Hacked WordPress Site? How to Clean It and Recover (Step by Step)

If your WordPress site has been hacked, the steps you take in the first hour decide how fast you recover. This guide shows exactly how to clean a hacked WordPress site — from the first backup to closing the hole the attacker used — so it stays clean.

The first few hours matter. A compromised website may contain malware, hidden backdoors, malicious redirects, spam pages, unauthorized administrator accounts, or other changes that can put your visitors and business at risk.

The most important thing is to avoid making random changes. Do not immediately delete suspicious files, reinstall WordPress, or restore an old backup without first understanding what happened. A rushed cleanup can remove useful evidence while leaving the real backdoor behind.

How to Tell If Your WordPress Site Has Been Hacked

Before starting the recovery process, make sure you understand the signs of a compromised WordPress website. Some attacks are obvious, while others remain hidden for weeks.

Common warning signs include:

• Unexpected redirects to unfamiliar websites
• Spam pages or posts appearing on your website
• Unknown WordPress administrator accounts
• Strange popups or JavaScript appearing on pages
• Unfamiliar plugins, themes, or files
• Google showing security warnings for your website
• Search results containing spam titles or descriptions
• Unexpected changes to your homepage or website content
• Suspicious login activity
• Your hosting provider reporting malware or suspicious files

If you notice several of these symptoms, treat the website as potentially compromised and begin an investigation before making major changes.

1. Stay Calm and Don't Delete Anything

Your first instinct may be to delete suspicious files immediately. Avoid doing that until you understand the infection.

Malicious files, modified timestamps, unfamiliar administrator accounts, database changes, and server logs can provide important clues about how the attacker gained access. Removing everything without investigating may destroy useful evidence and leave another backdoor behind.

Start by:

• Stopping unnecessary changes to the website
• Documenting what you noticed
• Taking screenshots of suspicious behavior
• Recording error messages and security warnings
• Noting when the problem was first discovered

Think of the compromised website as an incident that needs to be investigated before it is cleaned.

2. Put the Website Into Maintenance Mode

If visitors are seeing malware warnings, phishing content, spam pages, or suspicious redirects, temporarily restrict access to the website while you investigate.

This can help:

• Protect visitors from malicious content
• Reduce the risk of customers interacting with compromised pages
• Limit further damage to your website's reputation
• Reduce the chance of malicious pages being discovered by search engines

If your hosting provider offers a maintenance or temporary holding page, use it while the investigation is underway. Avoid deleting the website just to take it offline.

3. Take a Complete Backup Before Cleaning

Even when a WordPress website is infected, create a complete backup before making major changes whenever possible.

Your backup should include:

• WordPress files
• Database
• Uploads directory
• Configuration files
• Available server and access logs

Keep the backup separate from the live website. It gives you a recovery point if something goes wrong during cleanup and may help with later forensic investigation.

4. Change Compromised Passwords

A WordPress administrator password is not the only credential that may have been exposed during an attack.

After containing the incident, review and change credentials for:

• WordPress administrator accounts
• Hosting control panel
• FTP and SFTP accounts
• SSH users
• Database users
• Email accounts connected to the website
• Cloudflare or other CDN accounts
• Domain registrar account

Use unique, strong passwords and enable two-factor authentication wherever it is available. If you suspect an account was compromised, change its credentials after the affected system has been properly secured.

5. Scan the Entire WordPress Website for Malware

A hacked WordPress website may contain more than one malicious file. Attackers often leave multiple backdoors or persistence mechanisms so they can regain access after the visible malware has been removed.

A thorough investigation should examine:

• WordPress core files
• Plugins
• Themes
• Uploads directory
• Must-use plugins
• Unusual PHP files
• Modified configuration files
• Database content

Automated security scanners can identify many common infections, but they should not always be treated as the complete investigation. Suspicious code may be disguised, obfuscated, or placed somewhere a normal scan does not clearly identify.

If you need professional assistance with a compromised WordPress website, see our WordPress Malware Removal service.

6. Check for Unknown WordPress Users

Attackers may create unauthorized administrator accounts so they can maintain access even after the original vulnerability is fixed.

Review all WordPress users and look for accounts you do not recognize.

• Check administrator accounts
• Review recently created users
• Look for suspicious usernames or email addresses
• Check user roles and permissions
• Remove unauthorized accounts after investigating them

Do not assume an unfamiliar account is harmless simply because it is not currently an administrator. Review its activity and permissions before removing it.

7. Find Out How the WordPress Site Was Hacked

Removing malware is only part of recovering a hacked WordPress website. If the original entry point remains open, the attacker may simply return after the cleanup.

Common causes of WordPress compromises include:

• Vulnerable plugins or themes
• Outdated WordPress core
• Weak or reused passwords
• Compromised hosting credentials
• Exposed FTP or SSH credentials
• Insecure file permissions
• Compromised third-party services
• Pirated or nulled themes and plugins

The goal is not only to remove the current infection but also to identify and fix the weakness that allowed the attacker to enter.

If your website has already been compromised and needs a deeper investigation and recovery, see our Hacked WordPress Recovery service.

8. Update WordPress, Plugins, and Themes

Once the infection has been properly investigated and the website is ready for cleanup, update WordPress and its components to supported versions.

• Update WordPress Core
• Update active plugins
• Update active themes
• Remove unused plugins
• Remove unused themes
• Replace compromised or modified software with clean copies

Do not simply update a known vulnerable plugin and assume the website is clean. If an attacker modified its files or used it as an entry point, the site still needs to be checked for malicious changes.

9. Check the WordPress Database for Malware and Spam

Not every WordPress infection exists in a website file. Attackers can also inject malicious content, spam links, JavaScript, redirects, or unauthorized settings into the database.

Important areas to review include:

• wp_options
• wp_posts
• wp_postmeta
• wp_users
• wp_usermeta

Look for unexpected administrator accounts, suspicious URLs, injected scripts, spam posts, modified settings, hidden redirects, and other content that does not belong to the website.

Database cleanup should be performed carefully. Deleting the wrong records can break WordPress or remove legitimate website content.

10. Check Google Search Console for Security Problems

A hacked website can create SEO and search visibility problems in addition to the security issue itself. Attackers may publish spam pages, inject malicious redirects, or cause Google to display security warnings.

After an attack, check Google Search Console for:

• Security Issues
• Spam pages
• Unexpected indexed URLs
• Manual actions
• Changes in search visibility
• Suspicious search queries or pages

If Google reports a security issue, first make sure the underlying compromise has been completely resolved. Then follow Google's review process when the website is genuinely clean.

A professional WordPress Security Audit can also help identify security weaknesses that may not be obvious from the public-facing website.

11. Regenerate WordPress Security Keys

WordPress security keys, commonly called SALTs, help protect authentication cookies and logged-in sessions.

After a serious compromise, regenerating the security keys can invalidate existing authentication cookies and require users to log in again.

This is particularly useful when you suspect that an attacker may have obtained valid session information.

12. Secure the Website After Malware Removal

Cleaning a hacked WordPress website is not the final step. Once the malware is removed, strengthen the website so the same weakness is less likely to cause another compromise.

Depending on the website and hosting environment, consider implementing:

• Web Application Firewall (WAF)
• Two-factor authentication
• Login protection
• Regular backups
• Malware scanning
• File integrity monitoring
• Secure file permissions
• Cloudflare or CDN protection
• Regular WordPress and plugin updates

Security hardening should be based on the actual risks found during the investigation rather than simply installing more security plugins.

For a stronger WordPress security setup, see our WordPress Security Hardening service.

13. Monitor the Website After Recovery

A successful cleanup should be followed by continued monitoring. Some compromises involve persistence mechanisms that may not be immediately obvious.

Watch for:

• Unexpected file changes
• New administrator accounts
• Spam pages appearing in Google
• Suspicious login attempts
• Unexpected redirects
• Unknown scheduled tasks
• New malware warnings
• Unusual server activity

Monitoring is especially important during the first few weeks after recovery.

How to Clean a Hacked WordPress Site (Summary)

Recovering a hacked WordPress website is more than deleting a few suspicious files. A proper recovery process should investigate the original entry point, identify malicious files and database changes, remove backdoors, review compromised accounts, update vulnerable software, and strengthen the site's security.

If a clean backup exists, it may be useful as part of the recovery process. However, restoring a backup without fixing the vulnerability that caused the compromise can allow the website to become hacked again.

For complicated infections, server-level compromises, persistent malware, or websites with multiple suspicious changes, professional investigation and cleanup may be safer than repeatedly attempting random fixes.

What Not to Do When Your WordPress Site Is Hacked

Some common reactions can make a compromised website harder to investigate or recover.

• Do not delete suspicious files without investigating them.
• Do not immediately reinstall everything without understanding the infection.
• Do not restore an old backup without checking its integrity.
• Do not assume that removing one visible malware file solved the problem.
• Do not leave vulnerable plugins or themes installed.
• Do not ignore unknown administrator accounts.
• Do not assume that an SSL certificate protects against WordPress malware.

The safest approach is structured investigation, complete cleanup, vulnerability remediation, and ongoing monitoring.

Frequently Asked Questions

Can I recover a hacked WordPress website?

Yes. A hacked WordPress website can often be recovered when the infection, backdoors, compromised accounts, and original security weakness are properly identified and addressed.

What should I do first if my WordPress site has been hacked?

First, avoid making random changes. Document the symptoms, contain the website if necessary, create a complete backup, secure compromised accounts, and begin a structured investigation before removing suspicious files.

Should I restore an old backup after a WordPress hack?

A clean backup can be useful, but restoring it alone does not solve the underlying security problem. The vulnerability that allowed the attack should also be identified and fixed.

Can malware come back after WordPress malware removal?

Yes. Malware can return if a hidden backdoor, compromised account, vulnerable plugin, infected database entry, or other persistence mechanism remains.

Is SSL enough to protect a WordPress website?

No. SSL protects data transmitted between the visitor and the website, but it does not prevent malware, vulnerable plugins, compromised administrator accounts, brute-force attacks, or server-level compromises.

How often should I scan my WordPress website?

For business websites, regular automated monitoring combined with periodic security reviews provides stronger protection than occasional scans. The appropriate monitoring frequency depends on the website, hosting environment, and risk level.

Need Professional WordPress Security Help?

If your WordPress website has been hacked, infected with malware, showing suspicious redirects, or containing unauthorized changes, professional investigation can help identify the source of the compromise and restore the website safely.

• ✔ WordPress Malware Removal
• ✔ Hacked WordPress Recovery
• ✔ WordPress Security Hardening
• ✔ WordPress Security Audits
• ✔ Ongoing Security Monitoring
• ✔ Website Protection and Cleanup

Need help with a compromised WordPress website? Tell me what happened, what symptoms you are seeing, and what access you currently have. I can review the situation and determine the safest next step.

About the Author

Sefat Hossain is a WordPress Security Expert specializing in WordPress malware removal, hacked website recovery, security hardening, backdoor removal, security audits, and long-term website protection. He helps website owners investigate compromised WordPress websites, remove malicious infections, and improve security after recovery.

Written by Sefat Hossain

← Back to Blog