How to Clean Up a Hacked WordPress Site Safely

If your WordPress site has been hacked, the safest response is not to start deleting files at random. First, isolate the site, take a full backup for forensics, and then clean from the outside in: hosting account, WordPress users, core files, plugins, themes, and database content. That sequence reduces the chance of missing a backdoor or breaking the site further.

The hard part with a hacked site is that the visible symptom is often only the last thing that happened. You might see spam redirects, defaced pages, new admin users, unfamiliar files, email blasts, search engine warnings, or your host suspending the account. Sometimes the site still looks normal in a browser while malicious code is hiding in a plugin file, a theme template, or a database option.

What “cleaning up” a hacked site actually means

A proper cleanup does more than remove the obvious malware. You want to achieve three things:

• remove the active infection
• remove the attacker’s access and persistence
• restore trust in the site, hosting, and accounts

That usually means checking every place an attacker can live: WordPress admin accounts, hosting control panel, FTP/SFTP, SSH keys, database users, wp-config.php, plugin and theme files, uploads directories, scheduled tasks, and any third-party services connected to the site. If one of those still has compromised access, the site can be reinfected quickly.

If you want a broader step-by-step recovery path, our in-depth guide on how to clean up a WordPress site safely covers the main recovery workflow. If you are already locked out of wp-admin, start with Locked Out of WordPress Admin: Why It Happens and How to Fix It.

First signs you may be dealing with malware

Not every hack looks dramatic. Watch for these common signs:

• unexpected redirects, especially on mobile or only from search engines
• new admin accounts you did not create
• spam pages indexed by Google
• files appearing in wp-content/uploads that should not be there
• site content changing on its own
• plugin or theme files that look recently edited
• password reset emails or login alerts you did not trigger
• hosting warnings about malware, phishing, or resource abuse

Some hacks are meant to be loud. Others are designed to hide for weeks and collect credentials, send spam, or create a backdoor for later use. That is why a careful review matters more than a quick cleanup.

Do this first: contain the damage

Before you touch files, limit further harm. Back up the site first, even if it is infected. A backup gives you a point-in-time copy for recovery and analysis, and it can be useful if something gets deleted during cleanup.

1. Put the site in maintenance mode if you can still access it, or temporarily suspend public access through your host.
2. Change passwords for every WordPress admin account, hosting panel, SFTP/FTP account, SSH key, database user, and connected email account.
3. Log out all sessions where possible, including any security plugin sessions.
4. Tell your host you suspect a compromise so they can check server-side indicators.
5. Save screenshots, suspicious file names, and any alerts before deleting anything.

If your host provides a malware scan or file integrity check, run it now, but do not rely on it alone. Host scans are useful triage, not a full cleanup.

The safest cleanup workflow

1) Start with a known-clean backup if you have one

If you have a recent backup from before the hack, this may be the fastest and safest recovery option. Restore that backup to a separate staging environment if possible, then compare it to the live site. You still need to change credentials and check for the entry point, but you will be working from a cleaner baseline.

If you do not have a trustworthy backup, do not assume the current files are safe. Move through the cleanup steps below.

2) Replace WordPress core files

WordPress core should be one of the easiest pieces to verify. Reinstall a fresh copy of WordPress core from a trusted source, and replace everything except wp-config.php and the wp-content folder. That removes hidden changes from core files without touching your content.

Be careful with hosts or setups that use custom core modifications. In a standard WordPress install, core files should not be hand-edited. If they were, that is a sign of a bigger maintenance problem.

3) Inspect plugins and themes

Attackers often hide in plugin and theme files because those files are expected to execute PHP. Compare installed plugins and themes against fresh copies from the official source. If a plugin or theme is no longer needed, delete it rather than leaving it inactive.

Look for suspicious patterns such as:

• obfuscated code using long strings, repeated encoding, or odd variable names
• recent edits to files that should rarely change
• unknown PHP files in plugin or theme folders
• code that calls remote URLs, writes files, or creates admin users

If you find a modified premium plugin, do not just overwrite it blindly unless you understand what it does. Remove it, replace it with a clean copy, and test the site. If the plugin is nulled or downloaded from an untrusted source, remove it entirely. If you want help identifying a suspicious plugin before you touch it, free diagnosis can triage the issue and quote a flat price before work begins.

4) Check uploads and unexpected PHP files

The uploads directory should usually contain images, PDFs, and other media files, not executable PHP. If you find PHP in wp-content/uploads, treat it as suspicious unless you intentionally use it for a known purpose. The same applies to oddly named files with double extensions or random folder structures.

Do not delete blindly if you depend on custom functionality. Instead, back up the suspicious file, then remove it from production after you confirm it is malicious.

5) Review users, roles, and admin access

Check the WordPress Users screen for accounts you do not recognize, especially admin accounts with generic names. Remove unauthorized users, then review role assignments for legitimate users. An attacker may also have changed a subscriber or editor account to an administrator.

Also check the database for user records if you know how to do so safely. Some attackers create hidden admins or reuse existing accounts rather than adding obvious new ones.

6) Scan wp-config.php and other sensitive files

Open wp-config.php and look for unfamiliar includes, eval-like patterns, or extra code added above or below the normal configuration block. Also check .htaccess, web.config on Windows-based hosting, and any MU-plugins or drop-ins in wp-content.

These files are common places to persist after a cleanup because they load early and can redirect traffic or inject code before the site fully starts.

7) Check the database for injected content

Malware is not always file-based. Spam links, hidden scripts, and malicious redirects can live in the database inside posts, widgets, options, or transients. Search for strange domains, base64-like strings, or content that you did not publish.

Focus on:

• posts and pages with suspicious links or hidden text
• widgets and theme options that inject scripts
• sitewide settings such as home URL, active plugins, and custom code fields

If you are not comfortable editing the database directly, stop and use a staging copy. One wrong delete can break menus, widgets, or the whole site.

8) Remove persistence: cron jobs, scheduled tasks, and backdoors

Attackers often schedule scripts to recreate malware after you delete the visible files. Check WordPress cron events, hosting cron jobs, and any custom scheduled tasks. Also search for strange file names, recently modified files, and hidden folders in the root and wp-content directories.

Any file that can write to other files, create users, or fetch code from remote servers deserves close attention.

After cleanup: rotate everything again

Once you believe the site is clean, rotate credentials one more time. That includes WordPress passwords, hosting logins, SFTP/FTP, database credentials, API keys, SMTP credentials, and any third-party service tokens tied to the site.

Then update WordPress core, plugins, and themes from trusted sources only. Remove anything abandoned or unnecessary. A hacked site is often the result of weak access control plus neglected software, so this is where prevention begins.

How to verify the site is actually clean

Verification matters as much as cleanup. A site that “looks fine” can still be compromised. Check the following after the cleanup:

• log in and out with different roles to confirm access works normally
• browse the site in an incognito window and on mobile
• inspect source code for injected scripts or hidden iframes
• check recent file modification times for anything unusual
• revisit search console or security warnings if you had them
• ask your host to rescan if they provide that service

If you previously saw search engine warnings or blacklist notices, you may need to request a review after the cleanup. Make sure the underlying cause is fixed before you submit any reconsideration request.

How to prevent a repeat compromise

The best prevention is a smaller attack surface and better recovery options. That means:

• keep WordPress core, plugins, and themes updated
• remove unused plugins and themes
• use unique, strong passwords and MFA where available
• limit admin accounts to only the people who truly need them
• use backups you can restore and test
• monitor file changes, logins, and uptime
• install software only from trusted sources

It also helps to know what normal looks like on your site. If you can recognize a legitimate update, plugin change, or cron job, you will spot the abnormal ones faster.

For a related recovery step that many hacked sites need, read WordPress Caching Explained: What to Clear and When after the cleanup, especially if redirects or stale pages kept showing old content. If you suspect the hack came through an outdated plugin or theme, What to Do When a WordPress Update Breaks the Site is also useful for understanding how fragile deployments can be.

When to call a professional

Call a professional when the site is business-critical, when you do not know the entry point, when the hack keeps coming back, or when cleanup touches code and databases you are not comfortable editing. You should also get help if your host has suspended the account, Google has flagged the site, or you need the site back up fast without risking more damage.

That is exactly the kind of work Mend handles every day. Senior engineers clean up compromised WordPress sites on a backup-first workflow, usually the same day, and every paid fix comes with a plain-English report of what was found and what changed. If you want a fast, flat-price recovery, start with Emergency Rescue. If you are not sure how deep the problem goes, use free diagnosis first.

If you want ongoing protection after the cleanup, a Care Plan can cover updates, backups, security monitoring, and uptime monitoring so the site does not end up here again.

In a hacked-site situation, speed matters, but sequence matters more. Contain the problem, replace trust with known-clean files, check every persistence point, and only then bring the site back into service. That is how you clean up a WordPress hack safely instead of just making it look fixed for a day.