A hacked WordPress site can redirect visitors, display spam, create unknown administrators, send malicious email, or disappear from search results. Move quickly, but do not start deleting files until you preserve evidence and create a recovery point.
Confirm the Site Is Actually Hacked
Common signs include unfamiliar files, unauthorized users, security warnings, modified pages, unexpected redirects, traffic drops, and server resource spikes. Check the site from a private window and review recent activity, hosting alerts, Google Search Console security issues, and malware scanner results.
Put the Site in a Controlled State
Ask the host to isolate the installation if it is distributing malware or attacking other systems. Use a maintenance response when appropriate, but keep access available for cleanup. Do not rely on hiding the site as the fix.
Create a Full Backup Before Cleanup
Save the database and all files, including suspicious ones. Label this copy as infected and store it separately from clean backups. It may be needed to identify the entry point, compare changes, or restore missing content.
Reset Every Relevant Credential
Change WordPress administrator, hosting, SFTP, SSH, database, CDN, and email passwords. Remove unknown users and end active WordPress sessions by refreshing authentication salts. Use unique passwords and multifactor authentication wherever available.
Find and Remove the Malware
Compare WordPress core files with clean copies from WordPress.org. Replace core files, themes, and plugins from trusted sources instead of manually editing hundreds of infected files. Check uploads, must-use plugins, drop-ins, scheduled tasks, database options, injected JavaScript, and modified server configuration.
Delete abandoned plugins and themes. A deactivated vulnerable plugin can still be exploited because its files remain on the server.
Identify the Entry Point
Cleanup will not last unless the original weakness is fixed. Review access logs, file modification dates, outdated software, reused credentials, insecure administrator accounts, vulnerable forms, and other WordPress installations in the same hosting account.
Restore From a Known Clean Backup
If you have a verified backup from before the compromise, restoring it can be faster than cleaning every file. Apply all updates and security fixes before returning the site to normal traffic. A backup is not safe merely because it is older.
Check Search and Reputation Damage
Review indexed pages with a site:example.com search and inspect Google Search Console. Remove spam pages, return proper status codes, update sitemaps, and request a security review only after the site is clean. Do not use the URL removal tool as a substitute for deleting hacked content.
Harden WordPress After Cleanup
- Update WordPress, plugins, themes, and PHP.
- Use least-privilege accounts and remove unused administrators.
- Enable reliable backups stored outside the server.
- Add file-change and login monitoring.
- Protect the site with a properly configured firewall.
When to Call a Professional
Get expert help when the site handles payments or sensitive data, reinfection occurs, several installations share the account, or you cannot identify the entry point. Preserve logs and contact the host before destroying evidence.
For related fixes, visit my WordPress SEO troubleshooting hub and my guide to the WordPress critical error.
