in, and admin accounts the owner never created. Cleaning only the visible symptoms would have left the door open.
- 03
Locked down after the cleanup
After the cleanup, I secured the site with:
- a security plugin with firewall and login protection
- WordPress core, plugins and themes brought up to date
- all passwords reset
- unused plugins and themes removed
- 04
Back online
With the infection gone, the hosting account is active again and the website is working for the company's customers.
The result
The site is back online, the malware and backdoors are gone, and the hole the attacker used is closed.