A hacked WordPress site can damage your reputation, harm your SEO rankings, and put your users at risk. The good news: most hacks are fixable if you act quickly and follow a structured process.
This guide walks you through exactly how to identify, clean, and secure your site in 2026—whether you're a beginner or an experienced site owner.
Step 1: Stay Calm and Confirm the Hack
Not every issue is a hack. First, verify what’s actually happening.
Common signs of a hacked WordPress site:
- Unexpected redirects (e.g., to spam or malicious sites)
- Google warning: “This site may be hacked”
- New admin users you didn’t create
- Strange content (spam posts, links, or ads)
- Hosting provider suspends your account
- Sudden drop in traffic or SEO rankings
- Files modified recently without your knowledge
Quick checks:
- Visit your site in incognito mode
- Check Google Search Console for security issues
- Scan your site using an online malware scanner
If you confirm suspicious activity, move quickly.
Step 2: Put Your Site in Maintenance Mode
Before fixing anything, prevent further damage.
Do this immediately:
- Take your site offline (maintenance mode plugin or hosting panel)
- Notify your hosting provider
- Inform your team (if applicable)
This prevents visitors from being exposed to malware and stops hackers from continuing activity.
Step 3: Change ALL Passwords
Assume every credential is compromised.
Update:
- WordPress admin passwords
- Hosting account
- FTP/SFTP credentials
- Database password
- Email accounts linked to the site
Best practices:
- Use long, unique passwords (password manager recommended)
- Enable 2FA (Two-Factor Authentication) wherever possible
Step 4: Backup Your Current Site (Even If It’s Hacked)
This might sound counterintuitive, but it’s important.
Why:
- You may need files later for investigation
- You can compare clean vs infected versions
Download:
- All WordPress files
- Database export
Step 5: Scan and Identify Malware
Now you need to locate the malicious code.
Tools you can use:
- Security plugins (WordPress-based)
- Server-side malware scanners
- Online scanners
Look for:
- Suspicious PHP files
- Obfuscated code (e.g., base64, eval)
- Recently modified files
- Unknown plugins/themes
- Hidden admin users
Step 6: Remove Malicious Code and Files
This is the most critical step.
Manual cleaning approach:
- Delete all WordPress core files (except
wp-config.phpandwp-content) - Reinstall fresh WordPress core files
- Replace all plugins and themes with clean versions
- Remove unused plugins/themes entirely
- Inspect
wp-content/uploadsfor hidden PHP files (should NOT be there)
Database cleaning:
- Remove spam posts/pages
- Delete suspicious users
- Check
wp_optionsfor injected scripts - Look for suspicious cron jobs
If you're unsure, use a professional malware removal service.
Step 7: Restore from a Clean Backup (If Available)
If you have a backup from before the hack, this can save time.
Important:
- Make sure the backup is truly clean
- Still update all plugins/themes afterward
- Change passwords even after restoring
Step 8: Check for Backdoors
Hackers often leave hidden access points.
Common backdoor locations:
wp-content/uploadswp-includes- Randomly named PHP files
What to look for:
- Files with strange names (e.g.,
x.php,wp-log1n.php) - Code using
eval(),exec(),base64_decode()
Remove anything suspicious.
Step 9: Fix SEO Spam and Blacklisting
If your site was used for spam, clean it up.
Actions:
- Remove spam pages and links
- Check Google Search Console → Security Issues
- Request a review after cleanup
Also check:
- Your sitemap
- Indexed pages in Google (
site:yourdomain.com)
Step 10: Harden Your WordPress Security
Now that your site is clean, prevent future attacks.
Essential hardening steps:
1. Update everything
- WordPress core
- Plugins
- Themes
2. Install a security plugin
Look for features like:
- Firewall
- Malware scanning
- Login protection
3. Enable 2FA
Especially for admin users.
4. Limit login attempts
Prevent brute-force attacks.
5. Disable file editing
Add this to wp-config.php:
define('DISALLOW_FILE_EDIT', true);
6. Change login URL
Avoid using default /wp-admin or /wp-login.php
7. Set proper file permissions
- Files: 644
- Directories: 755
8. Use HTTPS
Install an SSL certificate if not already enabled.
Step 11: Identify How the Hack Happened
If you don’t fix the root cause, it can happen again.
Common causes:
- Outdated plugins/themes
- Weak passwords
- Nulled (pirated) themes/plugins
- Poor hosting security
- Lack of firewall
Check logs:
- Server access logs
- Error logs
- Login attempts
Step 12: Monitor Your Site Going Forward
Security is ongoing—not a one-time fix.
Set up:
- Real-time monitoring
- Automated backups (daily)
- Uptime alerts
- Security scans
Optional: When to Hire a Professional
Consider expert help if:
- You’re not comfortable editing files or databases
- The infection keeps coming back
- Your site handles sensitive data (eCommerce, memberships)
- You’ve been blacklisted by search engines
Final Checklist
Before going live again:
- All malware removed
- Passwords reset
- Core/plugins/themes updated
- Backdoors eliminated
- Security measures in place
- Google review requested (if needed)
Final Thoughts
A hacked WordPress site is stressful—but fixable. The key is acting quickly, cleaning thoroughly, and strengthening your defenses so it doesn’t happen again.