Hacked WordPress site: what to do, how to clean and secure it
A hacked WordPress site hosts code or content you never put there: pharmaceutical or gambling spam pages, redirects to dubious sites, unknown PHP files, administrator accounts created without your knowledge, sometimes malware served to your visitors. Google may then display a security warning and drop your pages from its index.
The consequences go beyond image: lost traffic, suspension by your host, emails landing in spam, stolen customer data and legal liability if personal data has leaked. The longer you wait, the longer the clean-up takes and the more backdoors accumulate.
This page explains how to recognise a compromise, which immediate actions limit the damage, how to genuinely clean the site and, above all, how to prevent reinfection, which is the most common outcome after an incomplete clean-up.
Typical symptoms
- Google Search Console or the browser shows "This site may be hacked" or "Deceptive site ahead".
- Pages or search results in a foreign language or on unrelated topics (medication, casino, counterfeits) appear under your domain name.
- Visitors arriving from Google or on mobile are redirected to another site, while direct access looks normal.
- Unknown administrator users appear in the user list, or your password no longer works.
- PHP files with odd names sit in wp-content/uploads, at the root or inside plugin folders.
- Your host alerts you about mass email sending, detected malware or abnormal resource usage.
- Visitors' antivirus software blocks the site, or unknown scripts are injected into the page source code.
Possible causes
Vulnerable plugin or theme left un-updated
This is the most common cause. A known flaw in a popular plugin is exploited automatically by bots within days of its disclosure, sometimes within hours.
Weak or reused passwords
Brute-force attacks on wp-login.php or xmlrpc.php, credentials found in a data breach from another service, an "admin" account with a simple password.
Nulled themes or plugins
Free copies of paid plugins downloaded from third-party sites very often ship with a backdoor built in from the moment they are installed.
Compromised shared hosting
On a hosting account where several sites live together without isolation, an infection on one site spreads to the others through the file system.
Overly permissive file permissions
Folders set to 777, a readable wp-config.php, file editing enabled in the admin all make it easier to write malicious code.
Previous incomplete clean-up
After a first infection, a backdoor left in a file, the database or a cron job lets the attacker come back as soon as the site is put back online.
Checks to perform
- 1
Check Google Search Console
The Security and Manual Actions section shows whether Google has detected hacked content and on which URLs. Also search site:your-domain.com to spot indexed pages you never created.
- 2
Scan the site from the outside
An online scanner such as Sucuri SiteCheck or VirusTotal detects visible redirects and injected scripts. Test with a mobile user agent and via a Google result too, since redirects are often conditional.
- 3
List recently modified files
Over SSH: find . -type f -mtime -7 -name '*.php' lists PHP files changed in the last seven days. Any PHP file inside wp-content/uploads is suspicious by definition.
- 4
Compare against the original files
WP-CLI can verify core integrity: wp core verify-checksums, then wp plugin verify-checksums --all. Any reported difference deserves a look at the file.
- 5
Review users and the database
Go through Users > All Users, then in phpMyAdmin search wp_posts and wp_options for strings such as eval(, base64_decode, <script or unknown URLs.
- 6
Read the access logs
Apache or Nginx logs (access.log) show POST requests to unusual files and the IP addresses behind them. Look for requests to wp-login.php, xmlrpc.php and to any file you did not install.
- 7
Check scheduled tasks
Inspect WordPress cron events with the WP Crontrol plugin and system crontabs (crontab -l): attackers often place the command that reinstalls their code there.
Solutions
Limit the damage immediately
Put the site in maintenance mode or take it offline if visitors are exposed, change every password (WordPress, FTP/SSH, database, hosting panel), revoke active sessions and back up the current state for analysis.
Clean the files
Replace WordPress core, themes and plugins with fresh copies downloaded from official sources, then inspect by hand whatever cannot be replaced: wp-config.php, .htaccess, uploads, custom code.
Clean the database
Remove unknown accounts, code injected into posts and options, redirects added to siteurl/home and malicious cron tasks.
Close the entry point
Identify the flaw that was exploited (vulnerable plugin, weak password, neighbouring hosting account), fix it and update everything that needs updating. Without this step, reinfection is almost guaranteed.
Harden the configuration
Two-factor authentication, login attempt limiting, xmlrpc.php disabled if unused, DISALLOW_FILE_EDIT in wp-config.php, correct file permissions, a web application firewall (WAF).
Request a review
Once the site is clean, request a review in Google Search Console and, if needed, from the blacklists blocking the domain (browsers, antivirus vendors, spam filters).
When should you call a professional?
- Google is showing a warning or your host has suspended your account: every hour counts for traffic and reputation.
- The site gets reinfected after a clean-up, a sign that a backdoor remains.
- The site collects customer data or processes payments and you need to assess the extent of the breach.
- You have no SSH access, no known-clean backup or no skills to read obfuscated PHP code.
- Several sites are hosted on the same account and you do not know which ones are affected.
How Agencei can help
- 1
Containment
Site isolation, forensic backup, credential rotation, blocking of malicious IP addresses and requests in progress.
- 2
Analysis
Search for every compromised file and database entry, log review to date the intrusion and identify the attack vector.
- 3
Full clean-up
Clean reinstall of core, themes and plugins, manual clean-up of custom code and the database, removal of backdoors and malicious scheduled tasks.
- 4
Fixing the flaw and hardening
Update or replacement of the vulnerable component, WordPress and server hardening, WAF, file integrity monitoring.
- 5
Lifting the blocks
Review requests to Google and blacklists, check of the email sending reputation.
- 6
Report and prevention
Incident report, recommendations and, if you wish, WordPress maintenance with ongoing updates and monitoring.
Frequently asked questions
Can a security plugin clean the site on its own?
It detects some infected files and removes known signatures, but it regularly misses custom backdoors and code injected into the database. It is useful for prevention, not sufficient for a reliable clean-up.
Should I restore a backup?
Only if you are certain it predates the intrusion, which is rarely the case because infections often stay silent for weeks. And restoring without fixing the flaw puts the site back in the state that allowed the attack.
How long does a clean-up take?
Often a few hours for a standard site, longer if the site has a lot of custom code, if several sites are affected or if the attack vector is hard to identify.
Has my customers' data been stolen?
It depends on the access the attacker obtained. Analysing the logs and files gives an estimate of what was accessed. If personal data may have leaked, notifying your data protection authority may be mandatory.
How do I prevent it from happening again?
Regular, tested updates, strong passwords with two-factor authentication, removal of unnecessary plugins, off-site backups, a web application firewall and file integrity monitoring.
Related services
WordPress Troubleshooting
White screen, 500 error, hack, broken after an update: fast diagnosis and recovery.
See this serviceSecurity
Hacked site cleanup, hardening, vulnerability assessment, WAF, backups and access management.
See this serviceWordPress Maintenance
Tested updates, verified backups, monitoring and security for a WordPress site that stays available.
See this serviceTechnical Audit
Independent review of code, architecture and infrastructure, with a prioritised report.
See this serviceTell us about your project
Describe your need in a few lines: we come back to you with a first analysis and the next steps.