Magento Malware Removal & Hacked-Site Cleanup

A spam redirect almost always means your store has been hacked and an attacker injected malicious code. On Magento 2 the redirect usually hides in injected JavaScript, a poisoned CMS block or layout-XML update, a rogue config row in the database, or a modified core file. It often only triggers for visitors arriving from Google or on mobile, so it looks fine to you while it’s costing you traffic and trust. Magento malware removal finds the injection at the source and closes the backdoor that allowed it.

We compare every core file against Magento’s known-good checksums to surface modified or added files, then scan the full filesystem for PHP web-shells, obfuscated uploaders and suspicious recently-changed files. We review access logs to pin down the entry point and timeline, and audit the database for rogue admin users, malicious cron jobs and injected rows. The goal isn’t just to remove the visible symptom, it’s to find and close every backdoor so the attacker can’t walk straight back in.

Magecart is the most common card-stealing attack on Magento. The attacker injects a small piece of JavaScript into your checkout that silently copies customers’ credit-card details as they type, then sends them to a server the attacker controls. It can hide in checkout JS, a CMS block, layout XML, a third-party script, or directly in the database. Because it doesn’t change how the page looks, stores often run infected for months. Magecart removal is a core part of every cleanup we do.

Yes. Once your store passes a clean rescan, we file a review through Google Safe Browsing / Search Console and track it until the warning is removed. Google typically clears a confirmed-clean site within 24-72 hours of the review request. The key is that the store must genuinely be clean first, submitting a delisting request while malware is still present just resets the clock, which is why we verify before we file.

Most single-site cleanups complete within 1-2 business days. Emergency triage usually starts within 12 hours of your request. A straightforward infection (single skimmer, one backdoor) can be cleaned same-day; a store that’s been compromised for months, has multiple backdoors, or runs across several servers takes longer. Google blacklist delisting then adds 24-72 hours on Google’s side after the store is verified clean.

Reinfection happens when the cleanup removed the malware but left the hole open. We close it: apply all outstanding Adobe APSB security patches, tighten file permissions, change the admin URL, enforce 2FA, rotate every admin and API credential, and set up a file-integrity baseline with monitoring. Our Full Cleanup + Harden tier includes a 6-month reinfection guard, if the same hole is re-exploited in that window, we re-clean at no charge.

For a thorough cleanup, yes, ideally SSH (or hosting-panel) access plus a Magento admin account. SSH lets us scan the full filesystem, compare core checksums and review logs; admin access lets us clean CMS blocks, layout updates and rogue users. If you can only provide admin access, we can still do a partial cleanup, but we’ll be upfront about what we can’t reach. Everything we touch is documented in the final report, and credentials are rotated when we’re done.

No one can promise 100%, but the right hardening dramatically lowers the risk. After cleanup we apply security patches promptly, lock down the admin (custom URL, 2FA, IP allow-listing), tighten permissions, remove unused extensions, and add file-integrity monitoring so any new change is flagged before it becomes a breach. For stores that want this maintained continuously, the Security Retainer keeps patches current and monitoring live year-round.

Every project gets a fixed written quote. Send a short brief on WhatsApp and I reply within one working day with scope, price and timeline.

Fixed-price tiers, no per-hour surprises:

• Emergency Cleanup: scan, backdoor + skimmer removal, patches, Google delisting filed
• Full Cleanup + Harden: everything above, plus forensic entry-point analysis, full hardening, credential rotation, file-integrity baseline and a 6-month reinfection guard
• Security Retainer, Custom: ongoing monitoring, same-day patching and priority incident response for multi-store or high-traffic stores

Out-of-scope work found during triage is always quoted before it starts.

Yes. Every Full Cleanup + Harden includes a file-integrity baseline and 6 months of monitoring, if a core file changes or a new admin user appears, we get pinged before it becomes a breach. For continuous coverage, the Security Retainer adds same-day Adobe APSB patch application, quarterly security reviews, and a priority incident-response SLA across all your stores and servers.

We clean and harden Magento 2.4.4 through 2.4.9 (Open Source and Adobe Commerce), and we can triage end-of-life 2.3.x and legacy Magento 1 stores too. End-of-life versions no longer receive security patches, so for those we’ll clean the current infection and then strongly recommend an upgrade path, staying on an unpatched version means the next exploit is only a matter of time.

If a Magecart skimmer or database compromise exposed customer or payment data, you may have legal disclosure obligations under GDPR, PCI-DSS or state breach-notification laws, and your payment processor may need to be notified. During cleanup we determine what data was likely exposed and for how long, and we preserve the forensic evidence you’d need. We’re not lawyers, so we won’t give legal advice, but we’ll give you a clear technical breach summary so you and your counsel can decide what to disclose.