MADRID — In the high-stakes world of website administration, few nightmares rival the discovery that a WordPress site has been compromised. Malware injections, malicious redirects, blacklisted domains, and lost revenue can paralyze a business overnight. Recognizing the overwhelming cognitive load that webmasters face during these critical hours, Fernando Tellado, a veteran figure in the Hispanic WordPress ecosystem and founder of the benchmark resource AyudaWP, has publicly released a professional-grade weapon against cyberattacks: a comprehensive, 77-point auditing spreadsheet designed to sanitize infected WordPress websites.

Available completely free of charge and requiring neither user registration nor email submission, the resource translates years of incident-response experience into a structured, phase-by-phase operational matrix.

This release arrives at a time when automated botnets and zero-day vulnerabilities target content management systems with relentless aggression. For developers, small business owners, and digital agencies managing portfolios of sites, Tellado’s spreadsheet aims to bring methodical precision to what is often a chaotic, panic-driven recovery process.

Main Facts: Anatomy of the Anti-Malware Toolkit

The core of Tellado’s contribution is a meticulously structured .xlsx workbook distributed natively through his platform, AyudaWP. Far from being a generic checklist, the spreadsheet is a tactical control center containing 77 specific checks distributed across 8 distinct phases.

Rather than substituting Tellado’s well-known, exhaustive text guide for recovering hacked websites, the spreadsheet acts as its operational twin. Its inception stems from a harsh reality of digital forensics: the primary challenge in a website cleanup is rarely knowing what to do, but rather remembering where you are in the process.

"A thorough, professional cleanup typically takes two to three days of intensive labor, while clearing a site’s blacklisted status with Google or antivirus vendors can drag on for weeks," Tellado notes. Amidst server reboots, file diffs, and database queries, interruptions are inevitable, and missing a single backdoor or hidden script can lead to immediate reinfection.

Intelligent Design and Risk-Aware UI

The spreadsheet incorporates several clever design choices tailored specifically to streamline crisis management:

• Dynamic Link Generation: Users only need to type their target domain once on the cover sheet. The workbook automatically maps this URL into dozens of pre-configured online security scanners and lookup tools, sparing administrators from repetitive copy-pasting across multiple browser tabs.
• Risk Stratification: Every single check within the matrix is assigned a risk level. Crucially, tasks that carry a high potential for breaking the site or causing downtime are highlighted in bright red, warning administrators to proceed with extreme caution.
• Zero Friction Access: Eschewing the lead-generation tactics common in the security industry, the file is accessible instantly via a direct download link without gating content behind email subscriptions.

Chronology: The Eight Phases of Recovery

To prevent the common pitfall of treating symptoms while leaving root causes untouched, the toolkit organizes the remediation workflow into a strict chronological sequence. Moving out of order can invalidate hours of work or tip off attackers.

Phase 0: The Legal Clock and Triage (Pre-Inspection)

Before a single file is touched or a database query is run, Phase 0 addresses external liabilities. If the compromised website processes personal data—such as e-commerce customer records, user accounts, newsletter subscriptions, or contact form entries—administrators face strict regulatory deadlines.

Under the European Union’s General Data Protection Regulation (GDPR), a confirmed data breach mandates notification to supervisory authorities (such as the Spanish Data Protection Agency, AEPD) within 72 hours of becoming aware of the incident. Tellado emphasizes that this clock starts ticking from the moment of discovery, not from the completion of the cleanup. For smaller sites, this phase requires assessing the scope of the breach and documenting the evaluation, even if formal notification is ultimately deemed unnecessary.

Phase 1: Securing and Isolating

Before attempting repairs, administrators must secure a pristine snapshot. This involves creating a complete backup of the infected state (for forensic analysis) and isolating the server environment to prevent lateral movement or data exfiltration.

Phase 2: Access Revocation and Credentials

Attackers frequently establish persistence by creating rogue administrator accounts or injecting malicious authentication hooks. This phase mandates the immediate invalidation of all user sessions, password resets for all administrative accounts, and the rotation of database credentials, FTP/SFTP keys, and hosting control panel access.

Phase 3 to 7: Identification, Eradication, and Hardening

Subsequent phases guide the administrator through system integrity checks, core file comparisons against official WordPress repositories, plugin and theme auditing (looking for modified or abandoned code), database sanitization (inspecting SQL tables for injected JavaScript or spam links), and removal from external blacklists.

Phase 8: Post-Verification and Google Review

The final phase focuses on hardening and rehabilitation. Only when the site has been thoroughly cleaned and verified should administrators request a review from Google Safe Browsing and security vendors.

Supporting Data: What Else Is Inside the Workbook?

Beyond the central 77-point checklist, the workbook functions as an exhaustive knowledge base, housing auxiliary tabs packed with critical diagnostic data:

• 27 Symptoms of Infection: A taxonomy of behavioral and visual anomalies (such as unexpected redirects, injected pharmaceutical keywords in search results, or unexplained CPU spikes) to help identify the type of attack.
• 20 Online Scanners: A curated list of external verification engines (including VirusTotal, Sucuri SiteCheck, and Quttera) pre-linked to the user’s domain via the cover sheet.
• 20 Code Patterns: Signatures and string examples characteristic of common malicious injections, obfuscated eval functions, and unauthorized backdoors hidden within PHP files.
• 10 Prevention Measures: Long-term hardening protocols designed to prevent recurrence once the emergency has passed.

Furthermore, the workbook includes dedicated tabs for system environment verification (checking PHP versions, file permissions, and .htaccess integrity) and e-commerce-specific checks for WooCommerce platforms.

Official Responses and Expert Insights: Sequence Errors and Limitations

In his accompanying technical analysis, Tellado highlights that the failures plaguing amateur cleanups are rarely rooted in a lack of technical knowledge; rather, they are sequence errors.

Four Fatal Order Mistakes

1. Requesting Google Review Too Early: Submitting a reinfected site to Google for a security review resets the evaluation queue. If malware is still present, subsequent reviews take progressively longer, keeping the warning banner active in search engine results pages.
2. Deleting Backdoors Before Changing Credentials: Cleaning files while leaving compromised admin passwords active allows attackers to regain entry within minutes via automated scripts.
3. Failing to Identify the Entry Vector: Cleaning a site without discovering how the attacker broke in guarantees a reinfection. Tellado stresses that the spreadsheet is a remediation tool, not a forensic vulnerability scanner. It will not automatically reveal whether the breach occurred via an outdated plugin, a compromised SSH key, or a vulnerability in the server’s operating system.
4. Skipping Local Backups: Modifying live databases or files without a verified, offline backup risks turning a minor database injection into total data loss.

When to Call in the Professionals

Tellado is refreshingly candid about the boundaries of his tool. He explicitly recommends hiring professional incident-response services under specific high-risk conditions:

• E-commerce sites where customer credit card or payment data may have been intercepted (which triggers severe PCI-DSS liabilities alongside GDPR concerns).
• Instances where the web hosting provider has already suspended the hosting account due to outgoing spam or distributed denial-of-service (DDoS) activity.
• Websites suffering from a second or third reinfection, indicating a deep-seated architectural flaw, server-level compromise, or an unpatched zero-day vulnerability in custom code.

For prevention, the security expert reiterates time-tested best practices: enforcing multi-factor authentication (MFA) for all administrative users, strictly avoiding "nulled" (pirated) premium themes and plugins, maintaining automated backups that have been successfully tested via restoration, and monitoring file system changes—noting his own free monitoring plugin, Vigilante, as a viable tool for this purpose.

Implications: Empowering the WordPress Community

The release of Tellado’s spreadsheet carries significant implications for the broader WordPress ecosystem, which currently powers over 40% of the top ten million websites globally.

By democratizing enterprise-grade incident response frameworks, AyudaWP lowers the barrier to entry for effective crisis management. Freelancers and boutique digital agencies can integrate this standardized checklist into their standard operating procedures (SOPs), ensuring consistency across client projects and reducing the human error inherent in high-pressure troubleshooting.

As automated cyberattacks become increasingly sophisticated, resources that bridge the gap between complex technical forensics and practical, human-centered execution are invaluable. Fernando Tellado’s contribution demonstrates that community-driven knowledge sharing remains one of the most effective defenses in modern web administration.

The spreadsheet is available for immediate download in .xlsx format via the AyudaWP portal, offering the WordPress community a reliable anchor in the storm of a security breach.