Do we need to take the website offline while it is being cleaned?

Not always. If the website is redirecting visitors to other sites or spreading malicious code, we recommend taking it offline temporarily, so your customers and your website's reputation in Google search don't suffer. Otherwise, we clean the live website and plan the work so that sales stop for as short a time as possible.

Will we lose orders or texts during cleaning?

Usually not. Before cleaning, we take a backup of the whole website and remove only the malicious code, foreign files and unknown users – orders, customers and texts stay. If some data is already damaged, we discuss what can be restored from backups.

Why does a website get infected again after cleaning?

Usually because only the visible malicious code was removed and the vulnerability remained: an outdated plugin, a hidden backdoor or the same password. That is why, along with cleaning, we update the system, remove hidden backdoors and change all passwords. To stop new vulnerabilities from opening up, updates need to be installed continuously – that is what maintenance from €29/month is for.

How do I get rid of Google's warning that the site may be hacked?

Only by cleaning the website and submitting it for review. Once the website is clean, we submit a review request in Google Search Console, and Google removes the warning if it no longer finds any issues. The review usually takes from a few days to a few weeks, and there is no way to speed it up.

Do you clean websites you didn't build?

Yes. Who built the website makes no difference to the cleaning – we need hosting and admin access. If you don't have it, we help you recover it together with your hosting provider. After cleaning, we can continue to maintain the website, and it can stay with your current provider.

Do we need to report the breach to customers or the authorities?

You may have to, if personal data could have been leaked. The GDPR requires a personal data breach to be reported to the State Data Protection Inspectorate within 72 hours and, in some cases, to the individuals affected. We help establish what data may have been accessed, while the decision on reporting is yours as the data controller.

Malware removal and website protection

Website malware removal means finding and removing malicious code, getting the website working again and closing the security holes it got in through. Saitai.lt cleans WordPress, Joomla, WooCommerce and VirtueMart websites, updates their software and helps remove Google warnings. We set the price after a free assessment of your website, and the work usually takes 1–3 working days from receiving access.

Get a quote How much does it cost?

Prepared by the Saitai.lt team · Updated 6 October 2026

In short

Price: set after a free assessment of your website and agreed before work starts; no VAT is added
Start: we reply within 1 working day; websites that are down or redirecting visitors take priority
Timeline: usually 1–3 working days from receiving access; Google's review is separate
Included: backup before cleaning, malicious code removal, updates, password changes, security settings, a description of the cause
Platforms: WordPress, WooCommerce, Joomla, VirtueMart, custom PHP websites
After cleaning: maintenance from €29/month, so updates are installed on time
Where we work: remotely, all over Lithuania; if it's urgent, call +370 670 99265

Who it’s for

Visitors arriving from Google are redirected to other websites – for example, lottery, casino or pharmacy ads.
Google shows a warning next to your website saying it may be hacked, or the browser displays a red warning screen.
Hundreds of pages from your website have appeared in search results with unrelated titles, often in another language.
Your hosting provider has blocked your website or email because of malicious code or spam being sent.
Unknown users have appeared in the admin area, and you can no longer log in.
Your website has suddenly slowed down, shows a white screen or strange pop-ups.
Your website has been cleaned before, but was infected again a few weeks later.

When it’s not the right fit

Your website is slow or shows an error after an update, but there are no signs of malicious code. Then you need bug fixing or speed optimisation rather than cleaning – we do that work too.
It is not your website that has been hacked, but a social media or email account. In that case, contact that platform's support team first.
Your website's content management system is so old that it can no longer be updated. Once cleaned, it would soon be infected again, so it is worth updating or rebuilding it – from €299.

Website malware removal process: enquiry or call, assessment and price, backup and cleaning, updates and protection, checks and Google review, explanation and prevention

Included

What you get

Urgent assessment

We check the website files, the database, the list of administrators and the server logs, and then tell you how badly the website is compromised and what needs to be done.

Backup before cleaning

Before changing anything, we take a backup of the current state, so that orders, texts and other data are not lost.

Malicious code removal

We remove injected code, backdoors, foreign files and spam pages, and replace the core system files with the originals.

Updates and vulnerabilities

We update the CMS, plugins and theme, and remove plugins that are no longer supported – they are the most common way into websites.

Passwords and users

We remove unknown administrators and change the admin, hosting, database and FTP passwords.

Security settings

We limit login attempts, disable file editing from the admin area, set the correct file permissions and, if needed, a firewall.

Removing Google warnings

We submit the cleaned website for review in Google Search Console, so the warning disappears from search results and browsers, and the spam pages are removed from search.

An explanation of the cause

We briefly explain how the website was infected and what to do so it doesn't happen again.

Price

How much does website malware removal cost?

Price

On request

We set the price for cleaning after a free assessment of your website, because it depends on the extent of the damage: one infected plugin takes less time to clean than a website with hundreds of foreign entries in its files and database. We agree the price and what it includes with you before work starts.

Prices include all taxes – no VAT is added (we are not VAT-registered). We agree the price and scope of work in writing before cleaning starts.

Get a quote

What the price depends on

How many files and database entries are compromised, and in how many places the malicious code is hidden.
The content management system and its version: whether it can be updated, or first needs moving to a newer one.
Whether there is a clean backup from which part of the website can be restored.
Whether the website runs an online store with orders and customer data that must not be lost.
Whether Google warnings and spam pages need to be removed from search.
Whether there are other websites on the same hosting plan – they may be infected too.

Additional costs

If the website's CMS is too old to be updated safely, we suggest updating or rebuilding the website – from €299.
Renewing licences for premium plugins – at their makers' prices.
To keep the website from being infected again, we recommend maintenance from €29/month: monthly updates and weekly backups; the Business (€69/month) and Premium (€149/month) plans also include security checks and malware removal.

Timeline

How long does it take to clean a website?

Most websites are cleaned and secured within 1–3 working days of receiving access. If the website is redirecting visitors elsewhere or spreading malicious code, we first take it offline temporarily. After a review request, removing the Google warning can take anything from a few days to a few weeks – that is up to Google.

Situation	What we do	Timeline
One infected plugin or theme, website still working	cleaning, updates, password changes	1 working day
Malicious code in the files and database, redirects	thorough cleaning, closing vulnerabilities, security settings	1–3 working days
Spam pages in Google search	cleaning and a review request in Google Search Console	cleaning 1–3 working days; Google's review from a few days to a few weeks
An old CMS that can no longer be updated	cleaning and moving to a new version or system	depends on the scope

Process

How it works

Enquiry or callup to 1 working day
You describe what you see: redirects, warnings, a blocked account. We ask for hosting and admin access – through a secure channel, not in the form.
Assessment and priceup to 1 working day
We establish the extent of the damage and agree the price and scope of work. If needed, we take the website offline temporarily.
Backup and cleaning1–2 working days
We back up the current state and remove the malicious code, foreign files and unknown users.
Updates and protectionalongside the cleaning
We update the system and plugins, change all passwords and apply security settings.
Checks and Google reviewon the last day of work
We check that the website is clean and working, and submit a review request in Google Search Console.
Explanation and preventiononce the work is done
We explain what happened and suggest how to avoid reinfection: maintenance from €29/month or a system update.

Comparison

Clean, restore from a backup or update the website?

Criterion	Restore from a clean backup	Cleaning and protection	Update or rebuild
When it fits	there is a backup taken before the infection, and the content has barely changed since	there is no clean backup, or the latest data must not be lost	the CMS is too old to be updated safely
Latest data	changes and orders after the backup date are lost	kept	content is moved to the new system
Closing the vulnerability	has to be done separately, or the infection will recur	included	a new, up-to-date system
Duration	usually the shortest	1–3 working days	depends on the scope
Price	after assessment	after assessment	from €299

Examples

Typical projects

A WordPress website redirecting to other sites

Situation: For example, a service company's website opens normally on a computer, but visitors arriving from Google on their phones are redirected to a lottery website. The owner finds out from customers' calls.
Solution: We find the malicious code injected into a theme file and the database, and remove it. We replace the unsupported plugin that let the attackers in with a supported alternative, and change all the passwords.
Result: A clean website, a closed vulnerability and a clear explanation of what happened.

Hundreds of spam pages in Google search

Situation: For example, when you search for a Joomla website's name, Google shows hundreds of its pages advertising products in an unfamiliar language.
Solution: We remove the generated pages and their source on the server, make the spam URLs return an error code, and submit the website for review in Google Search Console.
Result: A clean website and search results from which the spam pages gradually disappear.

An online store blocked by the hosting provider

Situation: For example, spam emails started being sent from a WooCommerce store's server, so the hosting provider blocked the account and orders stopped.
Solution: We clean the store without losing orders or customer data, remove the mailing script, change the passwords and give the provider details of the work done, so the account can be unblocked.
Result: A store that works again, and a maintenance plan so updates are installed on time.

Website infected? Call +370 670 99265

If your website is redirecting visitors elsewhere or Google is showing a warning, call us or send us the website address. Within 1 working day, we will assess the damage and give you a price.

Get help

FAQ

Frequently asked questions

By the signs: redirects to other websites, Google or browser warnings, unknown administrators, strange pages in search results or a notice from your hosting provider. Some malicious code is only shown to visitors coming from Google, or only on phones, so the owner may not notice it. If you suspect something, send us the website address and we will check.

More

Get help within 1 working day

Give us your website address and tell us what you have noticed. Please don't put login details in the form – we will ask for them through a secure channel. If it's urgent, call +370 670 99265.

Phone / WhatsApp / Viber:
+370 670 99265

Email:
info@saitai.lt

We reply within 1 working day. Meetings in Vilnius are by appointment only – please call first.