Cleaning up a hacked WordPress site takes more than deleting the bad files. A proper cleanup contains the damage, keeps a copy of the infected site, finds how the attacker got in, removes every backdoor, rotates passwords, patches the hole and gets the site off any blocklists. Anyone who can fix a hacked WordPress site properly should be able to explain each of those steps to you before they start.
We covered how sites get hacked in what gets WordPress sites hacked. This post is about the cleanup.
Signs your WordPress site has been hacked
Most infections are built to stay hidden from the owner, so the signs are often indirect:
- Google Search Console sends a security warning, your search listing shows "This site may be hacked", or Chrome shows visitors a red warning page.
- A Google search for site:yourdomain.com turns up pages you never wrote, often in Japanese or selling pills and knock-off goods.
- Visitors arriving from Google or on phones get redirected somewhere else, while you, logged in on your desktop, see a normal site.
- There are admin users you don't recognize.
- Your host warns about outgoing spam or suspends the account, or your business email starts landing in spam folders.
Any one of these is reason enough to get the site checked.
Who can fix a hacked WordPress site
Cleanup gets sold under several names, from malware removal to website technical remediation, and the people offering it don't all do the same job.
- Your host. Some hosts scan and restore, while others suspend the account and leave the cleanup to you. A restore is only one part of a cleanup.
- A malware removal service. These usually clean files and request blocklist reviews, often on a subscription. Quality varies, and some don't look for the entry point.
- A WordPress developer who does security work. Someone who knows how WordPress, its database and your plugins fit together can find what a scanner misses and fix the underlying problem.
When you need emergency website repair, it's tempting to hire whoever answers first. Ask four things before they start anyway. Will they find out how the attacker got in? Will they check the database and user accounts as well as the files? Will they handle the blocklist reviews? What happens if the infection comes back? Someone who can't answer clearly is probably planning to delete the obvious files and stop there.
Containing the damage and copying the infected site
First, stop the site harming visitors. If it's redirecting people or serving malware, take it offline or put up a maintenance page. Change the hosting control panel and SFTP passwords straight away, since those live outside WordPress. Leave the WordPress passwords until the backdoors are gone, because malware on the login page can record a new password as easily as the old one.
Then, before deleting anything, take a full backup of the infected site: files, database and the server's access logs. Copying malware on purpose feels backwards, but that copy is your evidence for finding the entry point, and it lets you recover anything the cleanup removes by mistake. Many hosts keep logs for only a few days or weeks, so save them early.
Finding the entry point
Quick cleanups often skip this step, and it's the main reason sites get reinfected: if the hole is still open, the same automated scanner will find it again.
The usual suspects are a plugin or theme with a known vulnerability, a stolen or weak admin password, a pirated premium plugin, or leaked SFTP credentials. To work out which, compare the dates on the earliest modified files with the access logs from the same window, check each plugin's version against public vulnerability databases, and look at which accounts logged in and from where.
Removing malware, backdoors and rogue accounts
Many cleanups stop at deleting the files a scanner flags. A thorough one goes further:
- Replace WordPress core with fresh files from WordPress.org, and reinstall every plugin and theme from a clean source rather than hunting for injected lines in the old copies.
- Look for PHP files in the uploads folder, which should only hold media, and check the must-use plugins folder, which loads automatically and can't be switched off from the dashboard.
- Read wp-config.php and .htaccess line by line. Both are favorite places for redirects and hidden includes.
- Search the database for injected scripts in posts, widgets and settings, and for spam pages hidden among your real ones.
- Check scheduled tasks, in WordPress and on the server, for anything that reinstalls the malware.
- Review every user account. Remove admins you don't recognize, look for application passwords added to real accounts, and check the users table directly, because some malware hides its admin account from the Users screen.
A scanner is useful for confirming the result, but new or customized malware often doesn't match anything in its database, so it can't be the whole method.
Rotating credentials, patching and clearing blocklists
With the site clean, change everything an attacker could have read: every admin password, the database password, the security keys in wp-config.php (which signs everyone out), and any API keys stored in plugin settings, such as payment or email keys. Then fix the cause. Update or replace the plugin that let them in, delete plugins and themes you don't use, swap any pirated plugin for a licensed copy, and move to a supported PHP version. Keeping that up afterwards is the job of ongoing maintenance.
Next, deal with the warnings. If Google flagged the site, request a review from the Security Issues report in Search Console. Reviews can take anywhere from a day to a few weeks, depending on the type of problem. Check other blocklists too, including the ones email providers use if the server was sending spam. Spam pages Google indexed will drop out as they start returning "not found", and the Removals tool in Search Console can hide the worst of them sooner.
Then watch file changes, new users, outgoing mail and Search Console for a few weeks. If something was missed, it tends to show up in that period.
Why restoring an old backup often isn't enough
Restoring a backup from before the hack is useful, and often the fastest part of a cleanup. On its own, it leaves problems in place:
- The hole comes back with it. The backup contains the same vulnerable plugin, and the scanners will find it again.
- The infection may be older than you think. Backdoors often sit unused for weeks before anything visible happens. If your backups only go back a week, every one of them may already be infected.
- Stolen passwords still work. A restore doesn't change any credentials, so an attacker who took them can log straight back in.
- You lose legitimate changes. Orders, form entries and content added since the backup are gone unless someone carries them across.
- The warnings stay up. Google and other blocklists won't clear the site until they recheck it.
A restore works best as one step inside the full process: choose a backup you're confident predates the compromise, restore it, then patch, rotate credentials and request reviews.
How we handle hacked sites
Our emergency website help is open to sites we don't host, and during business hours triage starts within the hour. We take a copy of the infected site before touching anything, find the entry point, and tell you what the cleanup involves and what it will cost before we start it. For sites on a Hosterr plan, backups go back 30 days, which helps when a backdoor has been sitting for a few weeks, and we restore the same day you ask.
Frequently asked questions
How much does it cost to fix a hacked WordPress site?
It depends on how far the infection spread, how long it's been there and whether there's a clean backup to work from. A recent hack with a known entry point and good backups can be a few hours of work, while a site infected for months with no usable backups takes much longer. Get a quote before work starts, and be wary of a flat price that doesn't include finding the entry point.
Can I fix a hacked WordPress site myself?
Sometimes, if the infection is simple and you're comfortable with SFTP, the database and server logs. The risk is missing one backdoor and having to do it all again a few weeks later. If the site takes payments or stores customer data, get help, because you may also have legal obligations to notify the people affected.
Will my site recover in Google after being hacked?
Usually, once it's clean and the warning is lifted. Rankings tend to come back as the spam pages drop out of the index and Google recrawls your real pages, which can take a few weeks. Request the review as soon as the cleanup is done, because traffic stays down while the warning is up.
