Daniel Lasek · Last reviewed 2026-11-01

How to Clean a Hacked WordPress Site

A hacked WordPress site is cleaned by saving a copy first, removing what does not belong, and closing the way the attacker got in. Deleting the site or random PHP files before a backup is how people lose the clean pages they still have. This is the order of work: preserve, inspect, repair, then prove it stayed clean.

What should you do before you change anything?

Write down the symptom and the time. A redirect, spam pages, a Google warning, and a host suspension are different symptoms and can share a cause. Screenshot a desktop browser and a phone. Some hacks redirect only mobile visitors.

Get a full copy of the files and the database from the host, or download one, and store it off that hosting account. A zip left in wp-content is not enough. It sits on the server you do not trust yet. If you already have an older off-site backup, set it aside. Do not restore it yet. Restoring now can wipe the record of what changed, and restoring an infected backup later puts the hack back.

From a computer you trust, change the email, hosting, and registrar passwords, and turn on two-factor authentication where it is offered. Do that before you set a new WordPress password. Code still on the server can read the new WordPress password, and a compromised inbox can reset the host and the registrar again.

What should you not delete?

Do not delete the site, drop the database, or remove PHP files because the names look strange. Core, plugins, and themes are supposed to be PHP. Uploads should not contain PHP, but that folder holds your media, so do not empty it.

Do not install a cleanup plugin from an ad, pay a ransom note, or point the domain at a new host and upload the same files. You would move the unwanted code and keep the stolen passwords. Do not search-and-replace the database for a spam word until you can restore a backup. A broad replace corrupts real posts that use the same letters.

How do you see what the hack changed?

Compare the site with copies of the same WordPress version, plugins, and themes from WordPress.org or the vendor. A nulled theme or a "GPL club" zip is not a known-good copy. If you cannot get a vendor original, retire that plugin or theme.

Look for files that are not in the vendor package, files that do not match it, and rows you did not write: extra administrators, spam posts, spam comments, and unexpected links. PHP inside wp-content/uploads or a cache folder, an administrator you did not create, and a theme file that changed without you are the usual finds. None of them, alone, proves the entry. They tell you what to remove after the backup exists.

A free read-only scan shows some public symptoms. It cannot see the database, unlinked files, or host logs. A calm result means nothing public showed up, not that the site is clean.

Read-only scan · No install · Results in about 30 seconds

Which passwords and users do you reset?

Reset secrets after the unwanted code is gone. Otherwise a leftover file can read the new password. Reset WordPress administrators, the database password in wp-config.php (and update that file in the same step), SFTP or SSH, the hosting panel, and API keys stored in the site.

Replace the keys and salts in wp-config.php using WordPress's generator at https://api.wordpress.org/secret-key/1.1/salt/. That logs every session out. Delete administrators you do not recognize, remove former staff, and delete FTP users and SSH keys that are not yours. If a password was emailed or reused, treat it as leaked.

How do you remove what does not belong?

Replace core with a fresh copy from WordPress.org, and update to the current release if the server's PHP allows it. Replace each plugin and theme you are keeping with the vendor copy. Delete unused plugins and themes, including inactive ones. If a package exists only as a pirated zip, remove it. Then delete spam posts, spam comments, links you did not place, and unknown users. If a line might be yours, compare it with the vendor file. Do not paste forum snippets into the site. If the host quarantined files, ask what they took.

How do you close the way in?

Removing spam and leaving the door open is a pause. The usual doors are an outdated plugin or theme, a reused password, a nulled package, shared hosting that does not separate customers, and leaked SFTP or SSH. Update what you keep, remove what you do not use, and use a unique password on WordPress, the database, the host, and the registrar. Do not email those passwords. On a paid job, access goes through the intake form and is deleted when the job closes. If you move hosts, upload the cleaned site only. The doors are described, with no breaking-in steps, in How hackers get into WordPress sites.

Who do you contact, and when is a paid cleanup the better job?

Contact the host if the account is suspended, if you need logs, or if you cannot get a backup. Contact the registrar if nameservers or DNS changed without you. For a Google warning, use Search Console and request a review only after the listed samples are fixed. The steps are in How to remove a Google hacked warning.

Emergency Cleanup is $499 once if you do not want to do this yourself. You fill in one intake form and confirm you may authorize the work. The job is the cleanup, a plain-English report of the cause we can support, hardening done during that job, a Google review walkthrough, and re-scans on day 1, day 7, and day 30. The first month of Protection is included after the site is clean. If the same issue returns within 30 days, we clean it again at no charge. If we cannot clean it, the cleanup fee is refunded. "Hack-free in 24 hours" is a target after we have access, not a measured promise. Protection is $19 a month or $190 a year per site, it is optional, and it does not replace cleanup on a site that is still hacked.

Fix it now — $499 Talk to us by email

Which symptoms are worth comparing?

The page visitors see is not the root cause. These notes are the common public symptoms:

Match the symptom so you know what to tell the host and Google. Then go back to the backup, the extra users, and the file that does not belong. That is the cleanup.

Questions

Can I clean a hacked WordPress site myself?

Yes, if you can take a real backup, tell WordPress core and vendor files from files that do not belong, and reset the accounts that were exposed. If you cannot tell those apart, stop deleting files and use a paid cleanup or your host. Guessing is how people erase their own pages.

Should I delete WordPress and reinstall first?

Not first. Take a backup of the files and the database, and keep it off the hacked account. A reinstall can be part of the repair later. It is a bad first move because it can destroy the only copy of your content and the trail of what changed.

Is a backup stored on the same server enough?

No. A zip inside the hacked account is on a machine you do not trust yet, and it may contain the same malware. Keep a copy with the host's backup system or download one to a computer that is not the server.

Do I have to buy Protection to have the site cleaned?

No. Emergency Cleanup is a one-time $499 job. Protection is optional monitoring after a site is clean. A site that is still hacked is not eligible for Protection until the cleanup is done.