How to Fix and Clean a Hacked WordPress Site (Step by Step)

A hacked WordPress site is a website that has been compromised by an attacker who gains unauthorized access, typically to inject malicious code, steal data, or use your server for spam distribution. This is not the same as a simple plugin conflict or a broken theme update, which cause visible errors but do not involve unauthorized access. If your site is redirecting to spam pages, showing unexpected admin users, or serving malware warnings in Google Search Console, you are dealing with a security breach that requires immediate, methodical action.

The most common cause of a WordPress hack is a vulnerability in a plugin, theme, or core file that was not updated, combined with weak user passwords. The quickest fix is to restore a clean backup from before the infection, but if you do not have one, you can manually clean the site by removing malicious files, resetting credentials, and scanning for backdoors. This article walks through 9 proven methods to fix a hacked WordPress site, ordered from the easiest to the most advanced, so you can get your site clean and secure again.

Before you start any cleanup, back up your site and database immediately. Even a hacked backup is useful because it preserves the environment you need to investigate. Use your hosting control panel or a plugin like UpdraftPlus to export everything. Then, take your site offline temporarily by enabling maintenance mode or adding a .maintenance file in your root directory. This prevents visitors and search engines from encountering malicious content while you work.

Common causes of a WordPress hack

Understanding how your site was compromised helps you close the specific vulnerability after cleanup. Below are the most frequent entry points attackers exploit.

Outdated plugins or themes — Attackers scan for known vulnerabilities in older versions (e.g., a vulnerable version of a contact form plugin).
Weak passwords — Admin or FTP passwords that are easy to guess or have been reused from other breaches.
Nulled themes or plugins — Pirated software often contains hidden backdoors installed by the attacker or the original cracker.
Unsecured admin area — No login attempt limit or two-factor authentication, allowing brute-force attacks.
Insecure hosting — Shared servers where another site on the same IP is compromised can allow cross-site contamination.
Compromised FTP/SSH credentials — If your file transfer protocol or shell credentials are stolen, the attacker can upload malicious files directly.
SQL injection — A vulnerability in a plugin or theme that allows an attacker to execute arbitrary SQL commands on your database.
Cross-site scripting (XSS) — Malicious scripts injected into your site through unescaped user input fields.

How to fix and clean a hacked WordPress site (9 proven methods)

The following steps progress from the simplest, least intrusive methods to the most thorough manual cleanup. Start with Method 1 if you have a clean backup, or skip to Method 4 if you do not.

Method 1: Restore from a clean backup

This is the fastest and most reliable fix, provided you have a backup taken before the infection. Most managed WordPress hosts offer one-click restore from their control panel. If you use a plugin like UpdraftPlus, navigate to Settings > UpdraftPlus Backups, select a clean backup, and click Restore.

After the restore, immediately update all plugins, themes, and WordPress core to patch the vulnerability that allowed the hack. Then change all passwords — admin, FTP, database, and hosting account — to strong, unique strings using a password manager.

Example: Using WP-CLI to restore a backup
wp db import backup.sql
wp core download --force
wp plugin update --all
wp theme update --all

Method 2: Use a security plugin to scan and remove malware

If you do not have a clean backup, a security plugin is the next best option. Install and activate a reputable plugin like Wordfence or Sucuri Security. Navigate to Wordfence > Scan and run a full scan. The plugin will flag suspicious files, modified core files, and known malware signatures. Wordfence can automatically delete many infected files and repair core files.

After the scan, review the results carefully. Some false positives occur, especially with custom code. If a file is flagged that you know is legitimate, you can mark it as ignored. But for anything you are unsure about, err on the side of deletion or quarantine.

Method 3: Reset all user passwords and keys

Attackers often create new admin accounts or compromise existing ones. Go to Users > All Users and delete any user accounts you do not recognize. For all remaining users, force a password reset by editing their profile and setting a new password. For the admin account specifically, use a password with at least 16 characters, including uppercase, lowercase, numbers, and symbols.

Next, update your WordPress secret keys. Open your wp-config.php file and replace the lines that define AUTHKEY, SECUREAUTHKEY, LOGGEDINKEY, NONCEKEY, and their corresponding salts with fresh values from the WordPress salt generator. This invalidates all existing login cookies, forcing every logged-in user to re-authenticate.

Example: Updated secret keys in wp-config.php
define('AUTHKEY',         'fresh-random-string-here');
define('SECUREAUTHKEY',  'another-random-string');
define('LOGGEDINKEY',    'yet-another-string');
define('NONCEKEY',        'and-one-more-string');

Method 4: Manually remove malicious files via FTP or cPanel File Manager

If a security plugin cannot clean everything, you need to inspect your file system directly. Connect to your server via FTP using FileZilla or your hosting file manager. Focus on these directories first: /wp-content/themes/, /wp-content/plugins/, and /wp-content/uploads/. Look for files with suspicious names like system.php, cmd.php, wp-resort.php, or files with timestamps that do not match your usual update patterns.

Check the .htaccess file in your root directory. Attackers often add redirect rules to malicious domains. Download the file and open it in a text editor. Look for lines containing RewriteRule that redirect to unknown domains. Replace the file with a fresh default from a clean WordPress installation or your hosting provider.

Method 5: Clean your WordPress database

Malware can hide in your database tables, particularly in wpoptions, wpposts, and wppostmeta. Use phpMyAdmin (found in your hosting control panel) to inspect these tables. Run the following SQL query to find suspicious options:

SELECT  FROM wpoptions WHERE optionname LIKE '%malware%' OR optionvalue LIKE '%eval%';

Delete any rows that contain malicious code. Be extremely careful — deleting the wrong row can break your site. If you are unsure, export a copy of the database first. A safer alternative is to use a plugin like WP-Optimize or Advanced Database Cleaner to remove transients and leftover plugin data that might harbour code.

Method 6: Reinstall WordPress core files

Attackers often modify core WordPress files to maintain access. Go to Dashboard > Updates and click Reinstall Now to replace all core files with fresh copies from WordPress.org. This does not affect your themes, plugins, or content, but it ensures that files like wp-includes, wp-admin, and root-level files are clean.

After reinstalling, immediately update to the latest WordPress version. Outdated core is a common attack vector.

Method 7: Remove backdoors in plugins and themes

Some backdoors are not obvious files — they hide inside legitimate plugin or theme files. Attackers insert a small snippet of code like eval(base64decode('...')); at the top of functions.php or wp-config.php. Open your active theme's functions.php file and any plugin's main PHP file. Search for the string base64decode, eval, pregreplace with /e modifier, or any gzinflate calls. These are rarely used in legitimate code.

If you find such code, remove it entirely. Then re-download the plugin or theme from the official repository and reinstall. This ensures the entire codebase is clean, not just patched.

Method 8: Secure your wp-config.php file

This file contains your database credentials and secret keys. If not already done, move it one directory level above your WordPress root (the /publichtml/ parent directory). WordPress looks for wp-config.php in the parent directory by default. This prevents direct access via the web.

Also add the following code to your .htaccess file to block direct access to wp-config.php:

<Files wp-config.php>
Order allow,deny
Deny from all
</Files>

Method 9: Audit user roles and capabilities

Even after cleaning files, an attacker may have elevated existing user accounts to Administrator or created hidden roles. Go to Users > All Users and check the role of each user. Any account that should not have Administrator privileges should be demoted to Subscriber or deleted. You can use a plugin like User Role Editor to inspect and modify custom roles that may have been injected.

For a thorough audit, query the database directly:

SELECT  FROM wpusermeta WHERE metakey = 'wpcapabilities';

Look for any role names that are not standard (Administrator, Editor, Author, Contributor, Subscriber). Delete any suspicious rows.

How to prevent your WordPress site from being hacked again

Cleaning the site is only half the work. The following measures dramatically reduce the chance of reinfection.

Keep everything updated — Enable automatic updates for WordPress core, and for plugins/themes where possible. Use a tool like WP-CLI or a managed host to automate this.
Use strong, unique passwords — Every user account, FTP account, and database user should have a password generated by a password manager. Enforce strong passwords with a plugin like WPS Hide Login or iThemes Security.
Limit login attempts — Install a plugin that limits the number of failed login attempts from a single IP address before temporary blocking. Wordfence includes this feature.
Disable file editing — Add define('DISALLOWFILEEDIT', true); to your wp-config.php to prevent attackers from editing plugin and theme files from the dashboard even if they gain admin access.
Use a Web Application Firewall (WAF) — Services like Cloudflare or Sucuri filter malicious traffic before it reaches your server, blocking SQL injection and XSS attempts.
Regular security scans — Schedule weekly scans with a security plugin and review the reports. Early detection prevents a minor issue from becoming a full compromise.

Frequently asked questions

How do I know if my WordPress site is hacked?

Common signs include unexpected redirects, spammy pop-ups, new admin users you did not create, your site being blacklisted by Google (you will see a warning in Search Console), and files with suspicious code that you did not add.

Can I clean a hacked WordPress site without a backup?

Yes, but it is more time-consuming. You can use a security plugin to scan and remove malware, manually delete malicious files via FTP, clean your database, and reset all passwords and keys. The manual methods described in Methods 4 through 8 of this article will work even without a backup, but you must be thorough to remove all backdoors.

What is the most common way WordPress sites get hacked?

Outdated plugins and themes are the leading cause, followed by weak or reused passwords. Attackers scan the internet for sites running known vulnerable software and then exploit those vulnerabilities. Keeping everything updated and using strong, unique passwords prevents the vast majority of attacks.

Should I pay a ransom if my site is held hostage?

No. Paying the ransom encourages the attacker and does not guarantee you will get your site back. In most cases, you can clean the site using the methods in this article or hire a reputable security professional. If you have a backup, restoring from it is the fastest option.

How long does it take to clean a hacked WordPress site?

If you have a clean backup, it can take as little as 30 minutes to restore and update everything. Manual cleanup can take several hours to a full day depending on the severity of the infection and your familiarity with the process. For complex hacks involving multiple backdoors, consider hiring a professional.

Final thoughts

A hacked WordPress site is stressful, but it is almost always recoverable. The key is to act methodically: isolate the site, investigate the entry point, clean every component (files, database, and users), and then harden your security to prevent a repeat. Start with the backup restore if you have one, and if not, work through the manual steps in order. Every minute you spend on prevention after the cleanup is an investment in your site's long-term health.

Once your site is stable and secure, you can focus on growth again. If you need to publish SEO-optimized content at scale without compromising security, nativeWP helps you bulk-generate and auto-publish articles directly to WordPress, freeing you to maintain the security and performance of your site.