Guides
Written from real WordPress cleanups: what hacks and breakages look like from outside, how to confirm them, and how to fix them for good.
How to check if your website is hacked
12 practical tests to tell if a website or WordPress site is hacked: cloaked spam, mobile-only redirects, injected scripts and exposed files.
9 min read
The Japanese keyword hack: detect it, remove it, keep it out
Google shows Japanese titles for your site? How the Japanese keyword hack works, how to confirm it, and how to clean WordPress and Search Console.
7 min read
WordPress redirect hack: when only some visitors get sent to spam
Your WordPress site redirects visitors to spam, but not you? How mobile-only and Google-referrer redirects work and where the code hides.
7 min read
SEO spam and cloaking: casino and pharma links only Google can see
Casino, slot or pharma titles in Google for your site? How SEO spam cloaking works, how to see what Googlebot sees, and how to clean it up.
6 min read
SPF, DKIM and DMARC for WordPress sites: why your emails land in spam
Contact form emails landing in spam? SPF and the 10-lookup limit, DKIM for Google Workspace and Microsoft 365, and DMARC, with records to copy.
8 min read
"There has been a critical error on this website": find the cause and fix it
What the WordPress critical error means, and how to find the plugin or theme behind it with recovery mode and the debug log. Plus related errors.
6 min read
Hacked WordPress cleanup checklist: every place malware hides
Step-by-step cleanup for a hacked WordPress site: backdoors in mu-plugins and uploads, fake plugins, cron, database payloads and rogue admins.
10 min read
Not sure if a site is hacked?
Run the free check: cloaking, redirects, malware, errors, SSL and email in about a minute.