Running a business in Perth means you are already used to being a bit isolated — but when it comes to cyber threats, distance offers no protection. Website malware targets Perth businesses just as aggressively as those in Sydney or Melbourne, and the consequences are identical: lost customers, damaged Google rankings, and potential breaches of the Australian Privacy Act.
We have cleaned malware from websites belonging to Perth mining suppliers, Fremantle hospitality businesses, Joondalup medical practices, and Subiaco retail stores. The attack patterns are remarkably consistent, and so is the recovery process. This guide shares exactly what we do.
Why Perth Businesses Get Targeted
Perth may feel like a world away from the major cybercrime hubs, but automated attacks do not care about geography. Bots scan every IP address on the internet, testing for known vulnerabilities. If your site has one, they will find it — whether you are in Perth CBD or Karratha.
Specific factors that put Perth businesses at risk:
- Reliance on small web agencies — many Perth businesses hire a local freelancer to build their site, then never maintain it. The agency moves on, plugins go unpatched, and vulnerabilities accumulate
- Mining and resources sector — Perth's dominant industry makes local businesses attractive targets for corporate espionage and supply chain attacks
- Tourism and hospitality — Perth and Margaret River tourism sites handle payment data, making them targets for credit card skimmers
- Medical and healthcare — Joondalup, Murdoch, and CBD medical practices run websites that handle patient data subject to strict Australian Privacy Act requirements
- Limited local cyber security talent — Perth has fewer specialised website security firms compared to the east coast, meaning compromised sites often stay infected longer
Common Malware Types Affecting Perth Websites
Based on our experience with Western Australian clients, these are the infections we see most frequently:
SEO Spam Injection
Also known as the Japanese SEO hack, your website looks normal when you visit it directly, but Google shows hundreds of spam pages indexed under your domain — typically pharmaceutical products, gambling, or counterfeit luxury goods in Japanese or Chinese text.
Impact for Perth businesses: Your Google My Business listing and local search rankings are destroyed. A Perth plumber ranking on page 1 for "emergency plumber Perth" can drop off entirely within days of an SEO spam infection.
Payment Card Skimmers
A small JavaScript snippet is injected into your checkout page. It captures credit card details in real time and sends them to an attacker-controlled server. The customer completes their purchase normally and does not realise their card has been stolen until fraudulent charges appear.
Impact for Perth businesses: Particularly devastating for Perth e-commerce stores, Margaret River wineries selling online, and WA tourism operators taking bookings. Beyond financial liability, this triggers mandatory notification under the Notifiable Data Breaches (NDB) scheme.
Cryptocurrency Miners
Learn more in our guide on detecting and removing crypto miners. Hidden JavaScript runs in your visitors' browsers, using their CPU to mine cryptocurrency for the attacker. Your site becomes noticeably slower, and visitors on mobile devices may see their battery drain rapidly.
Impact for Perth businesses: Damages user experience and can trigger Google's "This site may harm your computer" warning, which effectively kills your organic traffic.
PHP Backdoors
A small PHP file uploaded to your server gives the attacker remote command execution. Even after you clean the visible malware, the backdoor lets them reinfect within minutes. These files are often named to blend in: class-wp-cache.php, wp-config-backup.php, or about.php.
Step-by-Step Malware Cleanup Process
Step 1: Contain the Damage
The moment you suspect malware, take these immediate actions:
# Put site in maintenance mode
# For WordPress — create maintenance file
cat > /var/www/html/.maintenance << 'EOF'
<?php $upgrading = time(); ?>
EOF
# Backup everything — even the infected version
tar -czf ~/backup-infected-$(date +%Y%m%d).tar.gz /var/www/html/
mysqldump -u root -p your_database > ~/backup-infected-$(date +%Y%m%d).sql
# Change all passwords immediately
# - Hosting control panel (cPanel/Plesk)
# - CMS admin accounts
# - FTP/SFTP credentials
# - Database password
Step 2: Identify the Infection
# Find recently modified PHP files (last 7 days)
find /var/www/html -name "*.php" -mtime -7 -ls | sort -k9
# Search for common malware signatures
grep -rl --include="*.php" "eval(base64_decode" /var/www/html
grep -rl --include="*.php" "gzinflate(str_rot13" /var/www/html
grep -rl --include="*.php" "preg_replace.*e'" /var/www/html
# Check for PHP files in upload directories (should not exist)
find /var/www/html/wp-content/uploads -name "*.php" -ls
# Look for hidden files
find /var/www/html -name ".*" -not -name ".htaccess" -not -name ".well-known" -ls
# Check .htaccess for malicious redirects
cat /var/www/html/.htaccess
Step 3: Clean and Restore
For WordPress sites (the majority of Perth business websites):
- Download a fresh copy of your exact WordPress version
- Replace all core files — overwrite
wp-admin/andwp-includes/entirely - Reinstall plugins from scratch — delete
wp-content/plugins/and download fresh copies from WordPress.org or the vendor - Clean the database — check for injected content in
wp_posts,wp_options, and user tables - Reset all passwords and security salts — regenerate from
api.wordpress.org/secret-key/1.1/salt/
-- Find rogue admin accounts
SELECT user_login, user_email, user_registered
FROM wp_users
JOIN wp_usermeta ON wp_users.ID = wp_usermeta.user_id
WHERE wp_usermeta.meta_key = 'wp_capabilities'
AND wp_usermeta.meta_value LIKE '%administrator%'
ORDER BY user_registered DESC;
-- Check for injected scripts in post content
SELECT ID, post_title
FROM wp_posts
WHERE post_content LIKE '%<script%'
OR post_content LIKE '%eval(%'
OR post_content LIKE '%base64_decode%'
LIMIT 30;
-- Look for malware in wp_options
SELECT option_name, LEFT(option_value, 150)
FROM wp_options
WHERE option_value LIKE '%eval(%'
OR option_value LIKE '%base64_decode%'
OR option_name LIKE '%_transient_wp_check%';
Step 4: Harden Your Site
Post-cleanup hardening specific to Perth business websites:
// wp-config.php hardening
define('DISALLOW_FILE_EDIT', true); // No theme/plugin editing from dashboard
define('FORCE_SSL_ADMIN', true); // Force HTTPS on admin pages
define('WP_POST_REVISIONS', 5); // Limit revision bloat
# .htaccess — Block PHP execution in uploads directory
<Directory "/var/www/html/wp-content/uploads">
<FilesMatch "\.php$">
Deny from all
</FilesMatch>
</Directory>
Essential ongoing protection:
- WO Security Shield — real-time file integrity monitoring that compares your files against known-good checksums and alerts you immediately when anything changes
- Automated daily backups — store them off-server (AWS Sydney ap-southeast-2 region for low latency from Perth)
- Web Application Firewall — Cloudflare's free plan provides basic DDoS and bot protection
- Two-factor authentication — mandatory for every admin account
Step 5: Remove Google Warnings
If Google flagged your site:
- Verify ownership in Google Search Console
- Go to Security Issues and review what Google detected
- Click "Request a Review" — describe what you cleaned and what preventive measures you implemented
- Google typically responds within 72 hours
- Full ranking recovery takes 1–4 weeks for Perth local search results
Australian Privacy Act and Notifiable Data Breaches
If your Perth business website handles personal information and was compromised, you may have legal obligations under the Privacy Act 1988 and the Notifiable Data Breaches (NDB) scheme:
When You Must Notify
You must notify the Office of the Australian Information Commissioner (OAIC) and affected individuals if:
- There is unauthorised access to personal information, AND
- A reasonable person would conclude this is likely to result in serious harm
Personal information includes names, email addresses, physical addresses, payment details, health information, and tax file numbers.
Notification Timeline
- You must complete your assessment within 30 calendar days of becoming aware of the breach
- Notification to OAIC and individuals must happen as soon as practicable after assessment
Penalties for Non-Compliance
- Up to $50 million for serious or repeated breaches (under the enhanced penalty framework)
- Civil penalty proceedings by the OAIC
- Reputational damage from public breach notifications
Practical advice for Perth businesses: If you handle customer data online and your site was hacked, consult a privacy lawyer before deciding the breach is not notifiable. The cost of legal advice is negligible compared to potential penalties.
Perth-Specific Hosting Recommendations
Where you host your website affects both performance and security. For Perth businesses, we recommend:
| Provider | Why | Best For |
|---|---|---|
| AWS ap-southeast-2 (Sydney) | Lowest latency from Perth in Australia, enterprise-grade security | Medium to large businesses |
| VentraIP | Australian-owned, Australian-based support, APAC data centres | Small businesses wanting local support |
| Digital Pacific | Sydney-based hosting with good support hours for WA businesses | Small to medium businesses |
| Cloudflare + any host | CDN caches content at Perth edge locations, adds WAF protection | Any size business |
Avoid international budget hosting (GoDaddy US, Bluehost, etc.) for Perth businesses — the latency adds 200–400ms to every page load, and support operates on US time zones.
Professional Cleanup Cost Guide
| Service | Cost (AUD) | Timeline |
|---|---|---|
| Basic malware removal (single infection) | $400–$1,000 | 4–8 hours |
| Advanced cleanup (backdoors + SEO spam + database) | $1,000–$3,000 | 8–24 hours |
| Full forensic investigation with compliance report | $3,000–$8,000 | 2–5 days |
| Site rebuild with security hardening | $5,000–$15,000 | 1–4 weeks |
| Monthly security monitoring | $75–$300/month | Ongoing |
Get Your Perth Business Site Cleaned Up
If your Perth website is currently compromised, every hour matters. Customer data may be at risk, your Google rankings are deteriorating, and your legal obligations under the NDB scheme have already started ticking. WO Security Shield offers emergency malware cleanup with response times typically under 4 hours — we clean the infection, harden your site, and provide ongoing monitoring so you stay protected.
Related Articles
- WordPress Hacked Site Repair Perth: Complete Recovery Guide — WordPress-specific repair guide for WA businesses
- How to Clean a Hacked WordPress Site: Step-by-Step — detailed technical walkthrough
- How to Find and Remove PHP Backdoors in WordPress — the hidden files that cause reinfection
- WordPress Security in 2026: The Threat Landscape Has Changed — understand current attack trends
- Understanding WordPress Firewall Rules: How a WAF Protects Your Site — why a WAF matters for Perth businesses