ACASTANON WordPress malware
removal & recovery

Independent WordPress specialist

WordPress malware removal & recovery.

Understand what happened. Remove the threat. Get your website working again, with direct help from the developer doing the work.

Request a free assessment See the plastical.es case

First reply within 1 business day.
Free initial review of symptoms and publicly accessible indicators.

Alejandro Castañón

Independent senior developer · WordPress & WooCommerce

You speak directly with the person investigating your website. I work with application code, databases and hosting environments, and document the findings and agreed recovery work.

A documented investigation

Behind the casino spam.

· WordPress

plastical.es

Thousands of casino spam pages were reported on the website. The analysis uncovered code designed to hide spam from the WordPress dashboard and show it to Google.

files analysed
24,411
malicious files identified
≈45
malware families
7+

What the investigation revealed

A hidden SEO spam engine, two counterfeit plugins and multiple backdoors across WordPress, plugins and themes. Deleting the visible spam alone would leave other routes of access.

The investigation outcome

A documented map of the compromise and a recovery plan: rebuild affected components from trusted sources, review the database, rotate credentials and address spam indexing.

How the analysis was carried out

I examined a 534 MB backup without executing its PHP code. The work combined official file checksums, matching malicious file hashes, heuristic scanning and decoding obfuscated code.

The report distinguished verified files from malicious additions and components requiring replacement. The database was not part of the supplied backup, so database inspection and cleanup were specified as subsequent recovery steps. This case describes the investigation and its recommendations; it does not assert a completed cleanup or a search-ranking outcome.

What happens next

A clear path to recovery.

Three stages, with the work and permissions agreed before changes are made.

  1. Free review & next steps

    Review your symptoms and public indicators to assess the apparent severity, whether I can help and what is needed for a proposal.

    What the free assessment covers

    The initial review is limited to around 10–15 minutes of assessment work. It covers the symptoms you describe, publicly accessible indicators and the additional information needed to prepare a proposal. You receive a first reply within 1 business day.

    It does not include server access, an in-depth file analysis, a full database review or malware removal. Investigation requiring WordPress or hosting access is a technical diagnosis and is quoted separately. Scope, authorisation and data-handling arrangements are agreed before that work begins.

  2. Investigate & clean

    Contain the incident, remove confirmed malicious components and address the security weaknesses identified.

    Technical details

    Where feasible, relevant evidence and a recovery backup are preserved before changes. The investigation can cover files, plugins, themes, database content, accounts and persistence mechanisms. Untrusted components may be replaced with legitimate copies. Credential rotation and configuration changes follow the agreed scope.

  3. Validate & hand over

    Check essential functionality and known infection indicators. Receive a report of the work, findings and remaining risks.

    Validation & follow-up

    Checks reflect your installation, including forms, administration and WooCommerce workflows where applicable. Any untested functionality is documented. Temporary access is removed and local working copies follow the agreed deletion procedure. Any observation period or follow-up coverage is specified in the service agreement.

Your website, handled carefully

Clear access. Confidential work.

  • Agreed permissions. Access is limited to the authorised intervention. Temporary accounts are preferred.
  • Protected working copies. When offline analysis is needed, copies are held on dedicated encrypted storage.
  • Documented handover. Findings, remaining risks and data-retention arrangements are made explicit.
Data-handling details

Local working copies are used only for the agreed work, with a retention period and deletion deadline defined in the service agreement. Files and database exports are not intentionally sent to third-party storage or analysis services without prior authorisation.

Where personal data is processed on your behalf, the appropriate arrangements are established beforehand. Findings suggesting a personal-data breach are communicated without undue delay. Legal representation, regulatory notifications and formal digital forensics require a separate agreement.

Before you get in touch

A few useful answers.

What is included in the free assessment?

A brief review of your reported symptoms and publicly accessible indicators, limited to around 10–15 minutes of assessment work. The aim is to identify a possible incident, its apparent severity, whether I can take on the work and what else is needed for a proposal.

Server access, in-depth file analysis, a full database review and malware removal are excluded. A technical diagnosis requiring WordPress or hosting access is quoted separately and begins only after agreement.

When will I hear back?

You will receive a first reply within 1 business day. This is the response time to your request, not a promise to complete diagnosis or recovery within that period.

A recovery estimate follows assessment of the incident, available backups and access. Any planned interruption is discussed in advance whenever the situation allows it.

Will my content and orders be preserved?

Preserving legitimate data and functionality is a priority. Backups and recovery options are reviewed before destructive changes wherever feasible. Data already altered or deleted by an attacker may not be fully recoverable.

What about reinfection or Google results?

The work addresses known malicious components and identified weaknesses. Any follow-up period and coverage are agreed explicitly. No service can guarantee that a website will never be compromised again.

Where included in scope, spam URLs, sitemaps and indexing settings are reviewed. Google’s processing times and restoration of previous rankings cannot be guaranteed.

Start with what you know

Let’s assess your website.

Share the URL and the symptoms for a free initial assessment. I will reply within 1 business day to establish the next appropriate step.

hello@acastanon.com
Direct contact with Alejandro Castañón Technical diagnosis quoted separately Secure access arranged separately

Request a free assessment

Free review of symptoms and public indicators. First reply within 1 business day.

Please do not include passwords, database files or customer information.
Add context Optional

The free review does not include server access, in-depth file or database analysis, or malware removal. Technical diagnosis is quoted separately; scope and access are agreed before work begins.