Cleaning a Hacked WordPress Site: A Step-by-Step Rescue Guide

Finding spam pharma links in your search results or a red warning screen in Chrome is a rough way to start the day. Cleaning a hacked WordPress site is a methodical process, not a single button: you isolate the damage, remove the malicious code, close the hole that let the attacker in, then repair the SEO fallout. This guide walks through the whole rescue, including the recovery step most tutorials skip.

Most small business sites can be cleaned in three to eight hours of focused work. Sites with heavy customization, thousands of posts or repeat infections often take longer, and sometimes a rebuild is cheaper than the cleanup.

First, Confirm You Have Actually Been Hacked

Not every strange symptom means an attacker got in. A blank white screen or sudden 500 error is more often a plugin conflict or a PHP version bump than a hack. Real compromise usually shows at least two of the signals below.

• Search results show content you never wrote, typically Japanese keyword spam, replica goods or gambling pages indexed under your domain.
• Redirects that only fire for mobile users or visitors arriving from Google, while a direct visit looks completely normal.
• Admin users you do not recognize, often with random alphanumeric usernames and a Gmail-style address.
• Google Search Console security issues or a browser warning powered by Google Safe Browsing.
• Recently modified core files, especially index.php, wp-config.php, .htaccess or files sitting in /wp-content/uploads/ with a .php extension.

Check your host’s file manager and sort by modification date. A cluster of files changed at 3:14am on a day you did nothing is your smoking gun.

Step 1: Contain the Damage Before You Clean Anything

Put the site into maintenance mode or, if the infection is serving malware to visitors, ask your host to suspend public access for a few hours. Leaving an infected site live extends the blacklist window and lets the attacker re-inject while you work.

Then take a full backup of the hacked state, files plus database, and store it somewhere separate from your working copy. It sounds counterintuitive to back up an infected site, but that archive is your only reference if you delete something legitimate by accident, and it preserves evidence about how the breach happened.

Step 2: Lock Out the Attacker

Cleaning files while the intruder still holds valid credentials is wasted effort. Close every door in one sitting:

1. Reset all WordPress admin passwords, then delete any user account you cannot personally vouch for.
2. Change the hosting control panel, FTP/SFTP and database passwords, since attackers frequently pivot between them.
3. Replace the authentication salts in wp-config.php using the official WordPress secret key generator, which force-logs-out every existing session.
4. Review scheduled tasks (WP-Cron entries and server cron jobs) for anything calling an unfamiliar file or remote URL.
5. Turn on two-factor authentication for WordPress logins before you restore public access.

If several people share one admin login, this is the moment to split them into individual accounts with the lowest role each person actually needs.

Step 3: Scan the Site With a Malware Scanner

Run at least two scans from different angles. A server-side scanner such as Wordfence, MalCare or Sucuri reads the actual files and compares core, theme and plugin code against known-good checksums, catching backdoors that a remote URL scanner never sees. A remote scanner like Sucuri SiteCheck confirms what visitors and Google are being served.

Free tiers handle the detection side well; most charge for hands-off cleanup, typically between $50 and $300 per incident. Our roundup of the best WordPress security plugins to keep hackers out breaks down which scanners include automated removal and which only flag problems.

Export the scan report before you start deleting. You will want the file paths list when you check your work later.

Step 4: Replace Core, Themes and Plugins With Clean Copies

The fastest reliable way to clean WordPress files is replacement rather than surgery. Download a fresh copy of WordPress matching your version, delete /wp-admin/ and /wp-includes/ entirely, then upload the clean directories. Those two folders contain nothing unique to your site.

Do the same with every plugin and your theme: delete and reinstall from the repository or the developer’s account rather than trying to strip out injected lines. For a child theme or custom plugin with no clean source, you have to read the code manually, looking for eval(, base64_decode(, gzinflate( and long obfuscated strings.

Any plugin that was abandoned, nulled or downloaded from a torrent site should be removed permanently. Nulled premium themes are one of the most common infection vectors we see, and no amount of site cleaning fixes a plugin that ships with a backdoor by design.

Step 5: Clean the Uploads Folder.htaccess and wp-config

Attackers hide persistence mechanisms outside the obvious places. Work through these four spots before you declare the WordPress site cleaned:

• /wp-content/uploads/: no PHP file belongs here. Search the directory tree for .php.phtml and .ico files and remove them.
• .htaccess: strip out any RewriteRule pointing at a domain you do not own, plus auto_prepend_file directives.
• wp-config.php: compare it against wp-config-sample.php from the fresh download; malicious includes usually sit above the database credentials.
• /wp-content/mu-plugins/: must-use plugins load automatically and never appear in the normal plugins screen, which makes the folder a favorite hiding spot.

Also confirm file permissions are sane: 644 for files, 755 for directories, and 400 or 440 for wp-config.php where your host allows it.

Step 6: Clean the Database

Malware often survives a full file wipe because it lives in the database. Open phpMyAdmin or Adminer and search the wp_options, wp_posts and wp_users tables for suspicious strings such as <script, iframe, base64 and any spam keyword you saw in Google.

Check wp_options for rogue autoloaded entries and confirm that siteurl and home both point to your real domain. In wp_users, look for accounts with a user_registered date matching the breach window, then verify the wp_user_level and capabilities meta on the accounts you keep.

Back up the database again before every bulk edit. One careless UPDATE query on wp_posts can do more damage than the malware did.

Step 7: When to Restore a Backup Instead

If you have a clean backup from before the infection date, restoring is faster and safer than manual cleaning, with two caveats. You lose every post, order and comment created since that snapshot, and if the entry point was an outdated plugin, you are restoring the vulnerability along with the content.

The practical approach is to restore the backup, immediately update everything, then rescan. Daily off-site backups are the single cheapest insurance policy in WordPress, and our comparison of free and paid WordPress backup plugins covers retention windows worth paying for.

Step 8: Repair the SEO Damage (the Step Most Guides Skip)

Removing the malware does not automatically restore your rankings. A hacked WordPress site frequently leaves hundreds of spam URLs sitting in Google’s index, and those pages keep dragging on site quality signals for weeks after the code is gone.

1. Open Google Search Console, review the Security Issues report and submit a review request once the site is verifiably clean. Google’s guidance on recovering from a hacked site explains what reviewers check.
2. Serve a 410 Gone status for injected spam URLs rather than redirecting them to your homepage, which tells search engines the pages are permanently removed.
3. Where a legitimate URL was hijacked or renamed, set up proper 301 redirects in WordPress so link equity survives.
4. Regenerate and resubmit your XML sitemap, then use the URL Inspection tool on your top ten pages to confirm the rendered HTML no longer contains injected scripts.
5. Re-validate structured data, because injected content can break markup. If yours needs rebuilding, follow our walkthrough on implementing schema markup on a WordPress site.

Most sites see rankings recover within two to six weeks of a successful review, though sites that were blacklisted for a month or more sometimes take a full quarter to return to previous traffic levels.

Step 9: Harden the Site So It Does Not Happen Twice

Reinfection rates are high precisely because people clean the symptom and leave the cause. Work through the official WordPress hardening documentation, then put these habits in place:

• Update core, plugins and themes weekly, and remove anything you have not used in six months.
• Limit login attempts and rename or protect wp-login.php against brute force traffic.
• Run a web application firewall at the DNS or server level, not only inside WordPress.
• Keep off-site backups with at least 30 days of retention, tested by an actual restore.
• Audit user roles quarterly and disable file editing with define('DISALLOW_FILE_EDIT', true);.

Keeping your plugin stack lean helps more than any single tool. Our list of 15 essential WordPress plugins every site needs is a good baseline for trimming a bloated install down to code you actually maintain.

Frequently Asked Questions

How to fix a hacked WordPress site?

Fixing a hacked WordPress site takes eight steps: contain the site, back up the infected state, reset all passwords and salts, scan with a server-side malware scanner, replace core and plugin files with clean copies, clean the database and uploads folder, request a Google Search Console review, then harden the install. Most small sites are back online within a day. Skipping the root-cause step is why roughly one in five cleaned sites is reinfected.

How to clean a WordPress site?

The reliable method is replacement, not repair: delete /wp-admin/ and /wp-includes/ and upload fresh copies from WordPress.org, reinstall every plugin and theme from source, then remove any PHP file found in /wp-content/uploads/. Follow that with a database search for injected scripts and a review of .htaccess, wp-config.php and the mu-plugins folder.

How to clean a WordPress website from malware?

Use two scanners: a server-side plugin such as Wordfence or MalCare for file-level detection, plus a free remote scanner like Sucuri SiteCheck to see what visitors are served. Free malware removal plugins handle common injections well, while paid site cleaning services typically run $50 to $300 per incident and include a warranty against reinfection for a set period.

Can a hacked website be recovered?

Yes, the large majority of hacked websites are fully recoverable, and blacklist warnings are usually lifted within 24 to 72 hours of a successful review request. Recovery is hardest when there is no clean backup and the site runs heavily customized code, in which case rebuilding on fresh WordPress with migrated content is often faster than a line-by-line audit.

How long does it take to clean a hacked WordPress site?

Expect three to eight hours for a typical small business site, and one to three days if the infection reached the database or multiple sites on shared hosting. SEO recovery runs on a separate clock, generally two to six weeks before rankings stabilize.

Need a Hand Cleaning Up?

If your site is still redirecting visitors or flagged in Google after a first cleanup attempt, we can take the whole thing off your plate, from malware removal to the Search Console review and rankings recovery. Talk to SEO Quirk about an emergency cleanup, or read why working with a local agency makes the follow-up faster.