How I clean a hacked WordPress site, step by step

A hacked WordPress site is a bit like a burglary. Cleaning up the mess the burglar left is important, but if you don't find out how they got in, they'll be back next week.

This is the process I follow on every cleanup. It's written so you can follow along and understand what you're paying for, even if you'd rather not do it yourself.

1. Back up and contain

Before changing anything, I take a full copy of the files and the database. If the site is actively redirecting visitors or serving malware, I put it into maintenance mode so it stops harming visitors while I work.

The infected backup isn't for restoring. It's evidence: modified timestamps and access logs often show exactly how the attacker got in.

2. Find the way in

The most common entry points are:

• An outdated plugin or theme with a known vulnerability
• A nulled (pirated) theme or plugin with a backdoor built in
• A weak or reused password on an administrator, SFTP or hosting account
• Another infected site in the same hosting account

Server access logs help here. Requests to unusual PHP files, or a burst of POST requests to a plugin's endpoint just before files changed, point straight at the problem.

3. Check the files against known-good copies

WordPress publishes checksums for every core file, and WP-CLI can compare your site against them:

wp core verify-checksums
wp plugin verify-checksums --all

Anything modified or added shows up immediately. For themes and premium plugins that aren't on WordPress.org, I compare against a fresh copy from the vendor.

Then I search for code that shouldn't be there:

find wp-content/uploads -name "*.php"
grep -rnE "eval\(|base64_decode\(|gzinflate\(|str_rot13\(" wp-content --include=*.php

The first command finds PHP files hiding among your images. The second finds the obfuscation functions attackers use to hide their code. Some legitimate plugins use these functions too, so every match gets reviewed by hand rather than deleted automatically.

4. Clean the database

Malware doesn't only live in files. I check:

• siteurl and home in the options table, which attackers change to redirect the whole site
• Posts and pages for injected <script> tags, hidden links and spam content
• Widgets and theme options, a favourite hiding place for injected JavaScript
• The users table for administrators the owner never created

5. Replace instead of repair

WordPress core, plugins and themes are replaced with fresh copies from trusted sources rather than edited line by line. It's faster and safer: if a file is clean by construction, nothing can hide in it. Plugins that are abandoned or no longer needed are removed completely.

On a shop, this step needs extra care. In the Natalia Wuest art shop cleanup, products, orders and customer accounts had to stay intact while everything around them was replaced.

6. Close the door

Cleaning without hardening is how sites get reinfected. Before handing a site back, I:

• Update WordPress core, plugins and themes, and the PHP version if it's outdated
• Reset every password and generate new security keys in wp-config.php, which signs everyone out
• Add a firewall and login protection
• Fix file permissions and disable the built-in file editor
• Remove unused plugins, themes and old admin accounts

7. Get delisted and keep watching

If Google flagged the site, I request a review in Search Console once it's clean. Spam URLs are left to return a 404 so they drop out of the index. Then the site is monitored for a while, because a reinfection in the first days after a cleanup usually means something was missed.

What you get at the end

A clean site isn't enough on its own. You should also get a short report covering what was found, what was removed, how the attacker got in and what was changed to stop it happening again.

If you're dealing with a hacked site right now, send me a message. The first audit is free.