WordPress Site Hacked: How to Recover, Clean and Secure It Step by Step
If your WordPress site is hacked, work in this order: contain it (maintenance mode and a full backup for evidence), change every password (hosting, SFTP/SSH, database, all admins) and the salts in wp-config.php, remove unknown admin users, reinstall WordPress core, plugins and themes from clean copies, hunt for backdoors (especially PHP files in wp-content/uploads), then update everything, add 2FA, and ask Google to review the site. Restoring a backup alone is not enough if the hole they used stays open.
First 30 minutes
- Take a full backup of files + database (evidence, and so you lose nothing).
- Change hosting, SFTP/SSH and database passwords.
- In WordPress → Users, delete admins you do not know.
- Replace keys and salts in
wp-config.php(from api.wordpress.org/secret-key/1.1/salt/). - Update or remove every plugin and theme.
A live example first
A small clinic's WordPress site started sending mobile visitors from Google to a fake "you won a prize" page. Desktop visitors saw nothing wrong, which is a common trick.
- Contain: the admin turned on maintenance mode and downloaded a full backup with the host's tool.
- Users: WordPress → Users showed an admin
wp-support-teamcreated two days ago. Deleted (posts reassigned). - Find PHP in uploads:
find wp-content/uploads -name "*.php"
wp-content/uploads/2026/09/cache-img.php
That file contained obfuscated code (eval(base64_decode(...))). Uploads should never contain PHP.
- Recently changed files:
find . -name "*.php" -mtime -7 -not -path "./wp-content/cache/*"
This showed an edited theme functions.php and a plugin folder wp-content/plugins/wp-cache-helper/ that nobody had installed.
- Cause: a slider plugin two years out of date with a known vulnerability.
- Fix: fresh core with
wp core download --force --skip-content, clean plugin copies, removed the fake plugin and the slider, new salts, all passwords changed, 2FA added, Google review requested in Search Console.
Friends, the redirect was the symptom. The old plugin was the disease.
How does recovery work?
Recover in order: contain, rotate passwords, remove fakes, reinstall clean, harden, then ask Google to review.
Attackers usually leave more than one way back in: a fake admin, a backdoor file, a changed theme, and stolen passwords. Recovery has to remove all of them and close the original hole, otherwise the site is re-hacked within days.
How do I recover step by step?
- Put the site in maintenance mode or take it offline.
- Take a full backup (files + database) and keep it separately for evidence.
- Change hosting control panel, SFTP/SSH, and database passwords; update
wp-config.phpwith the new DB password. - Replace the keys and salts in
wp-config.phpto log everyone out. - Review all users; remove unknown admins; reset passwords for real ones.
- Reinstall WordPress core from WordPress.org (keep
wp-config.phpandwp-content). - Delete and reinstall every plugin and theme from the official source. Remove any you do not use.
- Search
wp-content/uploadsandmu-pluginsfor PHP files and remove them. - Check the database for strange admin users and injected
<script>tags in posts and options. - Or restore a backup from before the hack, then do steps 3–5 and update everything.
- Scan with a security plugin or an outside scanner.
- Request a review in Google Search Console if Google flagged the site.
Commands and checks by access type
| Access | Useful checks |
|---|---|
| WP-CLI (SSH) | wp core verify-checksums, wp plugin verify-checksums --all, wp user list --role=administrator |
| SSH / Linux | find wp-content/uploads -name "*.php", find . -mtime -7 -name "*.php", grep -rl "eval(base64_decode" . |
| cPanel / hosting panel | File Manager sorted by modified date, Malware scanner, raw access logs |
| Only wp-admin | Users list, Plugins list, a security plugin scan |
| Database (phpMyAdmin) | wp_users, wp_usermeta (capabilities), wp_options siteurl/home |
wp core verify-checksums compares core files with official copies and lists any that were changed.
Harden after cleaning
| Action | Why |
|---|---|
| Auto-update plugins and themes | Most hacks use known, already fixed bugs |
| Remove unused plugins/themes | Less code to attack |
| Never use nulled (pirated) plugins | They often come with backdoors |
| 2FA for all admins | Stops password-guessing and reuse |
| Unique strong passwords | Stops credential stuffing |
define('DISALLOW_FILE_EDIT', true); |
Blocks editing PHP from wp-admin |
| Block PHP in uploads | Web server rule, so uploaded PHP cannot run |
| Off-site daily backups | Fast clean restore |
| A web application firewall | Blocks common attacks |
Real example
In June 2024, the WordPress.org plugin team and the security firm Wordfence reported that several plugins on the official directory were changed by an attacker to include malicious code that created new admin accounts and sent the details to the attacker. This is why "check for unknown admins" is always an early step, and why plugin updates and monitoring matter even for trusted plugins.
Mistakes to avoid
- Only deleting the one bad file you found. There are usually more.
- Restoring a backup and leaving the old plugin. You will be hacked again.
- Keeping the old passwords. The attacker may already have them.
Summary table
| Step | Action |
|---|---|
| Contain | Maintenance mode + full backup |
| Credentials | Change all passwords + salts |
| Users | Remove unknown admins |
| Code | Reinstall core, plugins, themes cleanly |
| Backdoors | PHP in uploads, mu-plugins, theme files |
| Harden | Updates, 2FA, remove unused, firewall |
| Reputation | Google Search Console review |
Quick quiz: check what you learned
What is the most common way WordPress sites get hacked?
- Outdated or bad plugins
- Too many blog posts
- Using the default theme
- Having a contact form
Show answer
A. Vulnerable and nulled plugins are the top cause.
Where do PHP backdoors often hide?
- wp-content/uploads
- The robots.txt file
- Your CSS stylesheet
- The favicon image
Show answer
A. Uploads should hold media, not PHP files.
Why replace salts in wp-config.php?
- To log out every session
- To speed up the site
- To change the site theme
- To move to a new host
Show answer
A. New salts invalidate existing login cookies.
After cleaning, how do you clear the Google warning?
- Request a Search Console review
- Change the logo on every page
- Buy more ads on Google Search
- Rename the home page file
Show answer
A. Search Console lets you request a security review.
Learn it properly
These pages go deeper:
Frequently asked questions
How do I know my WordPress site is hacked?
Common signs: redirects to spam or scam sites, new admin users you did not create, Google "This site may be hacked" warnings, Japanese or pharma spam pages in search results, or your host suspending the site.
Should I just restore a backup?
A clean backup from before the hack is a great start, but you must also fix how the attacker got in (an old plugin, stolen password), or they come back.
How do attackers usually get in?
Most often through vulnerable or outdated plugins and themes, nulled (pirated) plugins, or weak or reused admin passwords.
Where do backdoors hide?
In PHP files inside wp-content/uploads, fake plugin folders, edited theme files like functions.php, mu-plugins, and sometimes in the database.
How do I remove the Google warning?
After cleaning, verify the site in Google Search Console, check the Security issues report, and request a review.
Do security plugins help?
Yes, for scanning and a firewall, but they do not replace updates, strong passwords, 2FA and backups.