WordPress hack removal: Ultimate Guide 2025

Why WordPress Hack Removal Is a Critical Priority for Every Site Owner

WordPress hack removal is the process of identifying, isolating, and eliminating malware from a compromised WordPress website, then securing it to prevent future attacks. If your site is compromised, time is of the essence. Every hour your site remains infected, you risk damage to your SEO rankings, customer trust, and revenue.

Quick Action Steps for a Hacked WordPress Site:

Take your site offline – Enable maintenance mode to protect visitors.
Change all passwords – WordPress admin, hosting, FTP, and database.
Scan for malware – Use security plugins like Wordfence or Sucuri.
Remove malicious code – Replace core files, clean themes/plugins, and sanitize the database.
Restore from a clean backup – If available and verified clean.
Harden security – Update everything, enable 2FA, and install a firewall.
Request review – Submit to Google Search Console if blocklisted.

Common Signs Your Site Is Hacked:

Browser warnings (“Deceptive Site Ahead”)
Unexpected redirects to spam sites
Strange admin users in your dashboard
Slow performance or server errors
Security plugin alerts

If your WordPress site has been compromised, you’re not alone. Research shows that thousands of WordPress sites are hacked daily. The panic you feel is understandable, as your website is a critical business asset. The good news is that most hacks are fixable. With the right approach, you can recover completely and prevent it from happening again.

This guide walks you through the complete recovery process. Whether you choose to tackle the cleanup yourself or bring in professional help, you’ll understand what needs to happen to get your site from compromised to secure.

I’m Kevin Gallagher, and over the past fifteen years, I’ve built more than 2,500 WordPress websites and managed hundreds more through wpONcall, specializing in WordPress hack removal and security. I’ve seen every type of compromise and helped business owners recover quickly. Let’s get your site back in working order.

Is Your Site Compromised? Identifying the Telltale Signs of a Hack

One of the most challenging aspects of WordPress hack removal is realizing you’ve been compromised. Identifying a hack early makes all the difference, minimizing damage to your revenue, SEO, and customer trust. Here are the telltale signs that your WordPress site has been compromised, from the obvious to the subtle.

Obvious Red Flags and Performance Issues

Some hacks are impossible to miss. If you see these signs, you know something is wrong.

Site Defacement: Your homepage is replaced with a hacker’s message, foreign text, or other unapproved content. It’s the digital equivalent of graffiti on your storefront.
Unfamiliar Pop-ups and Ads: Your site bombards visitors with aggressive pop-ups, fake virus warnings, or ads for questionable products. This “malvertising” exploits your traffic for the hacker’s gain.
Spam Links: Strange links to gambling or pharmaceutical sites appear in your header, footer, or scattered throughout your content. Sometimes these are hidden from human visitors but visible to search engines, destroying your SEO.
Performance Degradation: Your site suddenly becomes incredibly slow, or you experience frequent server timeout errors (like HTTP 500, 502, or 503). Malware consumes server resources, leaving little for your actual site.

For a visual guide, see our breakdown of what a hacked WordPress site looks like.

Alarming Security Warnings and Redirects

Often, the first warning comes from external security systems.

Browser Warnings: A bright red screen with a “Deceptive Site Ahead” or “This Site May Harm Your Computer” message appears when people try to visit. This is from Google’s Safe Browsing service and will crater your traffic. You can check your site’s status in the Google Transparency Report.
Malicious Redirects: Visitors are sent to a different website, often a spam or phishing page. These redirects can be sporadic or only affect users coming from search engines, making them hard to detect. If you’re facing this, our guide on how to fix WordPress redirect hack can help.
Blocklisting: Your site may be blocklisted by security authorities like Norton or McAfee. Your hosting provider might even suspend your account to protect other sites on the server.

Backend Anomalies and Access Problems

Many dangerous compromises operate in the background.

Inability to Log In: You enter the correct credentials, but your password doesn’t work. Hackers often change passwords or delete admin accounts to lock you out.
New Admin Users: You see administrator accounts in your WordPress user list that you don’t recognize. These are backdoors for hackers to regain access.
Suspicious Files: You find files with strange names or recent modification dates in your wp-content, wp-includes, or root directories via FTP or your host’s file manager.
Security Alerts: A security plugin alerts you to file changes, malware signatures, or suspicious login attempts. Don’t ignore these warnings.
Host Notifications: Your hosting provider emails you about unusual activity, excessive resource use, or detected malware. Treat these as urgent.

Understanding these signs is the first step in effective WordPress hack removal. Once you’ve confirmed a compromise, you must act quickly.

Emergency Response: Immediate Steps to Contain the Damage

The moment you confirm a hack, decisive action is critical. Think of it as digital firefighting: your goal is to contain the blaze and protect everyone nearby before you start rebuilding. Every minute your compromised site is live, it puts visitors at risk. Here’s what to do right now.

Isolate Your Website and Regain Access

Your first priority is to protect your visitors. Taking your site offline temporarily is the best way to do this.

Enable Maintenance Mode: If you can access your dashboard, use a maintenance mode plugin to show a simple “We’ll be back soon” message. If not, you can create a maintenance.html file and use a .htaccess rule to redirect all traffic to it.
Regain Admin Access: If a hacker has locked you out, first try the “Lost your password?” link. If that fails, you’ll need to reset your password directly in the database using a tool like phpMyAdmin from your hosting control panel. To do this, you’ll need to access your database, find your user in the wp_users table, and manually enter a new password (using the MD5 format). If your account was deleted, you can create a new one in the database.

Contact Your Hosting Provider

Your hosting provider is a key ally. They have server-level tools and experience that you don’t.

Inform Them Immediately: Open a support ticket or call your host. Be specific about the symptoms you’re seeing.
Request a Scan: Ask if they can perform a server-level malware scan. They can often find infections that WordPress plugins miss.
Understand Their Policies: Some hosts are supportive, while others may suspend your account to protect their servers. If your site is already suspended, don’t panic; they can provide valuable information about the cause.
Ask for Logs: Request server access and error logs from around the time of the hack. This can help identify the attacker’s entry point.

If you feel overwhelmed, our WordPress Security Support team can guide you through this process.

Create a Full Backup of the Compromised Site

This may seem counterintuitive, but backing up your hacked site is a critical step. Do not use this backup to restore your site.

Preserve Evidence: This backup is a snapshot for forensic analysis. It helps you or a security professional figure out how the hack occurred, which is essential for preventing it from happening again.
Create a Safety Net: If you make a mistake during the manual cleanup process, this backup allows you to revert to the infected state and try again. It’s better than having a completely broken site.

Use your hosting tools to download all website files and a complete database export. Label this backup clearly (e.g., “INFECTED – DO NOT RESTORE”) and store it securely offline. Once you have this backup, you are ready to begin the WordPress hack removal process.

The Ultimate Guide to WordPress Hack Removal

Now we arrive at the core of the recovery: the systematic removal of all malicious code. This phase requires patience and attention to detail. If you’re not comfortable working with code or databases, this is a good time to consider professional help. Think of it as surgery—you need to remove the disease without harming healthy tissue.

Scanning for Malware and Identifying Infected Files

Before deleting anything, you need a map of the infection.

Use Multiple Scanners: Start with a remote scanner like Sucuri SiteCheck to see what’s publicly visible. Then, use a server-side plugin like Wordfence to perform a deep scan of your files and database. This will give you a list of suspicious files, backdoors, and code injections.
Manual Inspection: Connect to your site via SFTP and look for anomalies. Pay close attention to the wp-content folder (especially uploads), as well as wp-includes and your root directory. Look for files with strange names or recent modification dates.
Identify Obfuscated Code: Hackers hide their code using functions like base64_decode(), eval(), and gzinflate(). Seeing these in unexpected places is a major red flag. You can use online decoders to reveal what the code is doing.

Our WordPress Security Audit Complete Guide provides a more detailed walkthrough of this process.

The Manual WordPress Hack Removal Process

This is the hands-on work of cleaning your site.

Replace Core Files: Download a fresh copy of your WordPress version from WordPress.org. On your server, delete the existing wp-admin and wp-includes folders and upload the clean versions. Do not delete your wp-content folder or wp-config.php file.
Inspect wp-config.php: This file contains your database credentials. Carefully compare it to the wp-config-sample.php file from the fresh download. Look for any suspicious code, especially at the very top or bottom of the file.
Clean Themes and Plugins: Delete all inactive themes and plugins. For your active theme and plugins, download fresh copies from their original sources. Use a file comparison tool like Diffchecker to compare your live files with the clean ones and remove any malicious code.
Clean .htaccess: This file is a common target for redirect hacks. Compare it to a default WordPress .htaccess file and remove any suspicious rules.
Sanitize the Database: Using phpMyAdmin, inspect your database. Look for new admin users in the wp_users table, spam links in wp_posts, and suspicious scripts in the wp_options table. Search for terms like base64_decode or eval to find hidden malicious code.

Restoring from a Clean Backup

If you have a backup that you are 100% certain is clean and predates the hack, restoring it can be the fastest solution.

Verify Before Restoring: This is non-negotiable. Scan the backup files for malware before you use them. Restoring an infected backup will just restart the entire problem.
Restore and Check: Use your host’s tools or a manual process to restore both the files and the database. After restoring, immediately run a full security scan to ensure no vulnerabilities remain.
Content Recovery: If you have no clean backups, the Wayback Machine can be a last resort to recover lost text content for a manual rebuild.

For more on this topic, see our Site Restoration WordPress guide.

Fortifying Your Defenses: How to Prevent Future WordPress Hacks

You’ve cleaned your site, but the job isn’t done. WordPress hack removal is only half the battle; the other half is ensuring it never happens again. The sites that stay secure are those that treat prevention as seriously as recovery.

Hardening Your WordPress Installation

These are the fundamental security practices every WordPress site needs.

Keep Everything Updated: This is the single most critical security measure. Outdated software is the #1 cause of hacks. Updates patch security vulnerabilities that attackers actively exploit. Enable automatic updates for minor releases and check for major updates weekly.
Use Strong, Unique Passwords: Create complex passwords (12+ characters with mixed cases, numbers, and symbols) for every account: WordPress admin, hosting, FTP, and database. Use a password manager like 1Password to generate and store them securely.
Enable Two-Factor Authentication (2FA): 2FA adds a crucial security layer. Even if a hacker steals your password, they can’t log in without the second verification code from your phone. Most security plugins offer this feature. Our guide on WordPress Login Security shows you how.
Limit Login Attempts: This thwarts brute-force attacks where bots try thousands of password combinations. A security plugin can lock out an IP address after a few failed attempts.
Apply the Principle of Least Privilege: Give users only the minimum access they need. A content writer doesn’t need administrator rights. The fewer admin accounts, the smaller the attack surface.

Advanced Security Configurations

Take your site’s security to the next level with these configurations.

Use a Web Application Firewall (WAF): A WAF acts as a security guard, filtering malicious traffic before it ever reaches your site. It can block common attacks and virtually patch vulnerabilities.
Disable File Editing: By default, WordPress lets admins edit theme and plugin files from the dashboard. This is a huge security risk. Add define('DISALLOW_FILE_EDIT', true); to your wp-config.php file to disable it.
Generate New Security Keys: After a hack, generate new WordPress security keys and salts from the official SALTs generator and add them to your wp-config.php file. This invalidates all existing login sessions.
Set Correct File Permissions: Incorrect permissions can allow hackers to modify files. Generally, folders should be set to 755 and files to 644.
Remove Unused Themes and Plugins: Every inactive theme or plugin is a potential security risk. If you’re not using it, delete it.

Our Ultimate WordPress Security Guide covers these measures in greater detail.

Ongoing Monitoring and Maintenance

Security is an ongoing process, not a one-time fix.

Install a Security Plugin: A reputable plugin provides continuous malware scanning, file integrity monitoring, and alerts for suspicious activity.
Monitor Activity Logs: Regularly review logs of user logins, file changes, and other events to spot unusual patterns early.
Maintain Regular Backups: Automated, daily, off-site backups are your non-negotiable insurance policy. Test them periodically to ensure they work. Our Site Restoration WordPress guide explains this in depth.
Monitor for Vulnerabilities: Stay informed about new security issues in your specific plugins and theme. Our WordPress Vulnerability Monitoring service can do this for you.

For many business owners, a professional maintenance plan is the best solution. It offloads all security tasks to experts, giving you peace of mind to focus on your business.

When to Call the Experts for Professional Help

Knowing when you’re in over your head is a smart business decision. While some hacks can be handled with a DIY approach, many require professional intervention to resolve completely and permanently.

Signs You Need a Professional WordPress Hack Removal Service

It’s time to call for expert help if you encounter any of these situations:

The Malware Keeps Returning: You clean the site, but the infection reappears within hours or days. This points to a hidden backdoor or a server-level compromise that standard methods can’t fix.
You Lack Technical Confidence: If you’re uncomfortable editing code, working with databases, or using FTP, you risk causing more damage. A misstep can break your site or leave it vulnerable.
The Hack Has Spread: If you find malicious files outside your WordPress installation or your host reports a wider compromise, you’re dealing with a server-level issue that requires specialized expertise.
Your Site is Business-Critical: For e-commerce stores or lead generation sites, every hour of downtime means lost revenue and reputational damage. You need a rapid, guaranteed solution, not trial and error.
You Need 100% Certainty: A professional service provides the peace of mind that every trace of malware has been removed. They also identify and patch the original vulnerability to prevent reinfection.

If this sounds like your situation, our WordPress Malware Removal Service is designed to provide a comprehensive solution.

The Benefits of an Expert Cleanup

Engaging professionals for WordPress hack removal is an investment in speed, expertise, and long-term security. Here’s what you get:

Thoroughness: Experts understand how malware hides and persists. They use specialized tools and forensic analysis to find and eliminate all threats, including complex backdoors and cross-site contamination.
Speed: A professional can often resolve in hours what might take you days of frustrating work, minimizing business impact and lost revenue.
Root Cause Analysis: A key difference is that professionals don’t just remove the malware; they investigate how the attacker got in. By identifying and patching the specific vulnerability, they prevent immediate reinfection.
Security Hardening: After the cleanup, experts implement comprehensive security measures custom to your site, such as configuring a WAF, setting proper file permissions, and establishing monitoring systems.
Peace of Mind: You can stop worrying about reinfection and get back to running your business, knowing your site is truly secure and protected.

Our WordPress Website Recovery Guide details our comprehensive approach to not just cleaning your site, but restoring it to full health for the long term.

Frequently Asked Questions about WordPress Hacks

Over the years, we’ve heard just about every question imaginable about WordPress hacks. Here are clear, actionable answers to the most common ones.

How do I get my site removed from Google’s blocklist?

Once you are certain your site is 100% clean, you must ask Google to re-evaluate it. The red warning screen won’t disappear on its own.

Set up Google Search Console: If you haven’t already, add and verify your site.
Steer to the Security Issues Report: In Search Console, this report will show you the issues Google found.
Request a Review: After fixing all issues, click the “Request Review” button. Explain the steps you took to clean the site.

You can find detailed steps on this page in the Google documentation. The review process typically takes a few days. The faster you clean your site and submit the request, the sooner your traffic will be restored.

What are the most common ways WordPress sites get hacked?

The vast majority of hacks are not sophisticated, targeted attacks. They are opportunistic exploits of common, preventable vulnerabilities.

Outdated Software: This is the #1 cause. Failing to update WordPress core, plugins, and themes leaves known security holes open for automated bots to find and exploit.
Weak or Compromised Passwords: Simple passwords like “password123” are easily cracked by brute-force attacks. Reusing passwords that have been exposed in other data breaches is also a major risk.
Vulnerable Plugins or Themes: A single poorly coded or outdated plugin can compromise your entire site. “Nulled” (pirated) themes and plugins are especially dangerous as they often come with pre-installed backdoors.
Insecure Hosting: Poor server configurations or shared hosting without proper account isolation can increase your risk.

What are the consequences of a hacked WordPress site?

A hacked website is more than an inconvenience; the consequences can be severe and long-lasting.

SEO Damage: Google penalizes hacked sites, causing search rankings to plummet and organic traffic to disappear.
Blocklisting: Browser warnings scare away the vast majority of visitors, effectively taking your site offline for potential customers.
Loss of Customer Trust: A security incident can permanently damage your brand’s reputation. Customers who encounter spam or redirects may never return.
Data Theft and Financial Loss: For e-commerce or membership sites, hackers can steal customer data, leading to identity theft and direct financial loss.
Legal Liability: If your site is used to distribute malware or steal data, you could face legal consequences. A customer might file a negligence claim if their information is compromised due to your site’s poor security.
Hosting Account Suspension: Most hosts will suspend a compromised account to protect their network, taking your site completely offline.

Conclusion

Finding your site has been compromised is a stressful experience, but recovery is entirely possible. By following a methodical approach—Identify, Isolate, Clean, and Harden—you can reclaim your website and secure it against future attacks.

Cleaning a hack without fixing the underlying vulnerability is like mopping up a flood without turning off the faucet. The problem will return. This is why proactive security is always better than reactive cleanup. Regular updates, strong passwords, reliable backups, and continuous monitoring are essential investments in your business’s digital foundation.

If you’ve read this guide and feel confident tackling the cleanup, we’re rooting for you. However, if the hack is complex, keeps returning, or you simply need an expert to handle it quickly and correctly, that’s a smart business decision.

That’s where wpOncall comes in. Our team specializes in WordPress hack removal, security hardening, and ongoing protection. We don’t just clean your site; we find out how the hack happened, patch the vulnerability, and secure your site to prevent it from recurring. Let our experts handle your site’s security so you can focus on what you do best—running your business.

Ready to secure your site for good? Learn more about our Website Maintenance plans and find out how we can keep your WordPress site protected around the clock. Your peace of mind is just a click away.