WordPress Site Hacked? A 7-Step Malware Cleanup Guide

Short answer: if your WordPress site has been hacked, do not start by deleting files. First take a full backup of the infected site, change every password, then find and remove the malware, close the hole the attacker used, and ask Google to review the site. Below is the order I follow when cleaning hacked sites for clients.

Signs your WordPress site has been hacked

• Visitors are redirected to spam, casino or pharmacy sites — often only on mobile or only when coming from Google.
• Google shows “This site may be hacked” or Chrome shows a red warning page.
• New admin users you did not create, or posts in foreign languages you never wrote.
• Your host suspends the account for sending spam or using too much CPU.
• Unknown PHP files in wp-content/uploads, or recently changed core files.

Step 1: Take a backup of the hacked site

It sounds strange, but back up the infected site (files and database) before you change anything. If a clean-up step breaks the site, you can go back, and the backup helps you understand how the attacker got in.

Step 2: Change every password

Change passwords for all WordPress administrators, the hosting control panel, FTP/SFTP, the database user and the email account linked to the admin user. Then update the security keys and salts in wp-config.php so that every logged-in session is forced out — including the attacker’s.

Step 3: Find the malware

• Compare WordPress core files with a fresh copy of the same version. Any difference is suspicious.
• Look for PHP files inside wp-content/uploads — there should normally be none.
• Search for common malware patterns such as eval(base64_decode, gzinflate and long encoded strings.
• Check the database: the wp_options table (siteurl, home and widget options), injected scripts in posts, and unknown admin users in wp_users.
• Use a server-side scanner if your host provides one (for example Imunify360 or ClamAV), plus a WordPress security plugin scan.

Step 4: Clean, then replace

Do not try to “fix” infected core files line by line. Replace WordPress core, themes and plugins with fresh copies from the official sources. Remove nulled or pirated themes and plugins completely — they are one of the most common sources of infection. Keep only your own uploads and custom code, and check those carefully.

Step 5: Close the hole

If you only remove the malware, the site is usually re-infected within days. Find out how the attacker got in. Typical causes are an outdated plugin with a known vulnerability, a weak or reused password, a nulled theme, or another infected site on the same hosting account. Update everything, delete unused plugins and themes, and isolate other sites on the same account.

Step 6: Harden the site

• Enable two-factor authentication for all administrators.
• Disable file editing in wp-admin with define('DISALLOW_FILE_EDIT', true);
• Block PHP execution in the uploads folder.
• Set correct file permissions (usually 644 for files and 755 for folders).
• Limit login attempts and add a web application firewall.
• Schedule automatic off-site backups.

Step 7: Ask Google to review the site

If Google flagged the site, open Google Search Console, check the Security Issues report, and request a review once the site is clean. Also check whether spam pages were indexed and remove them with the Removals tool or by returning a 410 status.

Frequently asked questions

Can I just restore an old backup?

Only if you know the backup is from before the infection and you also fix the vulnerability. Otherwise the attacker simply gets back in through the same hole.

Will a security plugin remove the hack automatically?

Security plugins are good at detecting known malware, but many infections hide in the database or in files the plugin does not scan. A manual review is still needed for a reliable clean-up.

How long does a WordPress malware cleanup take?

Most single-site clean-ups take a few hours to one working day. Large WooCommerce stores or servers with many infected sites take longer.

Is my customer data at risk?

It can be. If the site stores customer accounts or orders, treat the incident seriously: check for new admin users, review access logs, and — if you are in the EU — consider your obligations under GDPR.

Need your hacked WordPress site cleaned?

I clean hacked WordPress and WooCommerce sites, find the entry point and harden the site so it stays clean. I work remotely with clients in the USA and Europe. Contact me with your site URL and what you are seeing.