How to Clean a Hacked WordPress Site

Q: How do I know if my WordPress site has been hacked?

Common signs include sudden spam redirects, Google displaying a 'This site may be hacked' warning, unexpected admin users in your dashboard, severe performance drops, or your hosting provider suspending your account due to outbound malicious traffic.

Q: Can I just use a security plugin to clean my hacked site?

Security plugins are helpful for basic scans, but they frequently miss custom backdoors, database injections, or obfuscated webshells. A proper cleanup requires inspecting file checksums, cleaning the database manually, and hardening server permissions.

Q: Why does my WordPress site keep getting reinfected after cleaning?

Reinfection happens when backdoors are left behind in the uploads directory or database, or when the original vulnerability—such as an outdated plugin, weak FTP password, or compromised hosting account—remains unpatched.

Q: Will cleaning malware delete my website content?

If done correctly, no. Cleaning targets core files, plugin directories, and injected database strings without deleting your actual post content or media files. However, always take a full backup before starting.

To clean a hacked WordPress site, you must systematically isolate the environment, verify core and plugin files against clean checksums, inspect the database for injected scripts, remove backdoors, and re-secure file permissions. Quick plugins often leave hidden webshells behind, making a manual or WP-CLI triage protocol essential for permanent recovery.

When a site is compromised, urgency often leads to panic. Owners frequently reinstall plugins or run an automated scanner and assume the issue is resolved, only to be reinfected hours later. In my decade of handling WordPress development and server maintenance, I have learned that half-cleaning a website is as bad as not cleaning it at all. Below is the step-by-step process I use to isolate, clean, and harden an infected WordPress installation.

Step 1: Isolation and Emergency Triage

Before touching a single file, take the site offline or block public traffic to prevent further abuse, malicious spam redirects, or malware spreading to visitors.

Take a Full Backup: Even a compromised backup is critical. Download the raw wp-content folder and dump the MySQL database via phpMyAdmin or SSH. If a cleanup step breaks the site, you need a recovery baseline.
Change All Passwords: Reset hosting panel keys, SSH/FTP access, database passwords, and all WordPress admin accounts immediately.
Put the Site in Maintenance Mode: Place an index.html file in your public_html root or block external IPs via .htaccess or your firewall while work is ongoing.

If your site is hosted on a VPS using AWS and Hestia CP, you can suspend the domain or restrict web traffic at the server firewall level during the triage phase.

Step 2: Core File Verification via WP-CLI

Malware often injects obfuscated PHP code (such as eval(base64_decode(...))) directly into official WordPress core files like wp-settings.php or index.php. Trying to manually inspect thousands of files is inefficient.

If you have SSH access, the fastest way to verify and fix core files is with WP-CLI:

# Check core integrity against official WordPress checksums
wp core verify-checksums

# Force download clean core files without overwriting wp-content or wp-config.php
wp core download --force --skip-content

If you do not have WP-CLI, manually download a fresh ZIP of your exact WordPress version from WordPress.org. Delete the existing wp-admin and wp-includes directories on your server, and upload fresh copies from the zip file. Never replace wp-content or your wp-config.php file blindly.

Step 3: Scanning and Auditing wp-content

The wp-content directory houses your themes, plugins, and uploads. It is the primary target for malicious uploads because WordPress must retain write permissions here.

WordPress Malware Removal Checklist for Folders:

Uploads Directory: The wp-content/uploads/ directory should almost never contain executable .php files. Search for PHP files inside uploads using SSH: find wp-content/uploads/ -type f -name "*.php" If any PHP files appear here, inspect and remove them. Prevent execution entirely by adding a simple server rule blocking PHP execution in the uploads folder.
Plugins and Themes: Do not attempt to manually clean infected plugin code. Delete the entire directory for each installed plugin, then re-download fresh copies from official sources. For custom themes, compare current files against your local git history or initial production build.

Step 4: Fix the Infected WordPress Database

Malware frequently hides inside the database, specifically within wp_options (such as siteurl, home, or auto-loaded option payloads), wp_posts (injected script tags or hidden iframes), and wp_users (unauthorized admin accounts).

To fix an infected WordPress database, query for common malicious indicators:

Check User Accounts: Query the wp_users table for unfamiliar accounts with administrator privileges. Delete suspicious users and revoke their sessions.
Search for Injected Scripts: Execute SQL queries to search for ` tags, base64 strings, or spam links inside post content: `sql SELECT FROM wp_posts WHERE post_content LIKE '%<script%'; SELECT FROM wp_posts WHERE post_content LIKE '%eval(%'; ``
Inspect Site URLs: Search the wp_options table to ensure siteurl and home point to your real domain and have not been altered to force spam redirects.

Fixing database records requires caution. Always run a full database dump before executing search-and-replace queries.

Step 5: Backdoor Elimination and Permissions Hardening

Removing the primary infection without closing the backdoors ensures reinfection within 24 to 48 hours. Attackers leave webshells, hidden cron jobs, and rogue user roles behind.

How to Eliminate Backdoors:

Inspect Cron Jobs: Check server cron jobs (crontab -l) and WordPress crons using wp cron event list. Attackers schedule recurring tasks to re-download malicious files.
Clean .htaccess and index.php: Replace .htaccess with the default WordPress rules. Check for hidden files starting with dots (e.g., .ico files containing PHP code).
Check wp-config.php: Inspect wp-config.php for obfuscated code snippets at the very top or bottom of the file. Generate new security keys and salts from the official WordPress API service and update them in wp-config.php to invalidate all active user cookies.

WordPress Security Hardening After a Hack:

Set directory permissions to 755 and file permissions to 644 across the site.
Set wp-config.php permissions to 600 or 640.
Disable file editing in the WordPress dashboard by adding define('DISALLOW_FILE_EDIT', true); to wp-config.php.
Ensure all plugins, themes, and core files are updated to their latest versions.

If your site suffers from ongoing performance issues or vulnerabilities stemming from outdated plugin architectures, consider evaluating whether a custom build or managed infrastructure makes sense for your business by reviewing our WordPress vs custom development guide or our guide on WordPress website development costs.

If you prefer to review our broader capabilities across maintenance, migration, and custom infrastructure, explore our full services page or read about our custom website development solutions.

Frequently asked questions

How do I know if my WordPress site has been hacked?