Free chapter 01 · 22 pages
Is the WordPress Site Actually Hacked?
Separate a suspicious symptom from an ordinary fault, preserve useful evidence, and decide when a full incident response is justified.
Read Chapter 1 free
Expanded first edition · 18 chapters · 293 pages
WordPress Malware Removal for Developers & Site Owners
Stop deleting whatever a scanner flags and hoping the infection is over.
Learn how to follow a real WordPress compromise across files, database rows, hidden users, cron jobs, hosting accounts, DNS, checkout pages, and reputation systems—including a complete SC 4.0.3 self-healing malware case—then prove the behavior cannot return.
Pay what you want · Minimum price
$9.99
$19.99 suggested
Choose your price at secure checkout · Instant PDF download
Please read the two free chapters before purchasing. Digital-product refunds are limited to the eligible reasons in the 7-day refund policy.
See what changed on September 4, 2026 293 pages
18 chapters
86 figures
4,500+ cleanups behind it
Accessible pricing, complete edition
The price is flexible. The field guide is complete.
I want this practical reference to remain accessible to developers and site owners in different markets. Choose what works for you—the minimum changes the price, not what you receive.
293 pages
18 chapters
86 real figures
Included future updates
Pay what you want
Minimum price
$9.99$19.99 suggested
Every amount unlocks the same complete PDF and future edition updates. Enter your preferred amount securely at checkout.
Get the complete book · Pay $9.99+Secure Lemon Squeezy checkout · Instant PDF download
Review the two free chapters before checkout. Limited 7-day refund policy.
Read before purchasing
Two complete chapters. 39 pages. Free and ungated.
No email address or payment is required. Read the investigation method in Chapter 1, then see how that knowledge can become carefully scoped professional work in Chapter 18.
Free chapter 02 · 17 pages
Freelancing with WordPress Malware Removal
Explore marketplace opportunities, an evidence-led Upwork proposal, portfolio strategy, safe service boundaries, and the limits of earnings claims.
Read the freelancing chapter free Backdoor Removal WooCommerce Skimmers Database Malware Cron Job Malware Hosting Suspension Redirect Malware Hidden Administrators Blacklist Removal SEO Spam Recovery Reinfection Analysis Self-Healing Malware Backdoor Removal WooCommerce Skimmers Database Malware Cron Job Malware Hosting Suspension Redirect Malware Hidden Administrators Blacklist Removal SEO Spam Recovery Reinfection Analysis Self-Healing Malware
Where ordinary cleanup advice stops
A clean scan is a signal. It is not proof the site is clean.
The difficult incidents are not solved by one suspicious filename. They are solved by understanding what visitors saw, what stored the payload, what executed it, who still had access, and what could restore it.
The malware comes back
A file was deleted or WordPress was reinstalled, but a cron job, backdoor, neighboring site, or retained account restores the compromise.
Only some visitors see it
The redirect or fake page appears only on mobile, after a Google visit, on the first request, or during checkout—while the owner sees a normal site.
The scanner misses the answer
A report can identify useful files without finding the database payload, hidden administrator, loader, entry path, or mechanism that recreates them.
Recovery needs proof
A loading homepage is not enough. The original trigger, affected layers, account access, checkout, warnings, and recurrence window need to be tested again.
Look inside
Real evidence, decoded code, and the reasoning between them.
These are finished pages from the book—not decorative mockups. Open any page to inspect the typography, screenshots, captions, and technical depth.
Chapter 1
Separate a strange symptom from a real compromise
Compare trusted files, visible behavior, error evidence, and independent views before deleting anything.
Chapter 12
Decode a checkout-targeting WebSocket loader
Follow the XOR-decoded host, bot filtering, checkout condition, and dynamically executed response.
Chapter 15
Trace malware that restores itself after deletion
Read the loader, identify its hidden source, and remove the restoration chain—not only its visible destination.
Appendix A
Use the correct reputation-review route
Find official lookup and review destinations for high-use browser, search, and antivirus warning systems.
Cases you can reason through
The book does not flatten every infection into the same checklist.
Each case begins with what the owner or visitor actually experienced, follows the evidence across the relevant layers, and ends with a testable recovery conclusion.
Case 01
A WooCommerce skimmer changed the checkout
A customer used their card on the site and later noticed unusual activity. The investigation follows the fake form, database storage, obfuscated loader, WebSocket connection, and persistence.
Case 02
SC 4.0.3 rebuilt itself across files and the database
Eleven incident screenshots connect PHP startup, MU plugins, drop-ins, a theme implant, ZIP archives, database payloads, and browser persistence. The chapter shows how the samples were decoded without executing them.
Explore the focused case-study bookCase 03
One account suspension became a multisite cleanup
The host report was a starting map—not proof of full scope. Every site, shared account layer, backdoor, access path, and reinfection source still had to be checked.
Case 04
A clean file scan still failed Google review
The missing evidence was stored in WordPress content rows. Reinstalling core could never remove the database payload that selected visitors still received.
Inside all 18 chapters
From the first symptom to a monitored recovery.
The sequence follows the work of a real investigation: diagnose before changing evidence, clean every affected layer, and follow each visible symptom to its source. It then shows why malware returns, applies the method to the complete SC 4.0.3 case, and turns the verified recovery into a monitored baseline.
Start with two free chapters I
Diagnose Before You Delete
Prove the symptom, preserve evidence, understand likely access, and determine the full scope.
- 01 Is the WordPress Site Actually Hacked?
- 02 How Does a WordPress Site Get Hacked?
- 03 What to Do Before Cleaning Malware
- 04 Find What Else Is Infected
II
Clean Every Layer
Repair files and database state, then inspect the hosting account, server behavior, and DNS.
- 05 Remove Malware from WordPress Files
- 06 Remove Malware from the WordPress Database
- 07 Clean the Hosting Account, Server, and DNS
III
Follow the Symptom
Trace redirects, SEO spam, fake components, hidden users, skimmers, suspensions, and blacklist warnings from the visible symptom to its source.
- 08 Find and Remove WordPress Redirect Malware
- 09 Remove WordPress SEO Spam and Hacked URLs From Google
- 10 Find and Remove Fake WordPress Plugins and Themes
- 11 Remove Unwanted and Hidden WordPress Administrators
- 12 Find and Remove WooCommerce Credit-Card Skimming Malware
- 13 Recover a Suspended Hosting Account or Domain
- 14 Remove Website Blacklists and Security Warnings
IV
Keep the Site Recovered
Find what can recreate the compromise, work through a complete self-healing malware case, close retained access, and monitor the recovered site.
- 15 Stop Malware from Coming Back
- 16 Case Study - SC 4.0.3 Self-Healing WordPress Malware
- 17 Secure and Monitor a Recovered Site
V
Turn Recovery Skill into Professional Work
Present malware-removal skills honestly, find suitable opportunities, protect client systems, and keep learning through authorized practice.
- 18 Freelancing with WordPress Malware Removal
Author
MD Pabel
Field experience, turned into a method
Built from more than 4,500 WordPress malware cleanups since 2018.
I wrote this because the difficult part of malware removal is rarely pressing Delete. It is deciding what the evidence proves, what else must be connected, what must be preserved, and when a recovery can be trusted.
The investigations use real screenshots and retained artifacts from client work, with domains and sensitive details removed. Where a scanner helped, the book shows how. Where it missed the backdoor or database payload, the book shows that too.
More about my workReader reviews on Leanpub
What readers say after opening the field guide.
“This book is an excellent and highly practical resource for anyone seeking to understand, detect, and effectively remove malware from WordPress websites. What I particularly appreciate is its hands-on approach. The book goes beyond simply explaining the nature of malware and provides practical guidance on identifying infections, investigating compromised files, understanding common attack methods, and following the appropriate steps to clean, restore, and secure a WordPress website. A professional, practical, and worthwhile reference for WordPress security. Highly recommended for WordPress developers and site owners!”
“A practical and easy-to-follow guide for WordPress security. It provides clear steps for detecting, removing, and preventing malware. Highly recommended for WordPress developers and site owners.”
“This book stands out because it treats malware removal as a methodical investigation rather than just relying on automated scanners. The breakdown of real-case scenarios—like hidden admin accounts and database-level injections—is clear and actionable. Perfect for freelancers, developers, and agency owners who want to resolve complex site infections permanently. Five stars!”
Choose your storefront
Prefer another storefront?
Direct purchase gives you the simplest checkout and later downloads through My Library. Leanpub and Gumroad remain available as marketplace alternatives.
New editions and field notes
Hear about meaningful book updates.
Join for substantial chapter improvements, new preview material, and selected malware case notes—not a daily marketing sequence.
The complete first edition is available now Only meaningful release notes Unsubscribe at any time
You are on the book list.
Thank you. Both complete free chapters are available above without signing up.
Questions, answered
Before you start reading.
Is the complete first edition available? +
Yes. Choose what you pay from a $9.99 minimum, with $19.99 suggested. Every purchase includes the complete 293-page expanded first edition, 18 chapters, 86 real screenshots and figures, an introduction, a conclusion, a website-reputation review appendix, and future edition updates.
Who is this book for? +
It is written for WordPress developers, freelancers, agency teams, maintenance providers, technical site owners, and support professionals responsible for investigating or recovering hacked WordPress websites.
Do I need to be a malware researcher? +
No. The code examples are explained from behavior and evidence. You should be comfortable with WordPress, hosting files, databases, and basic browser developer tools, but you do not need reverse-engineering experience.
Is this a list of security plugins and scanner commands? +
No. Scanners are treated as evidence sources, not final conclusions. The book teaches how to connect symptoms to files, database rows, accounts, scheduled tasks, server state, DNS, and persistence.
Are the two free chapters really free? +
Yes. You can download the complete opening chapter and Freelancing with WordPress Malware Removal without providing an email address or payment.
Can I download the book again later? +
Yes. Open My Library and enter the email address used at checkout. Lemon Squeezy will email you a secure sign-in link, where you can download the current edition and view your receipt.
What is the refund policy? +
Because this is a digital book, purchases are generally non-refundable after access. Eligible duplicate-purchase, unresolved-access, or material-misrepresentation requests may be submitted within 7 calendar days. Please read the free chapters before purchasing.