How to Clean a Hacked WordPress Site, Step by Step
First: do not panic, and do not wipe anything. A hacked WordPress site is almost always recoverable, and the evidence on the server is what makes a clean recovery possible. Here is the process, the same one our team follows.
Step 1: Confirm it is really a hack
Common signs: Google shows “this site may be hacked”, visitors get redirected, pages you never created appear in search results, admin users you do not recognise exist, or email from your domain starts bouncing as spam. Any one of these means act now.
Step 2: Limit the damage
- Change every password: WordPress admins, hosting control panel, SFTP and database.
- Log out all sessions and remove admin accounts you do not recognise.
- If customer data is involved, note the time and what you know. You may have disclosure obligations.
Step 3: Find and remove the malware
Scan the files and the database. Attackers hide copies of their access in multiple places: modified core files, rogue plugins, scheduled tasks and database entries. This is the step where do-it-yourself cleanups usually fail. If you remove nine backdoors and miss the tenth, the site is reinfected within days.
Step 4: Close the door they used
The malware is the symptom. The cause is usually an outdated plugin or theme, a weak password, or a vulnerable account. Update everything, remove software you do not use, and check every admin user. If you skip this step, the hack repeats.
Step 5: Restore trust
Request a review through Google Search Console if you were flagged, resubmit your sitemap, and watch the site closely for two weeks. Reinfection is most likely in the first days after a cleanup.
Or let our team fix it
This is exactly what WP Guard does, every week. We find the malware, remove the attacker’s access, repair the damage, close the entry point, and verify the site passes a full clearance scan. Then around-the-clock protection starts, backed by a written guarantee, so this is the last time you go through it.
Start your recovery here, or run the free scanner to see what we are dealing with.