How to fix a hacked WordPress site and know it is clean

Your site’s been hacked, and every instinct says start deleting things. Slow down for ten minutes. To fix a hacked WordPress site properly, you have to remove every way back in, not only the visible damage, or it’ll be hacked again within days. This is the order I work in.

How do I know my WordPress site has been hacked?

These are the signs I see most often, and any one of them is reason enough to check your site properly:

• Visitors are redirected to spam, gambling or pharmacy sites, often only on mobile or only when they arrive from Google
• Google shows strange pages from your site when you search for site:yourdomain.com
• Chrome or Google Search shows a “this site may be hacked” or “dangerous site” warning
• Admin users you don’t recognise appear under Users
• Your host suspends the account for malware or spam email
• New PHP files appear in folders like wp-content/uploads, which should only hold images and documents

Step 1: Take a copy before you touch anything

Download a full backup of the files and the database as they are now. You may need it to see how the attacker got in, and it protects you if the clean-up goes wrong.

Step 2: Change every password

Change the hosting account, SFTP, database, every WordPress administrator, and the email account tied to the site. Then replace the security keys (the salts in wp-config.php). That logs everyone out, including the attacker.

Step 3: Replace WordPress files with clean copies

Don’t try to clean infected core files line by line. Reinstall WordPress core from wordpress.org, and reinstall every plugin and theme from its official source. If WP-CLI is available on your host, the commands wp core verify-checksums and wp plugin verify-checksums --all list the files that were changed.

Step 4: Search what you can’t reinstall

The uploads folder, wp-config.php, .htaccess and the database are unique to your site. Look for PHP files inside uploads (there should be none), unfamiliar code at the top of wp-config.php, redirect rules you didn’t add in .htaccess, and suspicious scripts in posts or in the options table.

Step 5: Remove unknown admin users

Delete any administrator you didn’t create, and check that the remaining users still have the right roles.

Step 6: Close the door they came in through

Most hacks come through an outdated plugin or theme (Patchstack found 91% of new WordPress vulnerabilities in 2025 were in plugins), a pirated (“nulled”) premium plugin, or a reused password. Remove plugins you don’t use, update everything, and replace any premium plugin that wasn’t bought from its developer.

Step 7: Tell Google the site is clean

If a Google Ads campaign was stopped, read what a Compromised Site disapproval means and how to appeal it.

If Google flagged the site, request a review in Search Console under Security issues once you’re sure it’s clean, as Google’s help page describes. The warning is removed after a successful review.

How do I know my site is really clean?

“It looks fine now” isn’t the same as clean. Hackers usually leave more than one way back in, and a site that looks normal can still be sending spam, redirecting mobile visitors or hiding links to other sites that only Google sees. Before you call it done, check:

1. Core files match WordPress.org. Tools such as WP-CLI’s wp core verify-checksums compare every core file with the official copy.
2. Plugins match their official versions. wp plugin verify-checksums --all does the same for plugins from the WordPress directory.
3. No PHP files in uploads. The wp-content/uploads folder should hold images and documents, never .php files.
4. No unknown scheduled tasks. Malware often re-installs itself through WordPress cron jobs. List them and remove anything you don’t recognise.
5. No hidden redirects. Visit the site from a phone on mobile data, and search Google for site:yourdomain.com to look for spam pages in your results.
6. Clean in Google’s eyes. Search Console’s Security issues report should be empty.

Then watch it for a few weeks. If the infection returns, a back door was missed, and it’s time to rebuild from clean copies rather than keep patching.

Why won’t restoring a backup keep me safe?

Restoring last week’s backup feels like a fix, but the hack usually started earlier than you noticed, so the backup may already be infected. Even a clean backup brings back the outdated plugin that let the attacker in. Restore only from a backup you know predates the hack, then update and harden immediately, before the site is public again.

Which security steps actually stop the next hack?

Most “security plugins” add a long list of settings. These few things make the biggest difference:

• Update promptly. Most attacks use known holes in old plugin versions.
• Remove what you don’t use. Deactivated plugins can still be exploited. Delete them.
• Use strong, unique passwords and two-factor login for every admin account.
• Give people only the access they need. Editors don’t need administrator accounts.
• Keep off-site backups so recovery never depends on the hacked server.

If you want to catch problems early, read how to check if your WordPress site is hacked. Most of the warning signs show up days before visitors notice.

What do I tell my customers after a hack?

If customer data may have been exposed, for example on a store or a site with user accounts, take advice on whether you must notify customers or a regulator. Rules differ by country. Even when you don’t have to, a short honest note builds more trust than silence: what happened, what you did, and whether anyone needs to change a password.

If the site only showed spam or redirected visitors, a notice is rarely needed, but check your email. Hacked sites are often used to send spam, which can get your domain’s email blocked. Ask your host or email provider whether your domain was put on a block list, and request removal once the site is clean.

How do I keep the site clean from now on?

Hacked sites are almost always unmaintained sites. Tested updates, off-site backups and monitoring for changed files catch problems in hours instead of weeks. That’s the core of a WordPress maintenance plan. If your site is hacked right now, send me the address and I’ll tell you what I see before you spend anything.

Written by Sakib Islam, a WordPress developer who builds and looks after sites for businesses and agencies. About my work