Shafail Shafa
Home / Services / WordPress & PHP sites
✚ WORDPRESS

WordPress and PHP repair, malware cleanup and hardening.

I bring broken sites back: critical errors, white screens, failed updates, malware and hacked stores. Most of that is WordPress and WooCommerce, but I work the same way on Joomla, Drupal, Laravel, CodeIgniter and plain PHP applications, because the problem is usually in the PHP, the database or the server rather than in the CMS. Once it is working I harden it, so the same thing does not happen twice. I also review sites that are not broken yet, to find what is exposed and what is likely to break next.

DELIVERABLES

Emergency fix

Critical errors, white screens, failed updates, plugin and theme conflicts, broken WooCommerce checkouts and database connection failures. I find what caused it rather than working around the symptom.

Malware and hack cleanup

Infected files, backdoors and rogue admin accounts cleared, the way in closed, and blacklist removal requested from Google and such. The site is re-hardened afterwards so the same door does not reopen.

Edits and changes

Smaller jobs on a site that is working: CSS and HTML changes, layout and theme edits, plugin configuration, and forms or mail that stopped sending. Nothing broken enough to be an emergency.

What this is not: I repair and maintain sites rather than build them. No rebuilds, no redesigns, no custom theme or plugin development, and no SEO or content work. If a site needs replacing rather than fixing, I will tell you that instead of charging you to patch it.

ALWAYS INCLUDED
full backup before touching anything the actual cause identified entry point closed after any hack 3 days of support after delivery

HOW IT WORKS

1

Triage

You describe the issue you are having. I find out what actually happened, which is not always the same thing. Before I change anything I take a backup, even of a site that is already broken.

2

Fix

The site comes back. If it was hacked, that means cleaning every infected file, removing hidden backdoors and admin accounts nobody created, and closing whatever they came in through. Usually an outdated plugin, a weak password, or a vulnerable theme.

3

Verify

I retest the site. On malware jobs the scans have to come back clean, and if you want it, I request blacklist removal from Google and such.

4

Protect

Then the hardening: firewall rules, login protection, file permissions, automatic backups. Where it is useful I will write up a brief summary. If you would rather not think about any of this again, I also look after sites on an ongoing basis.

FROM WORDPRESS CLIENTS

All 2,200+ reviews →
★★★★★ Fiverr

“I have used Shafa before to help migrate my website and did this with ease. Shafa fixed my wordpress issues with expertise. Also super helpful with advice on wordpress issues. I will definately be using Shafa again for any website issues I have. Thank you so much!”

s*** · United Kingdom · WordPress · Jul 2025
★★★★★ Fiverr

“AWESOME exp w/Dtyacf.I am an extremely detail oriented person & I knew NOTHING about WordPress &/or how to create&publish a Website.I was extremely nervous about hiring anyone & Dtyacf accomodated my detail orientation w/ "patience & great detail" which more than exceeded my expectations!”

b*** · United States · WordPress · Jul 2017
Rebuilding an event page layout after a plugin's major update
The Events Calendar 6.0 wiped out the custom single-event layout a client had built. I rebuilt it in CSS on top of the plugin's new default templates, desktop first and then mobile.

WHAT PEOPLE SEARCH FOR

wordpress malware removal
Cleaning the infected files is the easy half. Finding how they got in is what stops it happening again.
recover hacked wordpress
Usually spam pages injected into the site, a hidden backdoor, and an admin account nobody created.
fix wordpress errors
White screen, critical error, or an update that failed halfway. Nearly always one of those three.
woocommerce fix
Most often the checkout. A plugin conflict that only shows itself at the payment step.
php error
A fatal error or a 500 on a site that is not WordPress at all, which is the same diagnosis with a different codebase.
database connection error
The site cannot reach MySQL, usually credentials, a crashed service, or a table that needs repair.
wordpress audit
A review of a site that is still working: what is out of date, what is exposed, what has no backup, and what to deal with first.
wordpress maintenance
Updates, backups and monitoring handled by somebody, so the emergency never starts.

Tell me what is broken.

What you are seeing, when it started, and anything that changed just before. Screenshots welcome.

Get in touch →