Discovering that your business website has been compromised is a sinking feeling for any owner. For small and medium businesses relying on their digital presence to generate enquiries and sales, a hacked WordPress site means immediate lost revenue, damaged trust with clients, and a warning screen from Google that scares visitors away. When malicious actors inject malware, redirect your traffic to spam sites, or deface your homepage, you need a calm, methodical, and authoritative approach to restore order.
At WP Pro, we see the aftermath of website compromises regularly. Many business owners panic and start deleting files at random, which often makes the situation worse or completely breaks the site. Cleaning a hacked WordPress site requires precision, patience, and a thorough step-by-step recovery process. This guide outlines exactly how to diagnose the breach, remove the malicious code, lock down your vulnerabilities, and secure your site against future attacks so your business can get back to business.
Step 1: Assess the Damage and Put Your Site in Maintenance Mode
Before you touch a single file, you need to understand the scope of the infection. Is your entire dashboard locked out, or can you still log in? Are your search engine results displaying Japanese spam or pharmaceutical ads? Knowing how the hackers gained entry and what they altered is critical for a complete cleanup.
If you still have access to your WordPress dashboard, immediately place your site into maintenance mode using a reputable security plugin or a temporary landing page. This stops visitors and potential customers from encountering malicious payloads or broken layouts while you work. If you are locked out completely, you will need to access your website files directly via your hosting provider’s cPanel, Plesk, or an SFTP client.
Step 2: Backup Your Current Infected State (For Forensic Analysis)
It sounds counterintuitive, but your very next step should be to create a complete backup of your current, hacked website files and database. Why? Because if you accidentally break something during the manual cleanup process, you need a fallback to review original files or check what the hackers changed.
Download a zipped copy of your public_html directory and export your MySQL database via phpMyAdmin. Store these files securely in a dedicated folder on your local computer, and clearly label them as infected so you do not accidentally restore them later. Once this forensic snapshot is safely stored away, you are ready to begin the deep clean.
Step 3: Completely Wipe Core WordPress Files and Reinstall
The vast majority of WordPress hacks rely on modifying core files—such as index.php, wp-activate.php, or wp-load.php—to inject malicious redirect scripts or backdoors. Trying to manually find and delete every single line of injected code in core files is tedious and prone to human error.
The safest and most efficient method is to delete all core WordPress files and directories via your file manager or SFTP, leaving only the wp-content folder and your wp-config.php file untouched. Then, download a fresh, clean copy of the latest version of WordPress directly from the official source. Upload these fresh core files to your server. This instantly replaces any compromised core infrastructure with pristine, secure code.
Step 4: Audit Your Plugins, Themes, and Media Uploads
Once your core files are clean, your attention must turn to the wp-content directory, which houses your themes, plugins, and uploaded media. This is where hackers love to hide persistent backdoors that allow them to regain access even after you have changed your passwords.
Review every single installed plugin and theme. Delete any plugins or themes that are inactive, outdated, or downloaded from untrusted third-party marketplaces. For active plugins and themes, delete them entirely and reinstall the fresh, official versions from the WordPress repository or developer dashboard. Next, inspect your wp-content/uploads folder. Hackers often disguise PHP scripts as image files (e.g., image.php.jpg). Look for any executable file types hidden inside your media library and remove them immediately.
Step 5: Clean and Sanitize Your MySQL Database
Injecting code into files is only half the battle; hackers also love to hide malicious scripts, admin user accounts, and spam content directly inside your MySQL database. If you clean the files but leave the database infected, your site will simply get re-infected the moment it loads.
Log into phpMyAdmin via your hosting control panel. Look through the wp_users table to check for any unauthorized administrator accounts that you did not create, and delete them. Next, inspect the wp_posts and wp_options tables for suspicious serialized strings, injected JavaScript, or spam links. Running a reputable database scanner or utilizing a security plugin’s database repair tool can help surface these hidden database payloads.
Step 6: Reset All Passwords and Secure Authentication Points
With your files and database thoroughly cleaned, it is time to cut off the hacker’s access points. If they entered through a compromised password, they will simply log right back in unless you change every single credential associated with your hosting and website environment.
Reset the passwords for every WordPress user, especially administrators and editors. Crucially, you must also change your database passwords, update your FTP/SFTP login details, and reset your web hosting control panel password. To prevent future unauthorized logins, implement two-factor authentication (2FA) for all administrative accounts and consider changing your default wp-admin login URL to something unique.
Frequently Asked Questions
How did my WordPress site get hacked in the first place?
Most WordPress hacks happen due to vulnerabilities in outdated plugins, themes, or core software. Other common entry points include weak administrator passwords, compromised hosting environments, or reusing passwords across multiple external services.
Will Google penalise my site because it was hacked?
Yes, if Google detects malware or spam injections on your site, it will display a warning to users (
