Beginner’s Guide to Fixing Your Hacked WordPress Site

Your WordPress site is hacked. Visitors may see warnings, pages may redirect to spam, and your business could be losing traffic and sales with every passing minute.

The good news is that you can recover it. The key is to follow the right order: contain the breach, remove the malware, restore your site, and secure it against another attack.

We’ve helped hundreds of WordPress users recover hacked sites, and we’ve dealt with security issues on our own sites, too.

Today attackers are increasingly using AI to find and exploit newly patched WordPress plugin vulnerabilities, making fast action more important than ever.

In this guide, we’ll show you how to fix your hacked WordPress site step by step, even if you’ve never cleaned a hack before.

Quick answer: First contain the damage from outside WordPress, then either hire a cleanup service or wipe the server and rebuild from clean files.

Here is the full sequence, with each step explained below:

Step 1. Contain the Damage

Before you clean anything, stop the site from doing more harm to your visitors and your reputation.

Put your site behind a “coming soon” screen from outside WordPress. The easiest way is Cloudflare’s free Under Attack Mode, which challenges every visitor before they reach your site.

You can also use your host’s control panel maintenance mode, or temporarily point your DNS away.

Next, change your WordPress admin password and your hosting account password right away. If you can’t log in at all, see our guide on what to do when you are locked out of WordPress admin.

Then contact your hosting provider before deleting files, restoring a backup, or making other major changes to your site. Your hosting provider may be able to show you how the attacker got in and scan your site for malware.

Ask them two questions: “How do you think the attacker gained access to the site?” and “Do you have a recent clean backup?” The first can help you identify the vulnerability that needs fixing, while the second tells you whether you have a safe restore point if the site needs to be rolled back.

Finally, document everything. Take screenshots of the symptoms, and note the date, the time, and exactly what you see.

You’ll need this record for your host, for a security expert if you hire one, and to confirm the same symptom is gone after cleanup.

Step 2. Decide: Clean a Hacked Site Yourself or Hire a Security Expert?

There’s no wrong answer here.

Hiring a professional is the better choice if you’re not comfortable working in files and databases, or you want it done right the first time. Hackers hide backdoors, secret entry points that let them back in later, in places beginners rarely think to look.

A missed backdoor means the hack comes back.

For professional cleanup, Wordfence and MalCare both offer solid cleanup services. Another option we recommend is We Watch Your Website, which provides thorough WordPress security cleanup.

You can learn more in our guide on how to hire a WordPress security expert.

If you decide to clean it yourself, follow the rest of this guide.

Step 3. Find Where the Malware Is Hiding

Start with a free remote malware scan to quickly identify files or code that may need closer inspection. We recommend the free Wordfence plugin for this, but treat the scanner as an assistant, not a verdict.

Then check these common places where WordPress malware can hide:

• Fake files that imitate WordPress core. A stray wp-something.php in a folder where it doesn’t belong, or a second copy of wp-load.php.
• PHP files inside /wp-content/uploads/. The uploads folder is normally used for images, documents, and other media, so PHP files in this directory deserve immediate attention.
• Unknown must-use plugins in /wp-content/mu-plugins/. These plugins load automatically with WordPress and don’t appear on the regular Plugins page, which makes them an attractive place for attackers to hide malicious code.
• Recently modified files. Open your host’s file manager and sort by the last modified date. Pay particular attention to files that were changed around the time the problem started, especially if you did not make those changes yourself.
• Malicious code in the database. Injected rows can cause redirects, spam pages, and repeated infections even after the files are clean.
• A tampered .htaccess file. Look for redirect rules you didn’t add.
• Unknown admin or FTP users. Delete any account you don’t recognize. An unfamiliar account could give an attacker another way to access your site after you clean the files.
• Utility plugins you didn’t install. Plugins like WPCode, Code Snippets, or File Manager are safe on their own, but hackers sometimes install them to inject code. If a plugin appeared without you installing it, that is a red flag.
• Suspicious scheduled tasks. Hackers use WordPress cron jobs to reinfect a site on a timer.
• Your CDN account. Many sites store their CDN API keys inside WordPress. A hacker can use those keys to change files at the CDN level and add card skimmers or other malicious code, so check your CDN dashboard for changes you didn’t make.

For a deeper look at the most common hiding spot, see our guide on how to find a backdoor in WordPress and fix it.

Step 4. Back Up the Hacked Site First

Before you start deleting files or making other changes, create a complete backup of the hacked site, including both its files and database.

This may seem counterintuitive, but this backup gives you a snapshot of the site before cleanup begins. If something goes wrong during the process, you can refer back to it to identify what changed. It can also provide useful evidence for your hosting provider, security expert, or insurance company if you need to document the incident.

Label this backup clearly as the infected copy and keep it separate from any clean backup you plan to restore. You should not use it to put the site back online.

Taking this extra step gives you a safety net before you start removing malware.

Step 5. Clean the Malware: Wipe Everything and Rebuild Clean

The only reliable clean is a full wipe. Delete everything off the server, meaning all WordPress files and anything else in the hosting account, then rebuild from known-clean sources.

A WordPress-only reinstall is not enough. Most people install WordPress in the main folder of their hosting account, but backdoors often live outside it entirely, elsewhere in the account, in the web root, or in a cron job.

If you reinstall WordPress and leave the rest of the server untouched, that backdoor reinfects your fresh install.

Rebuild the clean way:

• Download fresh WordPress core files from WordPress.org.
• Download fresh copies of your plugins and theme from their official sources. Never reuse the old files.
• Create a fresh wp-config.php from scratch.

Only after the full wipe should you restore from a backup, and only one you are certain predates the hack. Even then, restore just your content and database, not the old executable files.

See our tutorial on how to restore WordPress from backup for the details.

Bring your content back carefully. Re-add uploads and media only after checking them for stray PHP files, and manually clean any injected rows if you’re restoring the database.

A security plugin’s auto-clean feature can help, and it removes known WordPress-layer infections well. But it may not catch a server-level backdoor sitting outside WordPress, which is why the wipe-and-rebuild is the safe default.

Don’t run a scanner and call it done.

Step 6. Reset All Passwords, Keys, and API Tokens

Yes, you changed your passwords in Step 1. Now that the site is clean, do it again, and go wider, because the hacker may have watched everything you typed while the site was still infected.

Reset every password: WordPress admin accounts, hosting, FTP or SFTP, the database, and any email account connected to the site. Use a password manager so every one of them is strong and unique.

Our guide on the best way to manage passwords can help. If your site has many users, you can force a password reset for all of them.

Next, regenerate your WordPress secret keys. These keys, also called salts, live in wp-config.php and secure the login cookies.

Resetting them logs out anyone still holding a hijacked cookie, even after the passwords change. Generate a new set of keys and paste them into your wp-config.php, and our article on WordPress security keys explains where they live.

Finally, rotate every API key and token the site uses. This ensures that any credentials the attacker may have accessed can no longer be used to connect to your services.

Step 7. Remove the “This Site May Be Hacked” Warnings

Your site is clean, but Google may still be warning people away from it. That warning doesn’t disappear on its own quickly, so you need to ask for a review.

Open Google Search Console and go to the Security Issues report. Once you fix every flagged issue, select the issues and click the Request Review button.

Describe what was wrong and what you did to fix it. Reviews usually take a few days, and sometimes longer.

While you wait, check your site on Google Safe Browsing to see its current status, and keep the site online and clean. Repeated review requests with an infected site slow the process down.

Step 8. Harden WordPress So It Never Happens Again

Now take a few extra steps to prevent the hacker from getting back into your site. Do these in order, starting with the measures that block some of the most common ways attackers regain access.

1. Disable the built-in file editor. Add this line to your wp-config.php:

define('DISALLOW_FILE_EDIT', true);

This prevents anyone with access to the WordPress dashboard from editing theme and plugin files directly. That adds an important layer of protection if an administrator account is ever compromised.

You can also follow our guide on how to disable theme and plugin editors in WordPress.

2. Stop PHP from running in your uploads folder. Even if a hacker sneaks a malicious .php file into /wp-content/uploads/, this rule makes the server refuse to run it.

On Apache, add this to a new .htaccess file inside the uploads folder:

<Files *.php>
deny from all
</Files>

On Nginx, ask your host to add the matching location rule. Our tutorial on how to disable PHP execution in certain WordPress directories walks you through it.

3. Remove plugin installs from the dashboard entirely. This is the advanced control we use on our own sites.

If your changes go through a deployment pipeline like Git, you don’t need to install plugins from wp-admin at all. Lock it off by adding define('DISALLOW_FILE_MODS', true); to wp-config.php and push all code changes through the pipeline.

Then finish the list:

• Set up automated, off-site backups with a plugin like Duplicator. If you had a clean backup in Step 5, the rebuild took minutes instead of days, so set this up today. Here is how to back up your WordPress site.
• Install a firewall or security plugin with ongoing malware scanning.
• Turn on strong passwords and two-factor authentication for every account.
• Limit login attempts and protect your wp-admin area.
• Set correct file and folder permissions.
• Update WordPress core, plugins, and themes in the proper update order, and delete anything you’re not using.
• Only run plugins and themes from trusted sources. Never use nulled or pirated versions, because they often come with malware hidden inside.

Frequently Asked Questions

How do I know if my WordPress site was hacked?

The common signs are a browser or Google warning on your site, your site redirecting visitors to strange websites, spam links or pages you didn’t create, admin users you don’t recognize, a sudden traffic drop, or your host suspending the account.

How do I wipe my WordPress site clean?

Back up the infected site first, then delete everything in the hosting account, not just the WordPress folder. Rebuild with fresh WordPress core, plugin, and theme files from official sources plus a new wp-config.php, and restore only content from a backup that predates the hack.

Does Wordfence remove malware?

The free Wordfence plugin scans for malware and can repair changed core files, and the paid service includes hands-on cleanup. Like every scanner, it works at the WordPress layer, so a backdoor elsewhere on the server can survive it, and that is why we still recommend a full wipe for serious infections.

We hope this guide helped you fix your hacked WordPress site and lock it down for good. To keep building on this, see our complete WordPress security guide, or if the cleanup feels like too much, here’s our tips on hiring a WordPress security expert.