Quick answer
To clean a hacked WordPress database: back it up first, then search wp_options, wp_posts, and wp_users for injected scripts, spam links, and unknown admin accounts. Remove malicious entries, delete rogue users, check for suspicious scheduled tasks, and change all passwords. Always pair database cleaning with a file cleanup — malware usually lives in both.
Key takeaways
- File-only cleanups miss malware that lives in the database.
- Common hiding spots are wp_options, post content, and the users table.
- Back up the database before editing, and never guess — remove only confirmed malicious entries.
When people think about a hacked WordPress site, they picture infected files. But the database is just as common a hiding place — and a file-only cleanup will leave the infection alive. Here's how to clean it safely.
Back up before you touch anything
Export the full database first. A wrong edit can break your site, and you'll want a restore point.
Where malware hides in the database
- wp_options — injected scripts, redirect code, or malicious settings
- wp_posts — spam links or hidden content inside posts and pages
- wp_users / wp_usermeta — rogue admin accounts and elevated privileges
Remove the malicious entries
Search for suspicious code (obfuscated scripts, unfamiliar URLs, base64 strings) and remove only what you've confirmed is malicious. Delete unknown admin users and reset the passwords of the rest.
Check scheduled tasks
Look at WordPress cron events for suspicious jobs that could be re-injecting malware or spam on a schedule.
Pair it with a file cleanup
The database is half the job. Clean the files too, close the entry point, and change all credentials. Then re-scan to confirm nothing reappears.
Free security check
Worried your site is infected?
Get a free security assessment — I'll tell you if your WordPress site is compromised and exactly what it needs. No obligation.
Follow-up questions
People also ask
Yes. Injected JavaScript, spam links, redirect code, and rogue admin users all commonly live in the database, not just in files.
Keep reading
How to Detect and Remove a Credit-Card Skimmer in WooCommerce
A card skimmer quietly steals customer payment details at checkout. Here's how to detect and remove one from WooCommerce.
Website Suspended by Your Host? How to Get It Back Online
If your host suspended your account for malware, here's how to clean the site to their standard and get it reactivated.
How to Request a Google Security Review After a Hack
Cleaned the hack but Google still warns visitors? Here's how to request a security review and get the warning lifted — the right way.