The Japanese keyword hack
Thousands of Japanese pages selling fake brands appear under your address in Google.
On a client’s site we removed 1,459 of them, and the hidden backdoor the attackers had left behind.
WordPress security to keep your business online.
Send us your site’s address. Within 2 working days you get a written check: your PHP version, what Google shows for your site, and what to do next.
Who sees the hack?
Most hacks hide from the owner. The spam shows only to Google, or to visitors who arrive from a search, so your site can look fine to you.
In 2025 one scanner alone found 834,661 hacked websites. GoDaddy Annual Cybersecurity Report, 2026
Google sees it.
Our free check looks where Google looks.
Casino and pharma spam
Google shows your pages selling casino bets, Viagra or Cialis.
Your real pages sink under the spam.
Spam only Google sees
Your site looks normal to you, but Google is shown a different one, full of spam.
Your rankings fall and you can’t see why.
Your customers see it.
Our free check often catches these.
Redirects
Visitors from Google, or on a phone, land on a scam site. You see your normal page.
Customers think you sent them there.
The fake “I’m not a robot” check
Your visitors are told to run a command to prove they’re human.
It installs malware on your customers’ computers.
Card skimmers
Nothing. The sale goes through as normal.
Your checkout sends customers’ card details to criminals.
Spam email
Your own emails start landing in spam folders.
Your server sends spam under your name, and quotes and invoices go unread.
Nobody sees it.
Only a clean-up finds these, from inside the site.
Hidden admin users
An administrator you never made, hidden from your Users screen.
Whoever made it can come back whenever they like.
Backdoors
A hidden way back in, tucked among your site’s own files.
It rebuilds the hack each time it’s removed.
PHP 8.2 gets its last security fix.
As of 28 October, 56.8% of WordPress sites run PHP 8.2 or older (WordPress.org).
In our check of Carlow business websites on 22 October, 59 of the 105 that show their PHP version run one with no security fixes.
What we do after the check.
Example check
yourbusiness.ie
- PHP version
- PHP 7.4: no security fixes since November 2022Fix
- WordPress
- Up to dateOK
- Google’s hacked warning
- NoneOK
- Spam pages on Google
- None foundOK
- Browser blocklists
- Not listedOK
- What to do next
- Move to PHP 8.4, €99
For a WordPress site that’s kept up to date
Move to a supported PHP
We back it up, update WordPress, the plugins and the theme, switch PHP, test your forms, bookings and checkout, and watch the error log for a day.
€99
For a site that’s been hacked
Clean up a hacked site
We remove the malware and any backdoor, close the hole it came in by, and ask Google to drop the spam pages.
€249
For an old site nobody looks after
Leave WordPress behind
We rebuild it in custom code, with no PHP to patch, and redirect every old page so your Google rankings can carry over.
Nutrition by Klara
Her clients book and pay online now.
We cleaned up Klara’s hacked WordPress site, then rebuilt it in custom code, with online booking and Stripe payments. There’s no WordPress left to patch.
Has anyone checked yours?
WordPress questions
Is PHP2Shell still a risk?
Yes, on any server that hasn’t been updated. Since 26 October the US cybersecurity agency CISA lists both flaws as actively exploited. The fix is PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or your host’s own patched build.
How do I know if my WordPress site has been hacked?
Search Google for site: followed by your address and look for pages you didn’t write. Look for a “This site may be hacked” note under your site, admin users you don’t know, and customers saying your site sent them somewhere else.
What does the free check cover?
Everything we can see from outside: your PHP and WordPress versions, Google’s hacked warning, spam pages under your address in Google, and browser blocklists. Hidden files and the database need access to your site, so we check those in a clean-up.
Will updating PHP break my WordPress site?
It can on an older site, because PHP 8 removed things old themes and plugins still use. On a site that’s kept up to date, we back it up, update everything and test it, for €99. For an old site we quote first, and tell you if a rebuild is the better money.
How long until Google removes the hacked warning?
Once the site is clean, we ask Google for a review in Search Console. Google says a review can take from a few days to a few weeks.
My hacked site had a contact form. Do I need to report it?
If personal data may have been exposed and that puts the people concerned at risk, you report it to the Data Protection Commission within 72 hours of finding out. Note the date and time you found out; the DPC’s breach page explains the rest.
Do you look after WordPress sites every month?
No. We move your site to a supported PHP, clean it up if it’s been hacked, or rebuild it in custom code, and our hosting plan keeps that up to date.