WordPress Hacked Site Recovery Guide (Complete)

This guide walks the whole recovery lifecycle for a compromised WordPress site, from first suspicion to long-term prevention. It is written for site owners and developers who want to understand each stage, not just follow a list. Each section links to a deeper guide where there is one.

How a recovery is organised

A WordPress recovery has two goals that pull in different directions. You want the damage to stop quickly, and you want to understand the compromise well enough that the cleanup is complete. The sequence below resolves that tension: contain first, preserve evidence, investigate, clean, then verify and harden.

If you're mid-incident and need a short list, use the WordPress Hacked Site Emergency Checklist. If you want to know what to decide in the first hours, read What to Do Immediately After Discovering a WordPress Hack. Everything here assumes a self-hosted WordPress site.

1. Detect the compromise

Detection comes from three places: visitors and customers, search engines and browsers, and your own checks. Typical signals are redirects, spam in search results, browser or Google warnings, a host notice, unknown administrators and unexplained file changes. How to Tell if Your WordPress Site Has Been Hacked lists them in detail and shows how to separate a compromise from an ordinary fault.

Two points matter at this stage. First, absence of symptoms doesn't mean a clean site: much malware is conditional or cloaked and shows only to some visitors or to search crawlers. Second, write down what you see, with dates and the devices involved. You will use the same conditions to verify the cleanup.

2. Contain the damage

Decide whether the site is currently harming anyone. If it redirects visitors to scams, serves malicious downloads, sends spam email or exposes customer data, take it offline or into maintenance mode while you work. A short outage is cheaper than being flagged by browsers and losing customer trust.

Containment also means cutting off the attacker's current access. From a computer you trust, change the passwords for WordPress administrators, the hosting control panel, SFTP/SSH, the database and related email accounts. If your own device might be infected, don't do this from it. Replacing the salts in wp-config.php ends all existing login sessions.

3. Preserve evidence: backups and snapshots

Before you delete or change anything, take a full copy of the files and a database export, and ask your host for a snapshot if they offer one. Keep it untouched. It serves three purposes: evidence of how the attacker got in, a fallback if the cleanup breaks something, and a reference for comparing against clean copies.

Also ask the host for access and error logs for the past several weeks. Logs are often kept for a short time only. Where they show the first suspicious request, they usually reveal the entry point.

Don't restore an old backup as a shortcut. It may contain the same backdoor, and it returns the site to the vulnerable state that was exploited. See Why Restoring a Backup May Not Fix a Hacked WordPress Site.

4. Notify the right people

Hosting provider. They may already have flagged or suspended the site, and they hold the logs. See WordPress Website Suspended for Malware: Recovery Guide.
Agency, developer or maintenance provider who manages the site.
Legal or data-protection contact. If personal data or payments may be affected, data-protection law, including the Swiss revFADP and the GDPR, can require breach notification, sometimes within tight deadlines. Decide early who handles it.
Customers or users, if their data or accounts are involved.

5. Review accounts and credential compromise

Accounts are both a cause and a persistence mechanism. Review every administrator and privileged user. Note, before removing, any account you don't recognise: username, email, role and registration date. Some malware hides users from the dashboard, so compare the Users screen with the database table directly.

wp user list --role=administrator --fields=ID,user_login,user_email,user_registered

Credential compromise goes beyond WordPress. If the attacker obtained the hosting, SFTP, SSH or database credentials, they can return even after the site is clean. Plan a full rotation, and do it after the cleanup so the new credentials aren't captured by leftover malware. Unknown Admin User in WordPress: What to Do covers suspicious administrators in depth, and Hacked wp-config.php: What Site Owners Should Check covers the secrets stored in wp-config.php.

6. Check WordPress core

WordPress core files should be identical to the official release for the installed version. WP-CLI can compare them:

wp core verify-checksums

Files reported as modified or unexpected deserve scrutiny. Don't hand-edit core files; reinstall core from a clean source. Note that checksum verification covers the official files only. It says nothing about extra files you've added or about the database.

7. Check plugins and themes

Plugins and themes are the most common way in. Make a list of everything installed, including inactive items, and for each ask:

Is it still used? If not, delete it.
Is it up to date, and does it have known vulnerabilities in the installed version?
Is it abandoned, with no updates for a long time?
Did it come from an official source? Pirated "nulled" software often carries built-in malware.
Do its files match the published version?

wp plugin verify-checksums --all

Replace modified plugin and theme files with clean copies from the official source, then update. If the compromised component can't be fixed because it's abandoned, replace it.

8. Look for malicious files

Malicious files tend to live where legitimate PHP shouldn't be or where nobody looks:

wp-content/uploads should contain media, not PHP.
wp-content/mu-plugins and drop-in files load without activation.
Theme files such as functions.php, header.php and footer.php.
The site root and the folders above it, including old backups and test files.
.htaccess and PHP configuration files that change server behaviour.

find wp-content/uploads -type f -name "*.php"
find . -type f -name "*.php" -mtime -14

Recently modified files are leads, not verdicts. Updates and normal use modify files too. Search for typical malware traits, such as long encoded strings, code that decodes and runs itself, and file names imitating core files, but treat pattern searches as hints because they produce false positives and miss obfuscated code.

9. Look at the database

A file-only cleanup leaves the database untouched. Check for:

Script tags and unfamiliar domains in posts, widgets and options.
Spam posts and pages that don't appear in your normal content.
Changed siteurl and home options.
Unexpected options and serialised data with code-like content.

wp option get siteurl
wp option get home

Spam content removed from the database but left generated by code in the files simply returns. Remove the generator first. See Casino and Pharmacy Spam on WordPress: Cleanup Guide for the spam variants.

10. Find persistence: malware types and backdoors

This stage decides whether the cleanup lasts. Malware comes in functional types: redirect code, SEO spam generators, credential stealers and payment skimmers, mailers that send spam, and backdoors that let the attacker back in. The first four are the payload; the last is persistence.

Persistence lives in files, modified plugins and themes, must-use plugins, rogue administrators, scheduled tasks, database content, server configuration and stolen credentials. A cleanup that misses one can be undone by it. The categories are explained in WordPress Backdoors: How Reinfection Happens, and the service side is described on WordPress backdoor removal. If the problem keeps coming back after a cleanup, read WordPress Malware Keeps Coming Back: Why Reinfections Happen.

11. Review scheduled tasks

WordPress cron runs tasks on a schedule, and malware uses it to reinstall itself. List what is scheduled and question anything you can't attribute to a plugin you know:

wp cron event list

Also check the server's own scheduled jobs through your hosting panel if it exposes them.

12. Check server-level issues

Sometimes the compromise isn't confined to WordPress. Signs: other sites in the same hosting account are infected, the malware reappears even after clean files are restored, or files are owned by an unexpected user. Check every site in the account, the account's PHP configuration, and the host's own scan results. Shared accounts with many sites should be cleaned together, and ideally separated afterwards. When the host account itself was breached, work with the host.

13. Clean up in the right order

Work on the preserved copy or a staging environment where possible.
Replace core, plugins and themes with clean copies and delete unused ones.
Remove malicious files you identified in uploads, mu-plugins and elsewhere.
Clean the database content.
Remove rogue users and application passwords.
Remove malicious scheduled tasks.
Close the entry point: update, replace or remove the vulnerable component.
Rotate credentials and salts.

The WordPress Malware Cleanup Checklist turns this into a tickable checklist for the person doing the work.

14. Validate the cleanup

Don't assume it worked. Re-test the original symptoms under the same conditions that triggered them: mobile, search-referred and first-time visits for redirects, and Google's view of the page for spam. Re-run core and plugin integrity checks, look for PHP in uploads and re-check users and cron. Take a fresh backup of the clean site. Watch logs for a few days: persistent access attempts to files that no longer exist are normal, but successful requests to unknown files are not.

15. Harden the site

Hardening reduces the chance of a repeat and limits what an attacker can do. Priorities: update and prune components, minimise administrators and require two-factor authentication, limit login attempts, disable the dashboard file editor, block PHP execution in uploads where possible, set restrictive file permissions, use HTTPS and verify backups. How to Secure WordPress After Malware Removal gives the sequence, and WordPress Security Checklist for Small Businesses is a business baseline. If you want it done for you, see WordPress security hardening.

16. Recover search and browser standing

If the compromise got the site flagged or spam indexed, recovery has its own steps, and they come after the cleanup.

Spam in Google: return 404/410 for spam URLs, fix sitemaps, check Search Console ownership and use the Removals tool where needed. See How to Remove Spam Pages From Google After a WordPress Hack.
Browser or Google warnings: once the site is clean, request a review. See flagged and blacklisted sites.
Host suspension: provide the host with what you found and fixed. See WordPress Website Suspended for Malware: Recovery Guide.

Reviews take time and nobody controls the timing. A review request on a still-infected site is rejected, so clean first.

17. Monitor and prevent reinfection

Most reinfections show within days or weeks. Keep watching: alerts for new administrators and changed files, Search Console's Security issues report, the original symptom conditions weekly for a month, and your host's notices. Then make the habits permanent: someone owns updates, backups are tested, and accounts are reviewed regularly. Ongoing WordPress security covers update oversight, regular security checks and backup verification from $79/month if you'd rather not carry that yourself.

18. When to bring in a specialist

You can do much of this yourself. Consider help when:

The site is business-critical, or handles payments or personal data.
The infection keeps returning after cleanup.
You can't identify the entry point.
Multiple sites in one hosting account are affected.
You don't have the time to do it carefully.

WordPress malware removal follows exactly the process above, from $199, and hacked-site recovery describes how an engagement runs. No cleanup is a guarantee, and anyone who promises one is overselling. A good one tells you what was found, what was fixed and what remains outside the site's control.

The Complete WordPress Hacked Site Recovery Guide