Fix Hacked WordPress Site: 2026 Ultimate Recovery Guide

What to Do When Your WordPress Site Gets Hacked

If you need to fix a hacked WordPress site, here are the core steps to take right now:

Put your site in maintenance mode to protect visitors while you work
Change all passwords — WordPress admin, hosting, SFTP, and database
Back up the current infected state before making any changes
Scan for malware using a server-side scanner
Replace core files, plugins, and themes with clean copies from official sources
Clean the database and remove any hidden backdoors
Request a Google review to remove malware warnings after cleanup

WordPress powers more than 40% of all websites online — which makes it the single biggest target for automated attacks. More than 13,000 WordPress sites are attacked every day. That’s not a typo. And yet, about 43% of WordPress admins still spend several hours each month just dealing with the fallout.

The hard truth? Most hacks aren’t random. Automated bots constantly scan the web for outdated plugins, weak passwords, and unpatched vulnerabilities. When they find one, they move fast.

The good news is that a hacked site is fixable — if you act quickly and follow the right process. Skipping steps, or restoring a backup without fixing the underlying vulnerability, almost always leads to reinfection.

This guide walks you through the full recovery process: from confirming the hack and locking down access, to cleaning infected files, removing malware warnings, and hardening your site so it doesn’t happen again.

I’m Kevin Gallagher, founder of wpONcall, with over 15 years of WordPress experience and more than 2,500 sites built and managed. I’ve helped hundreds of business owners fix hacked WordPress sites and get back online fast — and this guide is built on everything I’ve learned doing exactly that.

Fix hacked WordPress site terms made easy:

How to Identify If Your WordPress Site Is Hacked

Discovering that your website has been compromised is a stressful experience. Often, the signs are glaringly obvious, but occasionally they are incredibly subtle, designed to hide from you while exploiting your visitors. To effectively fix a hacked WordPress site, you must first learn how to spot the breach and confirm whether you are dealing with a real infection or a simple false positive.

Common Signs You Need to Fix Hacked WordPress Site

Malware behaves in predictable ways depending on the attacker’s goals. Here are the most common indicators that your site has been compromised:

Unexpected Redirects: This is one of the most frustrating symptoms. Visitors click a link to your site from a search engine and are immediately redirected to a spammy external domain, such as an online casino, a shady dating site, or a fake tech support portal. Interestingly, hackers often configure these scripts to only redirect logged-out visitors. If you are logged in as an administrator, the site might look completely normal, which is why you must always test your site in an incognito browser window. If your site is redirecting visitors, you need to read our guide on how to Fix WordPress Redirect Hack.
SEO Spam and Defacement: Attackers may inject thousands of spam pages into your site’s database. These pages are filled with keywords for pharmaceuticals, luxury goods, or gambling. You might not see them on your homepage, but they will show up in search engine results. In worse cases, your homepage might be completely defaced with a message from the hacker. For a broader overview of recovering your online presence, consult How to Fix a Hacked Website: A Step-by-Step Recovery Guide.
Unrecognized Administrator Accounts: If you log into your WordPress dashboard and notice a new user account with administrator privileges that you did not create, your site has been breached. Hackers often use automated scripts to add these accounts so they can maintain permanent access.
Hosting Account Suspension: Web hosting providers run automated malware scans on their servers. If their systems detect malicious scripts sending outbound spam emails or consuming excessive CPU resources on your account, they will suspend your hosting to protect other users on the server.
Massive Performance Drops: A sudden, unexplained spike in resource usage or a site that takes forever to load can indicate that your server is being used to mine cryptocurrency, launch DDoS attacks against other servers, or send millions of spam emails.

Distinguishing True Infections from False Positives

Before you begin deleting files and altering your database, you must verify that the infection is real. Security scanners occasionally flag legitimate code as suspicious, resulting in a false positive.

To confirm an infection, check your core WordPress file integrity. WordPress core files should never be modified. You can verify this by comparing your site’s file hashes against the official WordPress.org core checksums. If files like index.php, wp-activate.php, or files inside the wp-admin and wp-includes directories have been modified, you are dealing with a true infection.

Another key forensic step is inspecting file modification dates. If you connect to your server via SFTP and sort your files by the “Last Modified” date, you might notice that several core files were updated recently, even though you haven’t run any updates. Be aware, however, that sophisticated hackers can manipulate these dates (a technique known as “timestomping”) to blend in with older, legitimate files.

For a deeper understanding of how to separate real threats from false alarms and safely begin the removal process, refer to The Emergency Guide to Website Malware Removal.

Immediate Containment and Access Lockdown

Once you have confirmed that your site is compromised, you must act instantly to contain the damage. Think of this as putting a digital tourniquet on your website. Every minute your site remains active and infected, you risk losing search engine rankings, exposing your visitors to malware, and getting your domain permanently blacklisted.

Step-by-Step Containment Runbook

The first rule of incident response is to preserve evidence before you begin repairing the damage. Do not panic and start deleting files blindly. Follow this containment runbook:

Enable Maintenance Mode: Immediately take the site offline or put it into maintenance mode. This prevents visitors from being exposed to malicious redirects and stops search engine bots from indexing newly injected spam pages. If you cannot access your WordPress admin dashboard, you can block public access by adding a temporary password protection layer via your hosting control panel or by modifying your .htaccess file.
Restrict Access via .htaccess: If you still have access to your server files, you can block all traffic except for your own IP address. Open your root .htaccess file and add the following lines at the very top, replacing YOUR_IP_ADDRESS with your actual public IP:

This ensures that while you are working on the cleanup, the hacker and their automated bots cannot access the site to execute malicious scripts or monitor your progress.
Create a “Dirty” Backup: Before you touch a single file, take a complete backup of your website in its current, infected state. Label this backup clearly as “INFECTED” and store it safely. This backup is incredibly valuable for forensic purposes; if your cleanup process accidentally breaks the site, you can return to this state to try again.
Isolate the Environment: If you run multiple websites on a single shared hosting plan, you are highly vulnerable to cross-site contamination. If one site is hacked, the malware can easily spread through the server directory structure to infect every other site on that account. You must isolate each WordPress site into its own hosting environment with a dedicated system user.
Export Server Logs: Download your raw access logs and error logs from your hosting control panel. These logs contain the IP addresses and request paths of the attackers, which will help you identify the exact entry point they used to breach your site.

For a detailed look at initial incident response and official community advice, consult the FAQ My site was hacked – Documentation – WordPress.org.

Securing Credentials Across All Access Points

To prevent the hacker from immediately logging back in while you are cleaning the site, you must systematically rotate every single password associated with your web presence. Perform this step from a known clean device, as a local malware infection on your computer could be the source of the stolen credentials.

Change the passwords for all administrator accounts in the WordPress dashboard. If you cannot log in, you will need to access your database via phpMyAdmin to reset the admin password directly.

Next, update your hosting control panel password, SFTP/FTP account passwords, database user passwords, and SSH credentials.

Finally, you must regenerate your WordPress security keys and salts. These keys are located in your wp-config.php file and are responsible for encrypting the browser cookies that keep users logged in. By changing these keys, you instantly invalidate all active sessions, forcing everyone — including any hackers holding hijacked session cookies — to log out immediately.

To understand the complete process of locking down your access points, read our Complete WordPress Hack Removal Guide.

How to Safely Clean and Fix Hacked WordPress Site

Cleaning a hacked website requires a surgical approach. If you leave even a single backdoor script behind, the attacker will regain access within minutes, and all your hard work will be undone.

Reinstalling Core Files, Themes, and Plugins

In 90% of cases, infected files belong to the core WordPress directories, plugins, or themes. The safest and most effective way to clean these files is to completely replace them with fresh, uncompromised copies directly from the official repositories.

Do not attempt to manually edit malware out of core files. Instead, download a fresh copy of WordPress from WordPress.org. Delete your existing wp-admin and wp-includes directories entirely, then upload the clean versions via SFTP. Do the same for all root PHP files, making sure you do not delete or overwrite your custom wp-config.php file or your wp-content folder.

Next, address your plugins and themes. Do not copy these from your hacked installation. Instead, make a list of your active plugins and themes, delete their directories inside wp-content/plugins and wp-content/themes, and download fresh copies directly from the WordPress repository or your premium developers.

Using WP-CLI for Rapid Verification

If you have SSH access to your server, you can use WP-CLI to quickly verify the integrity of your core files and plugins. Run the following command in your WordPress root directory:

This command compares your local files with the official MD5 hashes on WordPress.org. Any modified or unexpected files will be flagged immediately. You can do the same for plugins using:

The wp-content/uploads directory is a prime hiding spot for malware because it persists through updates. By default, the uploads folder should only contain media files, such as images, PDFs, and audio files. It should never contain PHP files. Use your SFTP client or hosting file manager to search your uploads folder for any file ending in .php and delete them immediately.

For a deeper dive into this process, read our guide on WordPress Malware Removal and review the step-by-step instructions in How to Fix a Hacked WordPress Site: A Step-by-Step (DIY) Guide.

Database Cleanup and Backdoor Removal

Once your files are clean, you must inspect your database. Attackers frequently inject malicious code into database tables to execute scripts or recreate admin accounts.

Pay close attention to these tables:

wp_options: Check the siteurl and home rows to ensure they haven’t been modified to point to an external spam domain. Also, look for unrecognized scripts injected into active widgets or plugin configuration fields.
wp_posts: Search for unauthorized posts or pages, particularly those with publish dates set in the future or containing hidden iframe codes.
wp_users: Verify that every user listed is legitimate and that no unauthorized accounts have been granted administrator privileges.

Advanced Database Queries for Malware Hunting

You can run SQL queries inside phpMyAdmin to search for common malicious patterns. For example, to find posts containing suspicious script tags or iframes, run:

To check for unauthorized admin users directly in the database, run:

Hackers use backdoors to maintain access to your site. These are small, often heavily obfuscated scripts hidden within legitimate-looking files. They frequently use encoding techniques to bypass standard security scanners. Keep an eye out for PHP functions commonly used in backdoor scripts, including:

eval()
base64_decode()
gzuncompress()
str_rot13()
assert()
exec()
system()

If you are dealing with a severe hack and do not have FTP or hosting control panel access, you can learn alternative recovery methods by watching Fix Hacked WordPress Website Without FTP or Hosting access!.

Removing Malware Warnings and Requesting Reviews

After you have thoroughly cleaned your files and database, you need to deal with the public aftermath of the hack. If search engines flagged your site, visitors will see a terrifying red warning screen stating that “This site contains harmful programs” or “Deceptive site ahead.”

To remove these warnings, you must submit a reconsideration request:

Log into your Google Search Console account.
Navigate to the Security & Manual Actions tab and click on Security Issues.
Review the specific URLs Google flagged as compromised.
Once you are absolutely certain the site is clean, click Request Review.
Provide a detailed explanation of the steps you took to clean the site (e.g., “Reinstalled clean core files, removed malicious database entries, changed all credentials”).

Google typically processes these reviews within 24 to 72 hours. If your site is truly clean, the red warning screens will vanish, and your search rankings will begin to recover. For a detailed breakdown of navigating this recovery phase, check out How to Fix a Hacked WordPress Website: Complete Recovery Guide.

When to Hire Professionals to Fix Hacked WordPress Site

While a DIY cleanup is entirely possible if you are comfortable with SFTP, database queries, and command-line interfaces, there are times when attempting a manual fix is highly risky.

If you run an e-commerce store that handles sensitive customer data, a recurring infection that keeps returning despite your best efforts, or if you simply do not have the technical confidence to edit database tables, you should hire a professional.

Feature / Scenario	DIY Manual Cleanup	Professional Malware Removal Service
Cost	Free (except for your time)	Paid service, but guaranteed
Time Investment	Several hours to days	Completed quickly (often within hours)
Backdoor Detection	High risk of missing hidden backdoors	Deep forensic scanning and complete removal
Reinfection Guarantee	None	Typically includes a clean guarantee and monitoring
Best Suited For	Simple blogs, hobbyist sites	Business websites, e-commerce, membership portals

If you need fast, expert intervention to get your business back online, consider using our dedicated WordPress Malware Removal Service.

Frequently Asked Questions

Recovering from a website hack always brings up a lot of questions. Here are the answers to the most common concerns website owners face during the recovery process.

Should I restore a backup immediately after a WordPress hack?

No, you should never blindly restore a backup immediately after discovering a hack. While restoring a backup is a great recovery tool, it only works if the backup you are restoring is 100% clean. More importantly, if you restore a backup without identifying and patching the security vulnerability that allowed the hacker to get in in the first place, your site will simply get hacked again.

Always preserve the infected version for analysis, find the entry point, patch the vulnerability, and only then restore clean data. To learn how to build a robust defense strategy, read our guide on how to Prevent WordPress Hacks.

How long does WordPress infection cleanup take?

The timeline depends entirely on the complexity of the infection and the size of your website. A simple file-level infection on a small business site can often be cleaned in a few hours. However, complex infections involving database injections, thousands of SEO spam pages, deep backdoors, and domain blacklisting can take several days to fully resolve and monitor for reinfection.

Can a hacked WordPress site affect SEO?

Yes, a hack can severely damage your search engine optimization. When Google detects malware or spam link injections on your site, it will blocklist your domain to protect searchers. This leads to immediate drops in search traffic, loss of keyword rankings, and potentially manual actions that can take weeks to fully recover from even after the site is completely clean.

Conclusion

Successfully cleaning your website is a massive relief, but your security journey doesn’t end when the red warning screens disappear. To protect your business, your brand, and your visitors in the long run, you must establish proactive security habits.

Keep your WordPress core, themes, and plugins updated automatically. Outdated software is the single most common entry point for hackers. Remove any unused plugins or themes to reduce your attack surface, enforce strong and unique passwords paired with two-factor authentication for all users, and implement a robust web application firewall to block malicious bots before they ever reach your site.

If you want absolute peace of mind without spending your weekends running updates and scanning database tables, let us handle it for you. From our offices in Santa Rosa, CA, our team at wpOncall provides daily updates, secure cloud backups, continuous security monitoring, and unlimited support to keep your WordPress site running perfectly.

Learn How to Secure WordPress Site from Hackers or explore our comprehensive WordPress Help Services today to ensure your website remains safe, fast, and secure.