How to clean up a WordPress hack

How to Clean Up a WordPress Hack

If your WordPress website has been hacked or compromised, the first priority is to contain the issue and prevent further damage. The following steps can help you clean up a compromised WordPress installation and secure the site.

Important: If the site contains sensitive information, handles payments, or the compromise appears extensive, we recommend contacting a qualified WordPress security professional before making changes.

1. Take a Backup

Before making any changes, create a complete backup of the website, including:

  • WordPress files
  • Themes and plugins
  • Uploads
  • Database
  • Configuration files

Keep the backup separate from the website. Do not overwrite your only backup with the cleaned files.

Note: A backup taken after the site was compromised may contain malicious files. Keep it for reference, but do not assume it is safe to restore.

2. Put the Site in Maintenance Mode

If possible, temporarily take the website offline or place it in maintenance mode while you investigate the compromise.

This can help prevent visitors from interacting with malicious code while the site is being cleaned.

3. Change Your Passwords

Change the passwords for all accounts that may have been affected, including:

  • WordPress administrator accounts
  • Hosting control panel accounts
  • FTP/SFTP accounts
  • Database users
  • Email accounts associated with the website

Use unique, strong passwords for each account.

If you suspect an administrator account has been compromised, review the list of WordPress users and remove any accounts that you do not recognize.

4. Update WordPress, Plugins, and Themes

Make sure WordPress, all installed plugins, and all active themes are fully up to date.

Remove:

  • Unused plugins
  • Unused themes
  • Plugins or themes obtained from unofficial sources
  • Software that is no longer maintained

Important: Do not install “nulled,” pirated, or modified versions of WordPress themes or plugins. These are a common source of malware.

5. Look for Unauthorized Files and Changes

Review the website files for suspicious or recently modified files.

Pay particular attention to:

  • PHP files in the wp-content/uploads directory
  • Unexpected PHP files in plugin or theme directories
  • Modified .htaccess files
  • Modified wp-config.php
  • Unexpected files in the WordPress root directory
  • Recently modified WordPress core files

Common signs of malicious code include unfamiliar PHP files, obfuscated code, unexpected redirects, hidden administrator accounts, and code that references unfamiliar external websites.

Do not delete files simply because they are unfamiliar. Some WordPress plugins and themes legitimately contain files that may not be immediately recognizable.

6. Check WordPress Administrator Accounts

In the WordPress dashboard, go to Users and review all administrator accounts.

Remove any administrator accounts that you do not recognize.

For legitimate administrator accounts, reset the passwords and make sure each account belongs to someone who should have administrative access.

7. Check the Database

A compromised WordPress site may contain malicious content in the database even after infected files have been removed.

Review the database for:

  • Unknown administrator accounts
  • Unexpected changes to site settings
  • Malicious JavaScript or HTML
  • Suspicious URLs
  • Unexpected redirects
  • Modified posts or pages

If you are not comfortable working directly with the WordPress database, we recommend having a qualified WordPress professional perform this step.

8. Replace WordPress Core Files

If you believe the WordPress core files have been modified, replace them with a clean copy of the same WordPress version.

Do not overwrite:

  • wp-content
  • wp-config.php

unless you have specifically determined that those files need to be replaced.

The safest approach is to obtain WordPress from the official WordPress.org source rather than copying files from another website.

9. Scan the Website

After removing suspicious files and accounts, scan the website using a reputable WordPress security scanner.

A scan can help identify:

  • Malware
  • Modified core files
  • Suspicious plugins and themes
  • Malicious scripts
  • Known vulnerabilities

A security scan should be considered an additional verification step, not a guarantee that the website is clean.

10. Clear Caches

After cleaning the website, clear any applicable caches, including:

  • WordPress caching plugins
  • Server-side caches
  • CDN caches
  • Browser caches

This helps ensure that visitors receive the cleaned version of the website.

11. Review Website Activity

After the cleanup, monitor the website for signs that the compromise has returned.

Watch for:

  • Unexpected administrator accounts
  • New or modified files
  • Unauthorized redirects
  • Spam being sent from the website
  • Unexpected changes to website content
  • Security warnings from search engines or browsers

If malicious files continue to reappear, there may still be an unauthorized account, vulnerable plugin, compromised hosting account, or other persistence mechanism that needs to be identified.

12. Secure the Website

Once the site has been cleaned:

  • Keep WordPress updated.
  • Keep plugins and themes updated.
  • Remove software you no longer use.
  • Use strong, unique passwords.
  • Enable two-factor authentication where available.
  • Limit administrator access to users who need it.
  • Use SFTP instead of FTP when available.
  • Maintain regular off-site backups.
  • Consider using a reputable WordPress security plugin or web application firewall.

If You Need Help

Cleaning a compromised WordPress website can be difficult, particularly when the infection involves multiple files, the database, or hosting credentials.

If you are unable to determine how the site was compromised or malicious files continue to return after cleanup, we recommend contacting a qualified WordPress security professional.

Important: Simply removing the visible malware does not necessarily resolve the underlying security issue. The vulnerability or compromised account that allowed the attacker to gain access must also be identified and addressed.