If your WordPress site has been hacked, the most important thing you can do right now is stay calm and follow a structured recovery process — panicking leads to mistakes that make things worse. A hacked WordPress site can almost always be recovered, and this guide will walk you through every step, from confirming the breach to locking the site down so it never happens again. Whether you are seeing spam injections, a defaced homepage, or a Google warning, the process is largely the same.

How Do You Know Your WordPress Site Has Been Hacked?

Before diving into recovery, confirm you are actually dealing with a hack rather than a plugin conflict or server error. Common signs of a compromised WordPress site include:

  • Google Search Central's Safe Browsing warning — a red "Deceptive site ahead" screen in browsers
  • Visitors being redirected to unrelated websites (pharma spam, gambling sites)
  • New admin accounts you did not create appearing in Users → All Users
  • Your web host suspended your account citing malware
  • Spam pages indexed in Google (search site:yourdomain.com and look for strange results)
  • Files modified recently with no corresponding update or change on your part
  • Your own login credentials no longer work

If two or more of these match your situation, treat it as a confirmed hack and proceed immediately.

Step 1: Put Your Site Into Maintenance Mode and Isolate It

Your first priority is to stop the hack from spreading and protect your visitors.

Take the Site Offline Temporarily

Contact your hosting provider immediately and ask them to take the site offline or place it in a quarantine state. Most managed WordPress hosts (such as those following OWASP-recommended isolation practices) can do this in minutes. If you have cPanel access, you can password-protect the public directory as a stopgap:

  1. Log in to cPanel.
  2. Navigate to Directory Privacy.
  3. Select your public_html folder and enable password protection.

Change Your Hosting Account Password

Change your cPanel or hosting dashboard password immediately from a clean, trusted device — not a computer you suspect has been compromised.

Step 2: Reset All Passwords Across the Board

A hacked site almost always means credentials have been stolen or brute-forced. Reset every password associated with your site before you touch anything else.

Passwords to Reset Right Now

  • WordPress admin accounts — go to Users → All Users, hover each account, and click Send password reset or update manually via phpMyAdmin
  • Database password — update in cPanel under MySQL Databases, then update wp-config.php accordingly (the DB_PASSWORD constant)
  • FTP/SFTP credentials — regenerate in your hosting dashboard
  • Hosting account password — already done in Step 1
  • Email account linked to WordPress admin — attackers who control this email own your site

Delete Unknown Admin Accounts

Go to Users → All Users, set the role filter to Administrator, and delete any account you do not recognise. If you cannot log into WordPress, do this via phpMyAdmin:

sql SELECT * FROM wp_users; DELETE FROM wp_users WHERE user_login = 'suspicioususer'; DELETE FROM wp_usermeta WHERE user_id = [ID of deleted user];

Replace wp_users and wp_usermeta with your actual table prefix if it is not the default wp_.

Step 3: Scan Your Site for Malware

Do not guess. Use real scanning tools to find exactly what has been injected or modified.

Option A: Use a WordPress Security Plugin Scanner

Install and run one of these reputable scanners from the WordPress plugin repository:

  • Wordfence Security — includes a file integrity scanner that compares your core files against the official WordPress repository checksums
  • Sucuri Security — provides both a free site scanner and a server-side scanner if you purchase their service
  • MalCare — runs the scan on its own servers so it does not slow down your site

Run a full scan and export the list of flagged files before you delete or change anything.

Option B: Use Your Host's Malware Scanner

Many hosts include server-level scanners. In cPanel, look for Virus Scanner or ask your host to run ImunifyAV or ClamAV against your account.

Option C: Manual File Inspection via SFTP

Connect to your site via SFTP (never plain FTP — it transmits credentials in plaintext). Sort files by Last Modified Date and look for recently changed files you did not touch. Common injection locations include:

  • wp-config.php — look for obfuscated base64_decode calls or added code at the very top or bottom
  • wp-includes/ — attackers often plant files here because it looks legitimate
  • wp-content/themes/[your-theme]/functions.php — a common injection point
  • .htaccess — check for redirect rules you did not write
  • Random .php files with gibberish names in wp-content/uploads/

Red flag code patterns to look for:

eval(base64_decode str_rot13 gzinflate( preg_replace('/.*/e'

These patterns are hallmarks of malware obfuscation and should not appear in legitimate WordPress files.

Step 4: Clean the Infected Files

Now that you know what is compromised, you can clean it.

Replace WordPress Core Files

Download a fresh copy of WordPress from wordpress.org/download matching your current version. Delete and replace the following directories entirely (they contain no user data):

  • /wp-admin/
  • /wp-includes/

Also replace wp-login.php, index.php, xmlrpc.php, and all other root-level core files. Do not touch wp-config.php or the wp-content/ folder at this stage.

Clean the wp-content Folder

The wp-content/ folder contains your themes, plugins, and uploads, so you cannot simply delete it.

  • Plugins: Delete every plugin folder under wp-content/plugins/ and reinstall plugins fresh from the WordPress repository or a legitimate purchase source. Do not restore plugin files from a backup that pre-dates your awareness of the hack — they may already be infected.
  • Themes: Delete all inactive themes entirely. For your active theme, compare each file against the original theme files from the developer. Replace any file that differs unexpectedly. If it is a custom theme with no reference copy, manually review every PHP file for obfuscated code.
  • Uploads: The wp-content/uploads/ folder should contain only images, PDFs, and media files — not .php files. Delete any .php file found here. Use this command via SSH if available:

bash find wp-content/uploads -name "*.php" -delete

Clean the Database

Malware is often injected into the WordPress database, particularly into:

  • wp_options — look for suspicious option_value entries, especially in siteurl, home, and entries with serialised PHP
  • wp_posts — spam links or hidden iframes injected into post content
  • wp_users — already addressed in Step 2

Use phpMyAdmin to search for malicious strings. Common ones include <iframe, eval(, base64_decode, and known spam domains. The Wordfence and Sucuri scanners will also flag database infections.

Clean the .htaccess File

Delete your current .htaccess file and regenerate a clean one inside WordPress by going to Settings → Permalinks and clicking Save Changes.

Step 5: Update Everything

Running outdated software is the single most common reason WordPress sites get hacked, according to the WordPress Security Team. After cleaning, update immediately:

  • WordPress core — go to Dashboard → Updates
  • All plugins — even ones you rarely use
  • Your theme — including any parent theme

If a plugin or theme is no longer maintained (check the "last updated" date in the WordPress repository — anything over two years old is a serious risk), delete it entirely and find an actively maintained alternative.

Step 6: Restore From a Clean Backup (If Cleaning Is Not Sufficient)

If the infection is so widespread that manual cleaning is not practical, restore from a backup — but only if you can confirm the backup pre-dates the infection.

How to Identify a Clean Backup

Check your file modification timestamps against your backup dates. If your host logs show the first suspicious file modification was on a specific date, any backup made before that date should be clean.

How to Restore

  1. Download the backup archive from your host or backup plugin (JetBackup, UpdraftPlus, etc.)
  2. Verify the backup opens correctly and contains your expected files
  3. Use cPanel's Backup Wizard or your host's restore function to deploy it
  4. Immediately apply all updates (Step 5) to the restored site, because the vulnerability that allowed the hack likely still exists in the restored version

Important: After restoring, repeat the scan in Step 3 to confirm the restored version is clean.

Step 7: Request a Google Safe Browsing Review

If Google flagged your site with a malware warning, that warning will remain even after you clean the site until you request a review. Leaving it in place costs you traffic and trust every hour it persists.

  1. Go to Google Search Console (formerly Webmaster Tools) — search.google.com/search-console
  2. Verify ownership if you have not already
  3. Navigate to Security & Manual Actions → Security Issues
  4. Review the listed issues and confirm you have addressed them
  5. Click Request Review and describe the steps you took

Google's own guidance in Search Central states reviews typically take a few days. Do not request a review until you are certain the site is clean, as repeated failed requests can extend the timeline.

Step 8: Harden Your WordPress Site to Prevent Re-infection

Cleaning up a hacked site without hardening it is like patching a hole in a boat without bailing out the water. CISA (the Cybersecurity and Infrastructure Security Agency) recommends a defence-in-depth approach — multiple overlapping layers of security.

Secure wp-config.php

Move wp-config.php one directory above your public_html folder if your host allows it. WordPress will find it automatically. Also add these rules to your .htaccess to block direct access:

apache <Files wp-config.php> order allow,deny deny from all </Files>

Disable XML-RPC If You Do Not Need It

xmlrpc.php is a frequent brute-force target. If you are not using remote publishing tools or the Jetpack plugin features that require it, block it:

apache <Files xmlrpc.php> order allow,deny deny from all </Files>

Limit Login Attempts

Install Limit Login Attempts Reloaded (available in the WordPress repository, over two million active installations) to block brute-force attacks by temporarily locking out IPs with repeated failed logins.

Enable Two-Factor Authentication

Add two-factor authentication (2FA) for all administrator accounts using a plugin such as WP 2FA or Two Factor Authentication from the WordPress repository.

Set Correct File Permissions

OWASP recommends these WordPress file permissions as a baseline:

  • Directories: 755
  • Files: 644
  • wp-config.php: 440 or 400

You can set these via SSH:

bash find /path/to/your/wordpress -type d -exec chmod 755 {} ; find /path/to/your/wordpress -type f -exec chmod 644 {} ; chmod 400 wp-config.php

Replace /path/to/your/wordpress with your actual installation path.

Use a Web Application Firewall (WAF)

A WAF filters malicious traffic before it reaches WordPress. Options include:

  • Cloudflare (free tier includes basic WAF rules)
  • Sucuri's WAF (paid, specialised for WordPress)
  • Wordfence (plugin-level firewall, free and paid tiers)

Set Up Automatic Backups

Configure automated backups with off-site storage (not just on your server) using UpdraftPlus, BlogVault, or your host's backup service. CISA's incident response guidance emphasises that reliable backups are the single most effective recovery tool against any attack.

Monitor Your Site Going Forward

  • Enable Wordfence's email alerts for new admin account creation, plugin changes, and file modifications
  • Add your site to Google Search Console if you have not already — it will alert you to future security issues
  • Check Google's Transparency Report at transparencyreport.google.com/safe-browsing/search periodically to confirm your site status

Step 9: Document What Happened

Write down a brief incident log:

  • When you first noticed the hack
  • What symptoms appeared
  • What files or database entries were affected
  • What steps you took to resolve it
  • What vulnerability you believe was exploited (outdated plugin, weak password, etc.)

This documentation is valuable if you need to report the incident to a hosting provider, face questions from clients or customers, or experience a similar incident in the future.

Frequently Asked Questions

How long does it take to recover a hacked WordPress site?

For a straightforward infection (one compromised plugin, limited file changes), a thorough recovery takes two to six hours. A severe or long-standing compromise involving database injections, multiple backdoors, and a Google blacklisting can take one to two days of work. Restoring from a clean backup, if one is available, is almost always faster than manual cleaning.

Can I recover a hacked WordPress site without a backup?

Yes. If no clean backup is available, you can recover by replacing all core WordPress files with fresh copies from wordpress.org, manually cleaning the wp-content folder, removing malicious database entries, and resetting all credentials. It is more time-consuming but entirely possible. This is exactly the process described in Steps 1 through 8 above.

Should I pay a professional to clean my hacked WordPress site?

If you are not comfortable with SFTP, phpMyAdmin, or command-line tools, or if the infection is extensive, hiring a professional is a sensible investment. Services from companies like Sucuri or Wordfence (both offer incident response) typically cost between $200 and $500 for a one-time cleanup and come with a guarantee. Weigh that against the revenue lost while your site is down or flagged by Google.

Why did my WordPress site get hacked?

The three most common causes, as consistently reported by the WordPress Security Team and security researchers, are: (1) outdated plugins or themes with known vulnerabilities, (2) weak or reused passwords on admin accounts, and (3) insecure hosting environments (shared hosting where another account was compromised). Nulled (pirated) plugins and themes are also a significant vector, as they frequently contain deliberate backdoors.

How do I stop my WordPress site from being hacked again?

No site can be made completely immune, but you can reduce the risk dramatically by: keeping WordPress core, plugins, and themes updated at all times; using strong, unique passwords and enabling 2FA on all admin accounts; installing a WAF; taking automated off-site backups; and removing any plugin or theme you are not actively using. Following the hardening steps in Step 8 of this guide will put your site in a significantly stronger position than the vast majority of WordPress installations on the web.