My WordPress site was hacked: how to clean it

Signs your site was hacked

Visitors are sent to spam or scam sites, Google shows "This site may be hacked" under your listing, strange pages in Japanese or about pills appear in search results, you find admin users you never made, or your host suspends the account for malware. Any one of these means you need to act today.

Step 1: Make a copy of the site as it is now

Before you change anything, download a full copy: every file (by SFTP or your host's file manager) and a database export (from phpMyAdmin or your host's backup tool). It is infected, so never restore it as-is, but you need it to see what changed and to fall back on if a cleanup step breaks the site.

Step 2: Lock the attacker out

Change every password, in this order: your hosting account, cPanel, SFTP or FTP, the database user (then put the new one in wp-config.php), and every WordPress administrator. Then replace the security keys in wp-config.php with fresh ones from WordPress's own generator at api.wordpress.org/secret-key/1.1/salt/, which logs everyone out. In Users, delete any administrator you don't recognise.

Step 3: Find out what's infected

Run a malware scanner, such as Wordfence's free scan or your host's scanner, and open Google Search Console's Security issues report, which lists the pages Google flagged. Scanners miss things, so treat their list as a start, not the whole job.

Step 4: Replace WordPress itself

Download a fresh copy of WordPress, the same version you run, from wordpress.org. Delete the wp-admin and wp-includes folders on the server and upload the clean ones. Replace the core files in the root folder too, but keep your wp-config.php and the wp-content folder, then check both by hand.

Step 5: Reinstall plugins and themes from the source

Delete every plugin and theme you don't use. Reinstall the ones you keep from wordpress.org or the seller, never from a "free premium" download site, which is a common way in. Hacked sites often hide code inside an old plugin's folder.

Step 6: Hunt the backdoors (the hard part)

Attackers leave hidden ways back in. Look for:

• PHP files inside wp-content/uploads, which should only hold images and documents;
• files changed around the date the trouble started;
• code that unpacks and runs hidden text, which usually looks like a long block of random letters and numbers at the top or bottom of an otherwise normal file;
• anything in wp-content/mu-plugins you didn't put there;
• changes to .htaccess that redirect visitors; and scheduled tasks (cron jobs) in your hosting panel that you don't recognise.

This is the step that decides whether the cleanup holds. Miss one file and the site is reinfected, often within days.

Step 7: Clean the database

In phpMyAdmin, check the users table for unknown administrators, the options table for a changed siteurl or home, and posts and pages for injected scripts or spam links. Edit carefully: a wrong change here can take the whole site down, so work from the export you made in Step 1.

Step 8: Ask Google to remove the warning

Once the scanner and your own checks come back clean, go to Search Console's Security issues report and choose Request review, saying what you fixed. Google reviews it; the warning stays until it does.

Step 9: Keep it out

Turn on automatic updates, use two-factor sign-in for every administrator, give other users the lowest role that works, keep daily off-site backups, and consider a web application firewall.

Should you do this yourself?

If you have a clean backup from before the hack, restoring it and then doing Steps 2 and 9 is the easiest safe route. Without one, a full cleanup is slow, delicate work, and the backdoor hunt takes experience. Many site owners decide a clean rebuild is the surer fix.

Written by Geek Patch. Last reviewed 2026-11-06.