# A repeatable clean-up playbook for hacked websites

Entry E09. Sector: Group of WordPress sites. Status: in production. Delivered: 2026-05.
Source: https://ai.prospicience.in/work/wordpress-cleanup-playbook

Prospicience cleaned several hacked WordPress sites on one hosting account and turned the work into an eight section playbook: malware types, clean up steps, bad patterns, database work and clearing spam from Google. An assistant follows it by driving the hosting control panel like a person, so the next incident starts from a proven routine.

Speed: Cleaned and documented in one day.

## The challenge

Several sites on one hosting account were hacked and serving spam, and the host offered no automation to clean them up.

## Why it mattered

Hacked sites lose search ranking and visitor trust every day they stay infected, and reinfection is common. A one off rescue would have left the next incident starting from scratch, possibly with a different person at the keyboard.

## What we built

- Cleaned the infected sites and wrote the playbook along the way: malware types, clean up steps, file manager access, the site list, known bad patterns, database work and Google spam removal.
- Built an assistant that follows the playbook by driving the hosting control panel the way a person would.
- Recorded which tool suits which job, so each run starts where the last one ended.

## The result

- Infected sites cleaned, with configuration backed up before every change.
- An eight section playbook anyone on the team can follow.
- An assistant that repeats the clean up on a host with no automation of its own.
- A written procedure for clearing spam pages from Google results.

## Built for trust

Configuration files are backed up before any change, and every step states what it expects to see before it moves on. If a site is not in the expected state, the assistant stops, so a live site is never put at risk by a guess.

## AI at work

An AI assistant works through the clean up playbook on the hosting control panel the way a person would, on a host that offers no automation of its own. It backs up configuration first and stops the moment a site is not in the state it expects.

What it produces: cleaned sites, with configuration backed up first, step by step runs of the eight section playbook, spam pages cleared from Google results, notes on which tool suits which job.

- The next incident starts from a proven routine rather than from scratch, whoever is at the keyboard.
- Each run records which tool suits which job, so the next one starts where the last ended.
- Known bad patterns are written down, so every new infection is checked against what was found before.

How it works day to day: When a site is hit, the assistant opens the hosting panel, backs up configuration and follows the playbook, checking each step's expected state before moving on. Anything it stops on goes back to a person to decide.

## Figures from the delivered system

- playbook sections: 8
- host automation available: none
- backup before every change: yes

## The technology

- A written playbook anyone on the team can follow
- An assistant that works the hosting panel like a person
- Notes on which tool suits which job, so the next run starts where the last ended
- Backups before any change

AI models used: Claude (Anthropic).

### Technical notes

- Eight section runbook: malware taxonomy, clean up procedure, file manager access, site inventory, bad configuration patterns, search console spam removal, database operations, tooling
- Browser driven remediation where the host exposes no API
- Configuration files backed up before modification, and every step states its expected precondition

## Questions

### Why write a playbook instead of just cleaning the sites?

Because reinfection is common, and the person cleaning up next time may not be the person who cleaned up this time. With a written playbook, the second incident costs a fraction of the first.

### What if the host has no API?

The assistant drives the hosting control panel through the browser the way a person would. It works on any host, whether or not it offers automation.

### How do you avoid breaking a live site during clean up?

Configuration files are backed up before any change, and every step declares what it expects to see before it proceeds. A step that does not recognise the state it is in stops rather than guessing.

Capabilities: security-and-remediation, ai-agents-and-automation.