Quick answer
After cleaning a hacked WordPress site: change all passwords and security keys, update everything, confirm the entry point is closed, remove unknown users and unused plugins, set up a firewall and monitoring, take a fresh clean backup, and request a Google review if needed. The cleanup removes the infection; these steps stop it recurring.
Key takeaways
- A cleanup without hardening just resets the site to the state that got it hacked.
- Rotate every credential and security key — assume they were exposed.
- A fresh clean backup and ongoing monitoring protect the recovery.
The malware is gone and the site is back — but you're not done. The period right after a cleanup is when you either lock the site down or leave the door open for a repeat. Here's the follow-through that matters.
Rotate every credential
Change all passwords — WordPress, hosting, database, FTP — and regenerate your WordPress security keys. Assume anything the attacker could reach was compromised.
Confirm the entry point is closed
Removing the malware without closing how it got in invites a repeat. Make sure the vulnerable plugin, theme, or weak login that allowed the hack is fixed.
Tidy up users and plugins
Remove any unknown admin accounts and delete plugins and themes you don't use. Every unused component is a door you don't need open.
Harden and monitor
Add a firewall, enforce two-factor authentication, and set up monitoring so any future issue is caught early instead of after Google flags you.
Take a fresh clean backup
Your old backups may be infected. Take a new, verified-clean backup and store it off-site so your recovery point is trustworthy.
Free security check
Worried your site is infected?
Get a free security assessment — I'll tell you if your WordPress site is compromised and exactly what it needs. No obligation.
Follow-up questions
People also ask
Not fully. Until you've closed the entry point, rotated credentials, and hardened the site, the same vulnerability that let attackers in is often still open.
Keep reading
How to Recover Your Google Rankings After a Hack
A hack can tank your search rankings. Here's how to recover them once the site is clean.
WordPress Security for Small Businesses: A Practical Guide
You don't need an IT team to secure a small-business WordPress site. Here's a practical, no-jargon plan that covers the essentials.
How to Secure a WooCommerce Store
A WooCommerce store handles money and customer data, which makes it a target. Here's how to secure it without hurting sales.