How to Scan a WordPress Backup Before Restoring It
Inspect a WordPress backup offline for modified packages, executable uploads, database payloads, users and persistence before restoration.
Incident assessments openMalware is compromising your website.
WEBSITE MALWARE CLEANUP
Malware is compromising your website.
Remove it — and the way back in.
Jordi Ensenyat assesses malicious redirects, backdoors, SEO spam, injected code, blacklisting and infections that return after superficial cleanup. He defines the impact and likely cause first, provides a quote, and only intervenes after your approval.
Your request goes directly toJordi EnsenyatFounder of Code Barcelona · 15+ years with WordPress
- 15+
- years working
with WordPress - 01
- accountable specialist
from start to finish - ✓
- manual, documented
intervention
01 Preserve first02 Then diagnose03 Only then repair04 Always verify
THE SYMPTOM IS NOT THE DIAGNOSIS
Regaining control means understanding the whole journey.
The goal is not to make an error disappear for five minutes. It is to remove malicious persistence, close evidenced entry points and verify the behaviour that triggered the alert.
Every case stays with one accountable specialist, with evidence before changes and real verification at close-out.
RESCUE SERVICES
Specialist work focused on the point of failure.
This is not a generic maintenance package. We examine the affected journey, its dependencies and the outcome that must work again.
01
↘
Malware and backdoor removal
Focused diagnosis, the smallest supported change and verification of the affected journey.
Assess the case ↗02⌁
Redirect and SEO spam cleanup
Focused diagnosis, the smallest supported change and verification of the affected journey.
Assess the case ↗03◎
Hardening and reinfection review
Focused diagnosis, the smallest supported change and verification of the affected journey.
Assess the case ↗WP REPAIR PROTOCOL
Diagnosis, repair and evidence. In that order.
Urgency is not a reason to change a website without preserving a recovery route. This order protects your data and makes the result verifiable.
See the complete process ↗- 01
Safe assessment
You send the URL, visible symptom, recent changes and urgency. We do not ask for passwords in public.
DELIVERABLE · Initial scope and missing information - 02
Quote and approval
We review the case and explain the proposed intervention, dependencies, price and limits before starting.
DELIVERABLE · Clear quote before access - 03
Preservation and diagnosis
With secure access, we verify ownership, preserve a backup or rollback route and identify the real cause.
DELIVERABLE · Recovery point and diagnosis - 04
Repair, testing and report
We apply the smallest necessary change, test the affected journey and document the work and follow-up points.
DELIVERABLE · Verified website and close-out report
WHAT WE DO NOT DO
Trust also comes from being clear about the limits.
- We do not request passwords in public forms.
- We do not claim a diagnosis without reviewing evidence.
- We do not make risky changes without a backup or rollback route.
- We do not call a repair complete until it has been checked.
ACCOUNTABLE SPECIALISTJordi EnsenyatFounder of Code Barcelona
DIRECT RESPONSIBILITY
The person assessing the case remains accountable for the intervention.
No hand-offs between sales, support and development. The same technical responsibility follows the case from assessment to the final report.
Experience15+ years with WordPress
ModelManual service, case by case
FIND YOUR SYMPTOM
Guides and solutions by problem.
Content designed to help you make a safe decision, not to turn every keyword variation into an empty page.
QUESTIONS BEFORE YOU START
Clarity from the first contact.
How quickly will you respond?+
A person reviews every request according to its real urgency and current availability. While the green “Available now” status is shown, the first human response is sent quickly and you always receive a realistic timeframe for your specific case. We do not claim 24/7 coverage we cannot genuinely honour.
Do you need my passwords to assess the problem?+
No. The URL, visible symptoms, recent changes and exact error messages are usually enough for the initial assessment. Access is requested through a secure channel only after you approve the quote.
Do you start work before I approve the price?+
No. We first define the scope and present the quote. Technical work starts only after approval and once the necessary access is available.
What if the problem is larger than expected?+
We stop, explain the new evidence and agree any change in scope before continuing. An emergency never becomes open-ended hours without your approval.
Do you make a backup before repairing the site?+
Before any risky change we require a viable backup or an explicit recovery route. If the hosting setup or the site condition prevents this, we explain the risk before acting.
How will I know what was repaired?+
The close-out includes the cause found, changes applied, checks performed and relevant recommendations to reduce the chance of the same incident returning.
RESCUE JOURNAL
Diagnosis explained with judgement.
Read guide ↗
What to Ask the Hosting Provider During a WordPress Malware Incident
Ask a hosting provider for evidence, containment, account scope, recovery access and validation details during a WordPress malware incident.
When Shared Hosting Prevents a Reliable Malware Cleanup
Recognise when missing logs, weak isolation, restricted access or recurring account-wide writes make migration necessary for reliable cleanup.
FIRST STEP
Describe the failure.
Jordi will review the journey.
Do not send passwords. The URL, visible symptom and recent changes are enough to begin the assessment.
Request an assessment ↗