Recover a Hacked WordPress Site

Clean malware from your WordPress site, close the vulnerability, and get back online.

Your WordPress site is showing malware warnings, redirecting visitors, or displaying spam content. Here’s how to clean it up and prevent reinfection.

Confirm You’re Actually Hacked

Before cleanup, verify it’s malware and not a plugin conflict:

1. Google Search Console – Check Security Issues section
2. Sucuri SiteCheck – Free scan for malware
3. VirusTotal – Submit your URL
4. Visit in incognito – See what visitors see

Common signs:

• Redirects to spam/casino/pharma sites
• Foreign language content you didn’t add
• Unknown admin users in WordPress
• Google showing “This site may be hacked” warning
• Hosting provider suspended your account

Emergency Recovery Steps

Step 1: Lock Down Access (15 minutes)

Change ALL passwords immediately:

• All WordPress admin users
• Hosting control panel (cPanel, Plesk)
• FTP/SFTP accounts
• Database (MySQL) password

Remove unauthorized users:

1. Go to Users → All Users
2. Delete any admin accounts you didn’t create
3. Look for recent registrations with suspicious names

Step 2: Update Everything (30 minutes)

Outdated software is how most sites get hacked:

1. Dashboard → Updates → Update WordPress core
2. Update ALL plugins (Plugins → Installed Plugins → Select All → Update)
3. Update ALL themes
4. Delete unused plugins and themes (don’t just deactivate)

Step 3: Scan and Clean (60 minutes)

Option A: Use Wordfence (recommended):

1. Install Wordfence Security
2. Go to Wordfence → Scan → Start New Scan
3. Wait for scan (15-30 min)
4. Review results and clean detected threats

Option B: Manual inspection:

Check these locations for suspicious .php files:

• /wp-content/uploads/ – Should only have images, not .php files
• /wp-includes/ – Should match a fresh WordPress download
• /.htaccess – Look for redirect code
• /wp-config.php – Check for injected code at beginning/end

Red flags in code:

• eval(base64_decode(...))
• Suspicious file_get_contents()
• Hidden iframes
• Encoded/obfuscated strings

Step 4: Clean Database (30 minutes)

Access phpMyAdmin through your hosting panel.

Find spam posts:

SELECT * FROM wp_posts WHERE post_content LIKE '%casino%'
OR post_content LIKE '%pharmacy%' OR post_content LIKE '%viagra%';

Find unauthorized users:

SELECT * FROM wp_users WHERE user_registered > '2026-01-01';

Check for malicious options:

SELECT * FROM wp_options WHERE option_value LIKE '%eval%'
OR option_value LIKE '%base64%';

Delete spam content and unauthorized users.

Step 5: Replace .htaccess (5 minutes)

Replace your .htaccess with a clean version:

# BEGIN WordPress
<IfModule mod_rewrite.c>
RewriteEngine On
RewriteBase /
RewriteRule ^index.php$ - [L]
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule . /index.php [L]
</IfModule>
# END WordPress

Step 6: Regenerate Security Keys (5 minutes)

1. Go to WordPress Secret Key Generator
2. Copy the generated keys
3. Replace the keys section in wp-config.php

Prevent Reinfection

Immediate actions:

• Install Wordfence or Sucuri for ongoing protection
• Enable automatic updates (Settings → General or via plugin)
• Set up daily backups with UpdraftPlus
• Enable 2FA for all admin accounts (see our 2FA Guide)

Security hardening:

• Change database table prefix if using default wp_
• Disable file editing: Add define('DISALLOW_FILE_EDIT', true); to wp-config.php
• Limit login attempts (Wordfence does this)
• Use strong passwords (12+ chars, mixed)

Request Google Review

If Google flagged your site:

1. Go to Google Search Console → Security Issues
2. Review all flagged issues
3. Click “Request Review” after cleanup
4. Wait 24-72 hours for re-evaluation

When to Call a Professional

• Infection keeps returning after cleanup
• You can’t access wp-admin at all
• Hosting provider won’t restore access
• Site handles payments or sensitive data
• You don’t have a clean backup to restore from

Professional cleanup services:

• Sucuri ($199+)
• Wordfence ($179+)
• Your hosting provider may offer malware removal

Confirming Your Site Is Clean

• Wordfence/Sucuri scan comes back clean
• No unauthorized admin users
• Site loads normally without redirects
• Google Search Console shows no security issues
• Automatic backups and security monitoring are running

Sources

• Wordfence Learning Center
• Sucuri Security Guides
• WordPress.org – Hardening WordPress

Hacked Site Recovery Questions

How do I know if my WordPress site is really hacked?

Real signs: Google “This site may be hacked” warning, strange redirects, unknown admin users, unfamiliar files in wp-content, or your host suspended you. Phishing emails claiming you’re hacked (with no evidence) are usually scams.

Should I pay a ransom if my site is held hostage?

No. There’s no guarantee you’ll get access back, and payment encourages more attacks. Restore from backup instead. If you don’t have backups, hire a professional security firm—but don’t pay attackers.

How long does it take to clean a hacked site?

Simple malware: 2-4 hours. Complex compromise with backdoors: 1-2 days. Complete rebuild from clean backup: 1-4 hours depending on site complexity. Clean backups are always faster than cleaning infections.

How do I prevent getting hacked again?

Strong passwords + 2FA for all admin users, keep WordPress/plugins/themes updated, use a security plugin (Wordfence, Sucuri), and maintain regular backups. Most hacks exploit outdated software or weak passwords.