WordPress Site Hacked? Here's How to Clean It Up — Safely
What you're seeing
- Unexpected redirects sending visitors to spam, pharma, or sketchy third-party sites — often only on mobile or only from Google
- Spammy pages, posts, or links you didn't create (pharma, replica goods, gambling), or junk text injected into your existing pages
- New admin users you don't recognize, or suspicious scheduled posts and cron jobs you never set up
- A Google Search Console security alert, a "this site may be hacked" SERP label, or a browser/host blocklist warning
- Modified core, theme, or plugin files, a defaced homepage, or your host suspending the account for malware
What causes it
An outdated plugin or theme
The most common entry point by far is a plugin or theme left un-updated past a known security patch. Attackers scan the web for sites running vulnerable versions and exploit them automatically. The longer an update sits unapplied, the wider the window.
A vulnerable plugin (even when fully updated)
Sometimes the plugin itself has a flaw the developer hasn't fixed yet, or one that was abandoned entirely. A single insecure plugin can give an attacker a foothold to upload files or create admin accounts. Nulled or pirated premium plugins are an especially frequent culprit — many ship with backdoors built in.
Weak or reused passwords
Brute-force and credential-stuffing attacks target wp-admin, hosting, and FTP logins constantly. A weak admin password, or one reused from a service that was breached elsewhere, hands over the keys directly. Logins without two-factor authentication are the easiest targets.
Shared-host cross-contamination
On shared hosting, multiple sites can live under the same account or server space. If a neighbouring site is compromised, malware can spread across the directory into yours — even if your WordPress was perfectly maintained. This is why a clean reinstall sometimes gets reinfected within hours.
An out-of-date WordPress core or server stack
Running an old WordPress version, or an outdated PHP version your host no longer patches, leaves known holes open. Core is usually well-maintained via auto-updates, but sites with auto-updates disabled drift out of support. The underlying server software matters as much as WordPress itself.
A leftover backdoor from a previous hack
If a site was compromised before and only partially cleaned, attackers almost always leave a hidden backdoor file to re-enter later. Removing the visible symptoms without finding that backdoor leads straight to reinfection. This is the single biggest reason DIY cleanups fail.
How to fix it yourself
If you want to attempt the first steps yourself, here's how to do it safely and without making things harder to fix later.
Take a full backup before touching anything
Back up your entire site — files and database — even though it contains the malware. This preserves evidence of how the attacker got in and gives you a restore point if a cleanup step goes wrong. Download it locally; don't rely only on a backup that lives on the same compromised server.
Change every password and reset your salts
Reset your WordPress admin, hosting, database, and FTP/SFTP passwords to strong, unique ones, and remove any admin users you don't recognize. Then rotate your WordPress security keys (salts) in wp-config.php to force every existing session to log out, which kicks out an attacker who is currently signed in. Enable two-factor authentication on wp-admin while you're there.
Update WordPress core, themes, and plugins
Bring core, all themes, and all plugins up to their latest versions, since an outdated component is the most likely entry point. Delete any plugins or themes you aren't actively using, especially nulled ones. Don't reactivate anything until you're confident the entry point is closed.
Scan and inspect for malware
Run a reputable security scanner to flag injected code, unknown files, and modified core files. Compare your wp-admin and wp-includes directories against a fresh copy of the same WordPress version to spot anything that doesn't belong. Look closely for recently modified PHP files and obfuscated code, which often signal a backdoor.
Request a blocklist review once it's clean
After you're confident the site is genuinely clean and the hole is patched, request a review in Google Search Console to clear any "this site may be hacked" warning. Ask your host to lift any malware suspension as well. Submitting for review before the site is truly clean only resets the clock and can prolong the penalty.
Rather not risk it? We'll fix it for you.
Thorough malware removal is genuinely hard and risky to do yourself — one missed backdoor file and the spam or redirects come right back, often within a day. Mend's Emergency Rescue ($299) puts senior engineers on your site fast: we back up first, find and remove every piece of malware, patch the entry point that let it in, reset your credentials and salts, and request the blocklist review for you. Every step is documented so you can see exactly what we did, and it's backed by our money-back guarantee — if we can't fix it, you don't pay.