Cleaning Up a Hacked WordPress Site Safely

If your WordPress site has been hacked, the safest path is not to “delete suspicious files” at random. Start by backing up the infected site, take it offline if needed, change credentials, then clean the entry point and the backdoors before you restore the site to full traffic. If you skip those steps, the hack often comes back within hours or days.

This article focuses on the safest cleanup order for a hacked WordPress site: what to check first, what to avoid touching blindly, and how to decide when restoration is safer than cleanup. If you want a broader reference while you work, see the WordPress site hacked cleanup guide.

What a hacked WordPress site usually looks like

Not every compromise looks dramatic. Some hacked sites show obvious spam pages, redirect visitors to strange domains, or trigger browser warnings. Others look “mostly fine” but quietly inject SEO spam, create rogue admin users, or add malicious code that only loads for search engines.

Common symptoms include:

• Unexpected redirects, especially from search traffic or mobile users
• Spam links, pharma content, or Japanese keyword spam appearing in pages or titles
• New admin accounts you did not create
• Unknown files in wp-content/uploads, wp-includes, or theme folders
• Outgoing email spikes, contact form spam, or failed mail delivery
• Google Safe Browsing warnings or search snippets that show hacked text
• Visitors reporting antivirus, browser, or login warnings

Sometimes the only clue is a sudden change in behavior after a plugin update, a password reset, or a host migration. That’s why the first job is to preserve evidence and avoid making the compromise worse.

The safest cleanup order

Before you touch anything risky, make a full backup of the current hacked site and database. Keep that backup somewhere separate from your production server. You may need it later to compare files, confirm what changed, or recover something you accidentally remove.

1) Put the site in a safer state

If the site is actively redirecting users, sending spam, or exposing private data, reduce the damage first:

• Enable maintenance mode if you can do so without logging into a compromised admin session.
• Temporarily restrict access by IP, password protection, or host-level maintenance features if available.
• Do not rely on hiding the problem with a plugin alone; a hacked plugin can be part of the attack path.

If you cannot confidently secure the admin area, review Locked Out of WordPress Admin: Why It Happens and How to Fix It before trying more changes.

2) Change every password and revoke old sessions

Assume any reused password is compromised. Change passwords for:

• WordPress admin accounts
• SFTP/SSH or hosting panel access
• Database users
• Email accounts tied to password resets
• Any API keys or third-party integrations that can modify your site

Also log out all users if your host or security tools support session invalidation. If an attacker still has an active session, they can undo your cleanup.

3) Identify the entry point

Cleaning malware without finding the entry point is usually temporary. The most common entry points are weak credentials, outdated plugins or themes, vulnerable file upload features, or a compromised admin account. Sometimes the attack starts outside WordPress entirely, such as through stolen hosting credentials or a vulnerable staging site.

Check the recent history first:

• Recently installed or updated plugins
• Inactive themes or plugins that are still present on disk
• New admin users or editor accounts
• Unexpected changes in wp-config.php, .htaccess, or server config files
• Suspicious cron jobs, scheduled tasks, or file modification times

If the hack appeared right after an update, this may be related to a vulnerable add-on or a broken update process. In that case, the article What to Do When WordPress Breaks After an Update can help you sort out what changed and what needs replacing.

4) Replace core, plugins, and themes from clean sources

Do not “clean” core WordPress files line by line unless you have a clear diff and a good reason. The safer approach is to replace known-good files from official sources.

Start with WordPress core files. Reinstall the current WordPress version or upload a fresh copy of core, excluding wp-config.php and wp-content. Then do the same for plugins and themes by reinstalling clean copies from trusted sources. Remove any plugin or theme you do not actively use.

Be careful with theme customizations. If you edit theme files directly, compare them against a backup or child theme first. If you need a broader reminder, see Never Edit WordPress Theme Files Directly.

5) Search for backdoors, not just visible malware

Attackers often leave multiple ways back in. A visible spam injection might be only one layer. Common backdoors include:

• PHP files hidden inside uploads folders
• Base64 or obfuscated code in theme functions
• Fake plugin files that mimic legitimate names
• Modified core files that survive updates if you do not replace them
• Database injections in posts, widgets, options, or menu items

Look for code that is heavily encoded, unusually long, or placed where PHP should not normally live. But do not delete files just because they look unfamiliar. Some legitimate plugins generate cache, logs, or temporary files that can be mistaken for malware.

6) Clean the database as carefully as the files

Many hacks live in the database, especially spam links, malicious script tags, rogue admin metadata, or injected content in options tables. The database is easy to overlook because it does not look like code. Yet that is often where the visible spam actually comes from.

Review:

• Posts and pages for injected links or hidden text
• Widgets and custom HTML blocks
• Sitewide options, headers, and footer scripts
• User accounts and roles
• Scheduled tasks or transient entries that should not exist

If the site uses a page builder, membership plugin, or WooCommerce, check those plugin tables too. Some attacker changes will not appear in the standard posts table.

7) Check for reinfection paths

A site is not really clean until it stops getting reinfected. After the visible malware is removed, verify the following:

• All passwords were changed everywhere the attacker could reach
• Unused admin accounts were removed
• Old plugins and themes were deleted, not just deactivated
• File permissions are sane for your host
• Core, plugins, and themes are fully updated after cleanup
• Security keys in wp-config.php were rotated if needed
• Server-side malware scanning and file integrity checks are enabled where possible

If the site was hacked through brute-force login attempts, review How to Stop WordPress Brute-Force Login Attacks so you do not clean up the same compromise twice.

What not to do during cleanup

When panic sets in, it is tempting to wipe folders, delete random files, or restore an old backup immediately. Those shortcuts can make the situation worse.

• Do not delete files you do not understand without a backup copy
• Do not restore a backup from after the hack started
• Do not reuse passwords or API keys after cleanup
• Do not assume deactivating a plugin removes the threat
• Do not ignore email, hosting, or domain accounts; WordPress is only one part of the system

If your site is showing a “This site may be hacked” warning in search results, cleanup alone may not be enough. You may also need a review of cached pages, indexed spam URLs, and Search Console signals. In that case, see the full hacked-site guide for recovery steps.

How to prevent reinfection

Once the site is clean, the goal is to make the next attack much harder.

• Keep WordPress core, plugins, and themes updated
• Delete anything unused instead of leaving it inactive
• Use unique passwords and two-factor authentication where available
• Limit admin accounts to people who truly need them
• Enable backups you can actually restore, not just backups that exist
• Monitor file changes, login attempts, and uptime
• Review logs after suspicious behavior, not weeks later

Regular maintenance matters because most hacks succeed through known weaknesses, stale software, or reused credentials. If you want a lower-risk maintenance structure after recovery, a managed plan can help keep updates, backups, and monitoring from falling through the cracks.

When to call a professional

Bring in a professional if the hack involves payment data, customer accounts, SEO spam across many pages, recurring reinfection, or server-level compromise. You should also get help if you cannot tell whether the site is truly clean, if you do not have a restorable backup, or if the cleanup has to happen fast while the site is still live.

That is exactly the kind of work Mend handles every day. Our senior engineers clean hacked WordPress sites on a backup-first workflow, document the root cause in plain English, and fix the issue without making you hand over passwords. If you need a faster, safer path, you can start with a free diagnosis or go straight to Emergency Rescue for urgent cleanup.

If you want the site repaired with a clear report of what was changed, not guesswork, Mend can help. Paid fixes include a fixed-upfront price and a “fixed, or your money back” guarantee, and access is handled securely through the free Mend Connect plugin.

Final checklist

Before you call the site clean, confirm these basics:

• You have a fresh backup of the cleaned site
• All compromised passwords are changed
• Core, plugins, and themes were replaced from trusted sources
• Backdoors and rogue users were removed
• Database injections and spam content were cleaned
• Monitoring is in place so you can catch reinfection early

If any of those boxes is still uncertain, the site is not really done yet. At that point, a free diagnosis can save time and prevent a second incident.