How to Clean a Hacked WordPress Site Safely

If your WordPress site has been hacked, the safest first move is to contain the damage, take a clean backup of the current state, and then clean from a known-good baseline. Don’t start deleting files at random: a rushed cleanup often leaves hidden backdoors behind and the hack comes back.

The goal is simple: stop active abuse, identify what changed, remove the malicious code, and then rebuild trust with a clean core, clean plugins, and fresh credentials. If you want a deeper step-by-step reference while you work, start with WordPress Site Hacked? Here's How to Clean It Up — Safely.

What a hacked WordPress site usually looks like

WordPress hacks do not always look dramatic. Sometimes the site still loads, but search results show strange pages, customers get redirected, admin accounts appear that you did not create, or forms start sending spam. In other cases, the only clue is that hosting alerts, antivirus tools, or Google Search Console report suspicious files or unsafe pages.

Common symptoms include:

• Unexpected admin users or changed email addresses
• Spam links injected into posts, widgets, headers, or footers
• Redirects to unrelated sites, often only on mobile or only for search engine traffic
• Unknown PHP files in wp-content, uploads folders, or the site root
• New scheduled tasks, cron jobs, or plugin settings you never added
• Hosting account warnings about malware, phishing, or outbound spam
• Search engine warnings such as “this site may be hacked”

Sometimes a hack is not visible at all. A backdoor may sit quietly until the attacker returns later. That is why cleanup has to be methodical, not cosmetic.

The safest way to start: contain first, clean second

Before you touch the site, back it up. That backup is not the fix; it is your record of what happened. Use it to preserve evidence and to recover anything you might need later. If the site is live and actively serving malware or redirects, ask your host about temporarily isolating it or putting it into maintenance mode while you work.

Then change passwords from a clean device for every account tied to the site:

• WordPress admin accounts
• Hosting panel account
• FTP/SFTP and SSH users
• Database users
• Email accounts tied to site administration
• Any API keys or tokens used by plugins

If you can, also rotate your WordPress security salts in wp-config.php. That helps invalidate existing sessions. It does not remove malware, but it can kick out attackers who are still logged in.

Do not clean the site by deleting random files

This is where many site owners get burned. Hackers often hide malicious code inside legitimate files, or they place a small loader in one file that pulls the real payload from somewhere else. Deleting anything that “looks suspicious” can break the site and still leave the infection intact.

Instead, work from trusted originals and compare changes. The safest approach is to replace known-good WordPress core files with fresh copies, then inspect themes, plugins, and uploads for anything that does not belong.

Step 1: replace WordPress core files

WordPress core should never need to contain custom malware or business logic. So the first major cleanup step is to reinstall clean core files from WordPress.org, while preserving wp-config.php and the wp-content folder.

1. Download the same WordPress version currently installed, or a newer stable version if you are already planning an update.
2. Replace the core folders such as wp-admin and wp-includes with clean copies.
3. Replace root WordPress files except for wp-config.php and .htaccess if you need to preserve custom rules temporarily.
4. Check for extra PHP files in the root that do not belong.

If your site behaves strangely after this, that is useful information: it means the problem is likely in a plugin, theme, upload, or custom code rather than WordPress core itself.

Step 2: inspect plugins and themes the safe way

Most real-world hacks enter through outdated plugins, vulnerable themes, stolen credentials, or a compromised admin account. Even when the attacker used one file, the cleanup often ends with a plugin or theme being the original entry point.

Look for:

• Plugins or themes you do not recognize
• Files with very recent modification times in unexpected places
• Encoded or obfuscated PHP such as base64_decode, gzinflate, or long unreadable strings
• Files added inside uploads directories with PHP extensions
• Injected code in functions.php, template files, or plugin loaders

For a safer route, compare each installed plugin and theme against a fresh copy from the developer or the WordPress repository. If a file differs and you did not intentionally modify it, treat it as suspicious. When in doubt, replace the entire plugin or theme with a clean reinstall after confirming you have the correct version.

If a bad update seems to be involved, the rollback process in How to Roll Back a Bad WordPress Plugin or Theme Update can help you identify whether you are dealing with a vulnerability, a broken update, or a genuine compromise.

Step 3: hunt for backdoors, not just visible malware

The visible spam or redirect is usually only the tip of the iceberg. Attackers commonly leave backdoors so they can reinfect the site after you clean the obvious files. That is why a real cleanup includes searching for persistence mechanisms.

Check for:

• Unexpected admin accounts in WordPress users
• New cron events or scheduled tasks
• Unknown files in wp-content/uploads, mu-plugins, and the site root
• Modified .htaccess rules that redirect traffic
• Suspicious PHP in image folders or cache directories
• Hidden code in database options, widgets, or post content

If you have access to logs, use them. Access logs can show which files were requested before the compromise became visible. Error logs can point to malware loaders, failed includes, or suspicious PHP warnings. If you are comfortable reading logs, the guide How to Read WordPress Debug Logs and Find the Real Problem is useful, but for a hack cleanup, server access logs are often even more valuable.

Step 4: scan the database too

Hacks are not limited to files. Attackers also inject spam links, malicious scripts, and hidden redirects into the database. This is especially common in widget areas, old post content, theme options, and some page builder settings.

Search the database for obvious red flags such as:

• Unexpected links to unrelated domains
• <script> tags in places that should only hold text
• Base64-encoded strings or long encrypted-looking blobs
• Spam keywords in posts, excerpts, widgets, or options rows

Be careful here. Database cleanup can be safe, but only if you know what the legitimate content should look like. Back up first, then remove only content you can verify is malicious.

Step 5: reinstall and verify everything important

After you remove malicious code, do not assume the site is clean. Reinstall trusted copies of affected plugins and themes, and remove anything unused. Then update WordPress, plugins, and themes to current stable versions, assuming your host and stack support them.

Verify these items one by one:

• Only the expected admin users exist
• Passwords have been changed everywhere
• Security salts were rotated
• File permissions are sensible for your environment
• No PHP files exist where only uploads should be
• No unexpected scheduled tasks remain
• Search engine warnings have been addressed

If you use uptime or malware monitoring, re-enable it after cleanup so you know quickly if something returns.

Step 6: clear trust issues after the technical fix

Cleaning malware is only part of recovery. If customers, browsers, or search engines think the site is unsafe, you may still see warning pages or blocked traffic after the code is gone. That usually means you need to request a review in the relevant platform after confirming the site is clean.

Also review anything that could have been exposed during the breach. If attackers accessed admin accounts, assume passwords, email tokens, and API keys may be compromised. If payment, membership, or form data was involved, notify the right people promptly and follow your legal or compliance obligations.

How to prevent reinfection

Most reinfections come from the same small set of problems: weak passwords, outdated software, abandoned plugins, poor file permissions, and admin accounts that stayed active too long. Once the immediate fire is out, prevention matters more than clever cleanup tricks.

• Keep WordPress core, plugins, and themes updated
• Remove plugins and themes you do not actively use
• Use unique passwords and multi-factor authentication where possible
• Limit admin accounts to the people who truly need them
• Back up regularly and test that backups restore correctly
• Monitor file changes, uptime, and login attempts
• Use a host that can help you isolate and investigate suspicious activity

A lot of hacked sites are not “special cases.” They were simply easy to get back into because the first compromise was cleaned superficially instead of thoroughly.

When to call a professional

Call a professional if the site is still redirecting, if you cannot confidently tell which files are clean, if the database is involved, or if the hack keeps returning after you remove the obvious malware. You should also get help if the site is business-critical and downtime costs more than a fast, reliable cleanup.

That is exactly the kind of situation Mend handles every day. A senior engineer can investigate the compromise, clean it on a backup-first workflow, and send you a plain-English report of what happened and what changed. If you need a hand now, start with a free diagnosis; if the site is actively compromised, Emergency Rescue is the fastest path. You can also connect securely without sharing passwords through Mend Connect.

A practical recovery checklist

• Back up the current site before changing anything
• Change all passwords and rotate salts
• Replace WordPress core with clean files
• Reinstall trusted plugins and themes
• Inspect uploads, root files, and database content for injected code
• Remove unknown users, cron jobs, and persistence mechanisms
• Update everything to supported versions
• Request security reviews or blacklist reconsideration where needed
• Set up monitoring so you catch reinfection early

If you are stuck between “I think it is clean” and “I do not trust this site yet,” that is a good moment to stop and get a second pair of eyes. A careful cleanup is faster than a second cleanup.