If a WordPress site is hacked, do not start deleting random files. First contain it, keep evidence and work out how to restore a clean copy.
Redirects and spam pages are obvious signs. Unknown admin users, changed plugins or odd server activity can be harder to spot.
If the site holds customer data, treat it as a real security incident.
Common signs of compromise
Watch for:
- unknown administrator accounts
- spam pages in Google
- redirects to unrelated websites
- injected JavaScript
- security warnings
- unknown plugins
- modified PHP files
- unexpected emails
- high CPU usage
- disabled security tools
1. Do not destroy the only evidence
Before deleting everything, make a copy of the current state if it is safe to do so.
Logs, files and database records can help identify how the compromise happened.
2. Contain the site
Depending on severity, consider:
- maintenance mode
- restricting access
- disabling compromised accounts
- blocking malicious traffic
- temporarily isolating the site
Do not expose customers to known malicious redirects or downloads.
3. Take a backup
Even an infected backup can be valuable for forensic comparison.
Keep it separate from clean backups.
4. Change critical credentials
Prioritise:
- WordPress administrators
- hosting panel
- SFTP/SSH
- database credentials where appropriate
- email accounts
- API keys
- CDN/DNS accounts
Do this from a clean device.
5. Find the entry point
Cleaning malware without fixing the entry point often leads to reinfection.
Possible causes include:
- vulnerable plugins
- vulnerable themes
- stolen credentials
- outdated WordPress Core
- insecure hosting
- exposed admin tools
6. Clean files and database
Compare WordPress Core against clean copies.
Inspect:
- plugins
- themes
- uploads
- mu-plugins
- wp-config.php
- database options
- scheduled tasks
- users
Do not assume malware exists only in one suspicious file.
7. Update software
Once the site is in a controlled state, update:
- WordPress Core
- plugins
- themes
- PHP where appropriate
Remove abandoned or unnecessary components.
8. Review administrator accounts
Delete unauthorised users and reset credentials for legitimate administrators.
Check email addresses, roles and account creation dates.
9. Restore service carefully
Before reopening:
- test forms
- scan again
- check redirects
- inspect front-end source
- verify scheduled jobs
- check logs
- confirm backups
10. Monitor after cleanup
Successful cleanup is not the end.
Watch the website closely for:
- recreated files
- new users
- outbound traffic
- new spam pages
- repeated malicious requests
Should you restore an old backup?
Sometimes, but only if you know it is clean and you also fix the original vulnerability.
Restoring a backup without patching the entry point can simply reset the clock until the next compromise.
Need WordPress malware removal?
SiteForge provides malware cleanup, security hardening and recovery work for WordPress websites.
View WordPress Malware Removal.
What not to do after a WordPress hack
Do not install several security plugins and hope the problem disappears
A scanner can help identify suspicious files, but a compromised site may contain persistence mechanisms that need manual investigation.
Do not delete all logs
Access, PHP, web-server and authentication logs can contain useful evidence about the incident.
Do not reuse the same passwords
If credentials may have been exposed, create new unique passwords and enable two-factor authentication where available.
Do not assume one cleaned file means the site is safe
Attackers often place multiple backdoors or create administrator accounts for persistence.
After recovery: harden the site
Once the infection is removed:
- remove unused plugins and themes
- update WordPress
- update plugins
- use strong unique passwords
- enable 2FA
- review file permissions
- protect backups
- monitor changes
- keep hosting software current
Frequently Asked Questions
Can I just restore yesterday's backup?
Only if you know the backup predates the compromise and you also patch the entry point. Otherwise the restored site may still be vulnerable.
Does changing the WordPress password remove malware?
No. Password rotation is important, but malicious files or database injections remain until they are cleaned.
Should I delete the website and reinstall WordPress?
Sometimes a clean rebuild is the safest path, but content, uploads, database records and configuration still need careful handling.
Can a hacked website affect SEO?
Yes. Spam pages, redirects, downtime and security warnings can damage visibility and user trust. Search Console should be checked after recovery.
