Discovering your site has been compromised is a gut-punch — the pop-up ads that aren’t yours, the “this site may be hacked” warning in Google, the strange redirects, the login that no longer works. Take a breath. Knowing how to fix a hacked WordPress site is mostly a matter of working through the steps in the right order and not skipping the boring ones. This guide walks you through it calmly, and tells you honestly when it’s time to hand it to someone who does this all day.
First, confirm it’s actually a hack
Not every glitch is an attack. Before you go into cleanup mode, look for the tell-tale signs: content or links you didn’t add, spammy pages in Google’s results for your site, unexpected redirects to other sites, new admin users you don’t recognize, a sudden traffic or resource spike, or a warning from your host or your browser. If several of those are true, treat it as a compromise and keep going.
Step 1: Contain it before you clean it
The instinct is to start deleting things. Don’t, not yet. First limit the damage:
- Put the site in maintenance mode or take it offline temporarily if it’s serving malware to visitors — you don’t want to spread the problem or get further penalized by Google.
- Change your passwords — WordPress admin, hosting account, database, and file access (FTP/SFTP). Use new, strong, unique ones.
- Tell your host. On shared hosting especially, they may already know, and they can tell you whether the problem is limited to your site.
Step 2: Make a backup of the hacked site
This sounds backwards — why back up an infected site? Because it’s evidence and insurance. If a cleanup step goes wrong, you can get back to where you started. And a copy of the compromised files helps you (or a professional) figure out how the attacker got in. Label it clearly as infected so nobody restores it by accident later.
Step 3: Scan to find the infection
You can’t clean what you can’t see. Run a reputable malware scanner to locate the malicious code. Look in the usual hiding spots: recently modified WordPress files, the uploads folder (which should never contain PHP code files), fake plugin folders, and the wp-config.php (WordPress’s main settings file) and .htaccess files (a server settings file). Note everything flagged before you start deleting — attackers rarely leave just one file.
Deciding whether to clean it yourself or bring in help is a real fork in the road, and we compare the two paths in detail in WordPress malware removal: DIY vs professional cleanup. The short version: scanning is easy, and truly finishing the job is the hard part.
Step 4: Clean it out
With the map from your scan, remove the infection:
- Replace WordPress’s own files with fresh copies from WordPress.org. This wipes any tampering in WordPress itself in one move.
- Reinstall plugins and themes from clean sources. Delete anything you don’t recognize outright — attackers love to disguise malware as a legitimate-looking plugin folder.
- Clean your uploads folder of any executable files that don’t belong.
- Check the database for injected content, spam links, and rogue admin users, and remove them.
- Inspect
wp-config.phpand.htaccessfor injected redirects or malicious rules.
If you have a known-good backup from before the compromise, restoring it can be faster and cleaner than surgery — provided you’re confident it predates the infection.
Step 5: Close the door they came in through
Cleaning the site fixes today. Closing the hole fixes tomorrow. Skip this step and you’ll be doing all of the above again next week. As of 2026, security researchers consistently estimate that around 56% of WordPress hacks trace back to vulnerable plugins and themes — so the entry point is very often something out of date. Now:
- Update everything — WordPress itself, all plugins, all themes — to the latest versions.
- Delete unused plugins and themes entirely. Inactive doesn’t mean harmless; it means unwatched.
- Reset all passwords again now that the site is clean, and enable strong login protection.
- Regenerate security keys and salts in
wp-config.phpto invalidate any stolen sessions.
Step 6: Restore your reputation
If Google or your browser flagged the site, ask for a review once it’s clean — in Google Search Console you can request a security review so the warnings come down. Then keep an eye on things for the next couple of weeks. Re-infections are common precisely when someone cleans the visible mess but misses a hidden backdoor.
When to hand it to a managed host
Here’s the honest part. DIY cleanup works when the infection is simple and you’re comfortable in files and databases. But WordPress hacks are frequently not simple. Attackers plant backdoors — hidden ways back in — and a single one you miss means the whole cleanup was temporary. If any of these are true, it’s worth handing off:
- The site keeps getting re-infected after you clean it.
- You’re not confident poking around in the database or server files.
- It’s a store or a site that’s actively making you money, and every hour down costs you.
- You simply don’t have the hours this deserves.
A managed host does this routinely, with the tools and the pattern-recognition to find the backdoors an occasional cleaner won’t. To be straight with you: we only repair sites we host. So the offer is to move your site to us; we clean it as part of the move and keep it clean, for the flat monthly price. Once a site lives with us, this whole scenario gets far less likely, because prevention is built in.
The best fix is not needing one
Everything above is reactive. The real win is a setup where the attack mostly doesn’t land: automatic and verified updates that close vulnerabilities fast, a layered firewall and a live list of known attackers stopping bad traffic before it lands, breached-password login defense, ongoing malware scanning, and off-site backups 3 times a day so even a bad day is just a restore. That’s the standing protection we describe in what managed WordPress hosting should include.
If you’re cleaning up a hack right now, work the steps above in order and don’t skip closing the hole. And if you’d rather this never be your Saturday again, take a look at our managed WordPress plans — the protection is included, and support is there any hour when something feels wrong.