WordPress Malware Removal: How to Clean a Hacked Site and Prevent It Happening Again

Signs your WordPress site is hacked

Unfamiliar admin accounts, spam content or pages, redirects, browser warnings, your host suspending the account or a sudden drop in traffic. If you see any of these, treat it as an incident.

Step 1: Contain and back up

Put the site in maintenance mode if needed and take a full backup of files and database for forensic reference. Ask your host to confirm what they can see and whether they can restore a clean snapshot.

Step 2: Find the infection

Scan with a reputable security scanner and compare core files with clean WordPress copies. Review recently modified files, new users, scheduled tasks and unfamiliar plugins.

Step 3: Clean files and database

• Reinstall WordPress core from a clean source
• Replace plugins and themes with fresh copies; delete unused ones
• Inspect the uploads folder for PHP files
• Remove injected code and spam from the database

Step 4: Remove backdoors and reset credentials

Attackers usually leave backdoors. Change all passwords—WordPress, hosting, database, FTP and email—and regenerate security keys. Remove unknown users and review access to your hosting panel.

Step 5: Restore trust with Google

If your site was flagged, request a review in Google Search Console after cleaning and remove spam URLs. Prompt action limits damage to your rankings.

Step 6: Harden the site

Update core, plugins and themes, enforce two-factor authentication, limit login attempts, add a web application firewall and schedule off-site backups. Ongoing application support and maintenance automates this, as described in our maintenance services guide.

Protect your store

Hacked ecommerce sites risk customer data and revenue. If you run WooCommerce, see Shopify vs WooCommerce and our ecommerce cost guide.

Common ways WordPress sites get hacked

Outdated plugins and themes, nulled or pirated premium plugins, weak or reused passwords, insecure hosting and compromised FTP or admin accounts account for most infections. Attackers use automated scanners, so any site with a known vulnerability is a target regardless of size.

What malware does to your business

Infected sites can send spam from your domain, redirect visitors to scams, steal customer data or host phishing pages. Search engines may warn visitors or drop pages from results, and email from your domain may be blocked. The longer it persists, the greater the damage.

A simple prevention routine

Update weekly, remove unused plugins, use a firewall and malware scanner, enable two-factor authentication, use unique strong passwords and keep tested off-site backups. Review user accounts monthly. This routine is included in our maintenance plans.

Need it fixed today?

Contact us for WordPress malware removal—we investigate, clean and secure your site, then monitor it.