WordPress Site Hacked? A Step-by-Step Malware Removal and Recovery Guide

Visitors are redirected to strange websites. Google shows Japanese or pharmacy spam under your domain. Your host has suspended the account. Chrome shows a red warning. These are typical signs of a hacked WordPress site.

It is stressful, but it can be fixed. This guide walks through the steps in the right order: contain, investigate, clean, recover and harden.

Signs your WordPress site is hacked

• Redirects to spam, betting or scam sites (sometimes only on mobile or only from Google)
• Unknown pages in Google results (site:yourdomain.com shows spam)
• New admin users you did not create
• Unknown files in wp-content/uploads, or PHP files where there should only be images
• A “This site may be hacked” or “Deceptive site ahead” warning
• Your host reports malware or high resource usage
• For WooCommerce: customers report card fraud after shopping with you (a sign of a payment skimmer)

Step 1: Contain the damage

1. Put the site in maintenance mode or temporarily block public access if it is actively harming visitors or capturing payment data.
2. Make a full backup of the infected site (files and database). You need it for investigation; do not overwrite your clean backups with it.
3. Change passwords: hosting panel, SFTP/SSH, database, all WordPress admins, and email accounts connected to the site.
4. If you run a shop and suspect a card skimmer, inform your payment provider.

Step 2: Find out how they got in

Typical entry points:

• Outdated or vulnerable plugins and themes (the most common cause)
• Nulled (pirated) themes or plugins with built-in backdoors
• Weak or reused admin passwords
• Compromised hosting accounts or other sites on the same account
• Leaked credentials from a developer’s computer

Check server access logs around the time the problems started, look at recently modified files and review the list of admin users. If you do not find the entry point, the attacker will likely return.

Step 3: Clean the files

The safest approach is replace, do not repair:

1. WordPress core: replace wp-admin and wp-includes with fresh copies of the same version from wordpress.org. With WP-CLI you can verify core files:

wp core verify-checksums
wp plugin verify-checksums --all

1. Plugins and themes: delete and reinstall from official sources. Remove anything you do not use.
2. Uploads folder: there should be no PHP files in wp-content/uploads. Find them:

find wp-content/uploads -name "*.php"

1. Check wp-config.php and .htaccess for injected code, unknown includes or redirect rules.
2. Look for recently modified files:

find . -type f -mtime -7 -name "*.php"

1. Search for common malicious patterns such as eval(base64_decode(, gzinflate( or long obfuscated strings, but remember that some legitimate plugins use similar functions.

Step 4: Clean the database

Malware often lives in the database:

• Unknown admin users: remove them
• wp_options: check siteurl, home and suspicious autoloaded options
• Posts and pages: search for injected <script> tags or hidden links
• Spam pages: remove generated spam posts

wp user list --role=administrator
wp db search "<script" --all-tables

Step 5: Reset all secrets

• Generate new salts and keys in wp-config.php (this logs out every user)
• Change database password and update wp-config.php
• Rotate API keys used by plugins (payment, email, shipping)

Step 6: Update everything and scan again

Update WordPress, PHP, all plugins and themes. Then run a scan with a reputable security plugin or an external scanner, and check the site from a clean browser and from mobile.

Step 7: Fix Google warnings and spam pages

1. Check Security issues in Google Search Console
2. Request a review after the site is clean
3. For spam pages, make sure they return 404 or 410 and remove spam sitemaps the attacker added
4. Check the Pages and Sitemaps reports for unknown entries

Spam URLs can stay visible in Google for a while after removal. They disappear as Google recrawls them.

Step 8: Harden the site

• Automatic updates for minor releases and trusted plugins
• Two-factor authentication for all admins
• Least privilege: only give admin rights to people who really need them
• Disable file editing in the dashboard:

define( 'DISALLOW_FILE_EDIT', true );

• Block PHP execution in wp-content/uploads
• Web application firewall (at host, CDN or plugin level)
• Off-site, versioned backups with tested restores (see my server backup strategy guide)
• Monitoring: uptime, file changes and Search Console alerts

When to restore from backup instead

If you have a clean backup from before the infection and the shop has not received important new orders since, restoring can be faster. But you still need to fix the entry point and update everything, otherwise the site will be reinfected.

Frequently asked questions

Can a security plugin clean my site automatically?

It can find and remove many known infections, but backdoors and database injections are often missed. Manual review is still needed for a reliable cleanup.

Why does my site get hacked again after cleaning?

Usually because a backdoor was missed or the original vulnerability (an outdated plugin, a weak password) was not fixed.

Does a hack hurt my SEO?

It can, especially with spam pages and Google warnings. Fast cleanup and a review request usually limit the damage.

Is WooCommerce data at risk?

Possibly. If you suspect customer or payment data was accessed, get professional help and check your legal obligations, such as data breach notification rules under GDPR.

Need urgent help with a hacked site?

I clean and secure hacked WordPress and WooCommerce sites, find the entry point and set up backups and monitoring so it does not happen again. See my WordPress and WooCommerce service or request help now.