How to Recover a Hacked WordPress Site: Step by Step

Discovering that your WordPress site has been hacked is stressful, but a clear plan makes it manageable. The aim is to contain the damage, remove the malicious code, close the hole that let the attacker in, and then confirm the site is clean. Skipping the third step is the most common reason sites get hacked again within days.

Signs your site may be compromised

• Visitors are redirected to unrelated or suspicious sites, especially on mobile or from search results.
• Search results show Japanese-language or pharmaceutical spam pages under your domain.
• Your browser or Google warns that the site is dangerous.
• New administrator accounts you did not create.
• Your host suspends the account or reports outgoing spam.
• Files with random names, or recently changed files you did not touch.

Some of these have innocent explanations, so confirm before assuming the worst, but act quickly if you find real evidence.

Immediate steps: snapshot and contain

Before changing anything, take a full copy of the files and database, even though it is infected. It preserves evidence for working out how the attacker got in, and gives you a fallback if a cleanup step goes wrong. Store it offline and do not restore it later by accident.

Contain the problem

If the site is serving malware or spam, put up a simple maintenance page or restrict access while you work. Contact your hosting provider; they can often see what is happening on the server and may help isolate the account. At the same time, change the passwords that matter: the hosting control panel, FTP or SFTP accounts, database user, and WordPress administrator accounts. Do this from a clean computer.

Restore or clean

You have two broad options.

• Restore from a clean backup. If you have a backup from before the compromise, this is usually quickest. Restore, then immediately update everything and fix the entry point, or the attacker will return.
• Clean manually. If no clean backup exists, you will need to remove malicious files and database entries by hand or with scanning tools.

Be careful about how far back to go. Attackers sometimes sit quietly for weeks before acting.

Manual cleanup checklist

1. Replace WordPress core files with a fresh download of the same or newer version. Leave wp-config.php and wp-content alone for now.
2. Delete every plugin and theme, then reinstall them fresh from trusted sources. Discard any you do not need.
3. Inspect the wp-content/uploads folder. It should contain media, not PHP files.
4. Check wp-config.php and .htaccess for code you do not recognise.
5. Review users and remove unknown administrators.
6. Search the database for injected scripts in posts, options and widgets.
7. Generate new secret keys and salts in wp-config.php, which logs everyone out.
8. Check scheduled tasks for unfamiliar entries, since attackers often use them to re-infect.

Find the entry point and verify

Common entry points are an outdated plugin or theme, a pirated extension, a weak or reused password, or another compromised site on the same account. Check your access logs for suspicious requests around the time of the first change. Update everything, remove what is abandoned, and enable two-factor authentication. If you host several sites in one account, check each of them, because malware can spread sideways.

Verify and request reviews

Re-scan the site with a malware scanner, browse it from different devices, and check that redirects and spam pages are gone. If Google or a browser flagged the site, use Google Search Console to request a review once you are confident it is clean. Also check that your email domain has not been used to send spam.

Harden so it does not happen again

Work through a hardening list: keep software updated, use least-privilege roles, limit login attempts, disable dashboard file editing and keep tested off-server backups. Our WordPress security hardening checklist covers each of these. Consider a web application firewall too, as it can block many exploit attempts before they reach WordPress.

Mistakes to avoid, and when to get help

• Do not just delete the visible symptom and hope. Backdoors are usually hidden elsewhere.
• Do not reinstall over the infected files without removing the old ones.
• Do not pay anyone who contacts you out of the blue offering to fix your site.
• Do not ignore the other sites in the same hosting account.

When to ask for professional help

If the site is critical for your business, if you handle customer data or if cleanup keeps failing, get a professional. Also consider whether personal data was exposed; depending on where you operate, there may be notification obligations. Check the rules that apply to you, or ask a qualified adviser.

After recovery, keep an eye on the site for several weeks. Watch for new files, unexpected users and odd traffic, and keep your logs. Re-infections usually appear within days if a backdoor was missed, so early monitoring pays off.

How we can help

Hosting with Plesk, Cloudflare CDN and free SSL gives you a stronger starting point, and our team can answer questions about restoring and securing a site. If you need a fresh, clean start, our WordPress migration service can move your cleaned site to WordPress hosting for free.