WordPress site hacked? How to clean it up and stop it happening again

Where hacks come from

Patchstack’s 2026 security report counted 11,334 new vulnerabilities across the WordPress ecosystem in 2025, an increase of 42% on the year before. Some 91% were in plugins, and only a handful were in WordPress itself. A growing share of attacks also arrive through trusted plugins that were sold on or taken over and then updated with hidden code.

The same report found that hosting-level defences alone stopped only a small fraction of attacks in testing. In practice that means the way to stay safe is to run less code and keep it patched, not to rely on your host to catch everything.

Signs your site has been compromised

Any one of these is enough to start the clean-up below.

Visitors are redirected to unfamiliar sites, especially from mobile or from Google.
Spam pages, often in another language, appear in Google results for your domain.
There are administrator accounts you did not create.
Your browser or Google warns that the site is dangerous.
Your host suspends the account or emails about malware.
Files you do not recognise appear, especially PHP files in the uploads folder.

Step 1: contain it and take a copy

Put the site into maintenance mode or block public access so visitors are protected. Download a full copy of the files and database as they are now, because you may need evidence of how the attacker got in.

Step 2: change every password

Change the passwords for every WordPress user, your hosting account, the database, SFTP or FTP, and the email accounts tied to the site. Log out all sessions. Do this before the clean-up, or the attacker simply walks back in.

Step 3: restore or rebuild a clean site

The safest route is to restore a backup taken before the infection and then update everything. If there is no clean backup, reinstall WordPress core, your theme and each plugin from fresh downloads rather than trying to hand-edit infected files.

If you have SSH access and WP-CLI, these commands do most of the checking for you. They compare your files with the official copies, list your administrators, find PHP files hiding in uploads, and replace WordPress core with a clean copy without touching your content.

Find and replace tampered files with WP-CLI bash

# Compare core and plugin files with the official copies
wp core verify-checksums
wp plugin verify-checksums --all

# Who has admin access? Delete any account you do not recognise.
wp user list --role=administrator --fields=ID,user_login,user_email,user_registered

# PHP files should never be inside uploads
find wp-content/uploads -type f -name "*.php"

# Replace WordPress core with a clean copy, leaving wp-content and wp-config.php alone
wp core download --force --skip-content

# Reinstall a plugin from wordpress.org (repeat for each free plugin)
wp plugin install plugin-slug --force

Step 4: clear warnings and tell Google

If Google flagged the site, open the Security issues report in Search Console, confirm the site is clean and request a review. Remove any spam pages that were added, so they stop appearing in results.

Step 5: make a repeat unlikely

Delete unused plugins and themes, and replace any that have not been updated in a year. Turn on automatic updates for security releases, and apply the rest on a staging copy first. Use two-factor sign-in, give each person their own account and keep the number of administrators small.

Two small changes remove the most common attack routes. The first stops anyone editing plugin and theme code from the dashboard. The second stops PHP running from the uploads folder, which is where most planted backdoors live.

wp-config.php: no code editing from the dashboard php

define( 'DISALLOW_FILE_EDIT', true );

wp-content/uploads/.htaccess: block PHP in uploads (Apache) apache

<Files "*.php">
  Require all denied
</Files>

Nginx server block: the same rule for Nginx nginx

location ~* /wp-content/uploads/.*\.php$ {
  deny all;
}

Keep it that way

Keep daily backups stored away from the server, and test that you can restore one. A website care plan covers exactly this routine, so it happens every week whether or not anyone remembers.

Common questions

How do I know if my WordPress site has been hacked?

Look for redirects to other sites, spam pages in Google results, administrator accounts you did not create, warnings from your browser or host, and PHP files in the uploads folder. A malware scan and the WP-CLI checksum commands confirm it.

Can I clean a hacked WordPress site myself?

Often yes, if you can restore a clean backup or reinstall core, plugins and themes from fresh copies, change every password and remove unknown admin users. If the site handles payments or the infection keeps returning, bring in a developer.

Why does my site keep getting hacked after I clean it?

Usually a backdoor was missed, an outdated or abandoned plugin is still installed, or a stolen password is still valid. Reinstall everything from clean sources, delete unused plugins and change all credentials.

How often should I back up WordPress?

Daily for a site that changes often, weekly for one that rarely does, always stored away from the web server, and always tested by doing a restore at least once.

Sources

Have a project in mind? I reply within a day or two.

Start a project Website care plans