Quick answer: To fix a hacked WordPress site, first contain it (take a backup of the infected state, change all passwords, put the site in maintenance mode if it is attacking visitors). Then replace WordPress core, themes and plugins with clean copies, remove malicious files and database entries, find and close the entry point, and request a review in Google Search Console if you have been flagged. Finish by hardening the site so it does not happen again.
Signs of a hack vary. Visitors get redirected to spam sites. Google shows “This site may be hacked” in results. Chrome shows a red warning screen. Your host suspends the account for sending spam. Strange pages appear in search results in languages you do not publish in. Or a security plugin emails you about changed files.
Whatever the symptom, the process is the same. Work through it calmly and in order.
Step 1: Contain the damage
Do not panic and delete everything. You may need the infected files to find out how the attacker got in.
- Take a full backup of the current state (files and database) and store it offline, labelled clearly as infected.
- Change every password: WordPress admin users, hosting control panel, FTP/SFTP, database user, and the email account tied to the admin user.
- Check for unknown admin users in Users and remove any you did not create.
- Put the site in maintenance mode if it is serving malware or redirecting visitors. Protecting visitors matters more than uptime for a few hours.
- Tell your host. Many hosts have security teams and can share logs that show where the attack came from.
Step 2: Scan to understand the infection
Use more than one source:
- A security plugin such as Wordfence or Sucuri Security to scan core files, themes and plugins against known good versions. See Wordfence vs Sucuri for a comparison.
- An external scanner such as Sucuri SiteCheck to see what visitors and search engines receive.
- Google Search Console Security Issues report, which lists hacked content or malware Google found.
- Google Safe Browsing site status to check whether browsers are warning visitors.
- Server access logs for unusual POST requests to odd files, login attempts, or requests to files in uploads.
Write down what you find: modified files, unfamiliar files, spam URLs, injected scripts.
Step 3: Clean the files
Replace WordPress core
Download a fresh copy of WordPress from wordpress.org (the same version or the latest 4.9.x release) and replace the wp-admin and wp-includes folders completely. Replace root files except wp-config.php and .htaccess, which you will inspect by hand.
Replace plugins and themes
Delete each plugin folder and reinstall a fresh copy from the official source. Do the same for themes. Remove any plugin or theme you do not use. Never reinstall “nulled” premium plugins; pirated plugins are a common source of backdoors.
If your theme is custom, compare it with your version control or a known-good backup. Look for obfuscated code, eval(, base64_decode(, gzinflate( and long unreadable strings.
Check wp-config.php and .htaccess
Look for extra code at the top or bottom of wp-config.php, and for redirect rules in .htaccess that send search engine or mobile visitors elsewhere.
Clean the uploads folder
The uploads folder should hold media, not PHP files. Search for .php files in wp-content/uploads and remove them after checking. Then block PHP execution in uploads with a server rule.
Step 4: Clean the database
Attackers often hide content in the database:
- Spam posts or pages (sort by date and look for recent unknown entries)
- Injected scripts in post content, widgets or theme options
- Rogue admin users
- Modified
siteurlorhomeoptions pointing to another domain - Suspicious entries in the options table that load remote code
Search the database for <script, eval(, base64 and unfamiliar domains. Be careful: legitimate plugins sometimes store encoded data. When in doubt, compare with a clean backup from before the hack.
Step 5: Find and close the entry point
Cleaning without fixing the cause invites a repeat hack within days. Common entry points:
- Outdated plugins or themes with known vulnerabilities
- Weak or reused passwords and no login protection
- Abandoned plugins that no longer get security fixes
- Compromised FTP credentials on an infected computer
- Other sites on the same hosting account (one infected site can infect its neighbours)
- Outdated PHP versions on the server
Update everything, remove what you do not need, and check other sites in the same account. Use your logs and the file modification dates from Step 2 to narrow down the likely route.
Step 6: Clear warnings from Google and browsers
Once the site is clean:
- In Google Search Console, go to Security Issues, confirm you fixed the problems, and request a review. Describe what you cleaned and what you changed to prevent reinfection.
- Remove spam URLs that Google indexed. Return a 404 or 410 for them, and use the Remove URLs tool for urgent cases.
- Check your sitemap only lists real pages.
- If your domain was blacklisted by other services (email blacklists, security vendors), follow their delisting process.
Reviews for malware usually take a few days. Spam (hacked content) reviews can take longer.
Step 7: Harden the site
Now lock it down. Our WordPress security checklist covers this in depth, but the essentials are:
- Keep core, plugins and themes updated. Apply security releases promptly.
- Use strong unique passwords and a password manager.
- Turn on two-factor authentication for admin accounts; see WordPress two-factor authentication.
- Limit login attempts and consider changing who can reach
wp-admin. - Run a firewall (plugin-based or a cloud firewall such as Sucuri or Cloudflare).
- Disable file editing in the dashboard with
define('DISALLOW_FILE_EDIT', true); - Use SFTP, not FTP.
- Run a current PHP version (PHP 7.x).
- Serve the site over HTTPS.
- Take automatic, off-site backups and test a restore.
- Give users the lowest role they need.
Should you clean it yourself or get help?
You can clean a simple infection yourself if you are comfortable with files, databases and server logs. Get professional help if:
- The site handles payments or personal data
- It has been reinfected after a cleanup
- The host has suspended the account
- You cannot find the entry point
- Downtime is costing real money
A professional cleanup should include a written report of what was found, what was removed and how the entry point was closed.
FAQ
Will restoring a backup fix the hack?
Only if the backup predates the infection and you then close the entry point. Otherwise the attacker will return through the same hole.
How did they get in if my site is small?
Most attacks are automated. Bots scan the whole web for known vulnerabilities and weak passwords. Size does not protect you.
Will the hack hurt my SEO?
Spam pages and warnings can hurt rankings and clicks. Cleaning quickly and requesting a review limits the damage.
Do I need a security plugin after cleanup?
A firewall and file monitoring help, but updates, strong logins and backups matter more.
Clean it once, then keep it clean
A hacked WordPress site is stressful, but the fix follows a clear order: contain, scan, replace files, clean the database, close the entry point, clear Google warnings and harden. If you would rather hand the cleanup and ongoing protection to a team that does it every week, see how we keep business sites safe so they can turn visitors into customers.
