How to Clean a Hacked WordPress Site

The first hour: what to do before you delete anything

The instinct after finding malware is to start deleting files. Resist it. The infected files are evidence of how the attacker got in, and if you destroy that trail you will clean the site today and be reinfected next week.

Do these four things first:

• Take a full backup anyway - files and database, infection included. If a cleanup step goes wrong, this is your only way back.
• Write down the timestamps. Sort the files by modification date. The oldest modified file usually sits closest to the entry point.
• Do not change passwords yet. Change them after the backdoors are gone, or you will simply hand the attacker a chance to harvest the new ones.
• Put the site into maintenance mode if it is serving spam or redirects to real visitors.

Confirm the site is actually hacked

Not every strange symptom is malware. A plugin conflict, a broken cache, or an expired certificate can all look alarming. Three checks tell you quickly whether you are dealing with an intrusion:

1. Search site:yourdomain.com in Google. This shows what Google has indexed, not what your browser renders. Pages you never created - Japanese characters, pharmacy names, casino brands, random alphanumeric slugs - mean injected content.

2. Fetch your own page as Googlebot. Most SEO spam is cloaked: it is served only when the user agent looks like a search engine crawler. A page that looks clean in Chrome and spammy to Googlebot is the signature of an SEO spam infection.

3. Open Search Console. The Security Issues report names the problem directly. The Coverage report will show a sudden spike in indexed URLs if pages were injected.

Find the infection

There are four places malware hides on almost every compromised WordPress install:

• Core files. Compare wp-admin and wp-includes against a clean copy of the same WordPress version. Anything that differs was not put there by WordPress.
• Plugins and themes. Same method - reinstall from the official source rather than trying to repair individual files. Pay particular attention to plugins you deactivated but never deleted; a deactivated plugin's PHP files are still reachable over HTTP.
• The uploads directory. wp-content/uploads should contain media, nothing else. A .php file there is a backdoor, with no exceptions.
• mu-plugins. The wp-content/mu-plugins folder loads automatically and does not appear in the plugins list. Attackers like it precisely because most site owners have never opened it.

Beyond files, check the database. Injected scripts commonly live in the wp_options table, and rogue administrators in wp_users.

Remove it properly

The reliable sequence, in order:

• Replace WordPress core with a fresh download of the identical version.
• Delete every plugin and theme, then reinstall the ones you actually use from the official repository. Do not reinstall a plugin that has been abandoned by its author.
• Remove every .php file from the uploads directory.
• Empty mu-plugins unless you deliberately put something there.
• Check .htaccess and wp-config.php for injected rules and includes.
• Delete admin accounts you do not recognise, then reset the passwords of the ones you keep.
• Rotate the salts in wp-config.php to invalidate every existing session.
• Change the database password and the hosting and FTP credentials.

Close the door behind you

A cleanup without hardening is a temporary repair. The measures that prevent the overwhelming majority of reinfections:

• Update WordPress, plugins and themes - the vast majority of intrusions exploit a vulnerability that was patched months earlier.
• Disable PHP execution inside wp-content/uploads.
• Enable two-factor authentication on every administrator account.
• Move the login page away from /wp-admin.
• Delete plugins you no longer use rather than deactivating them.
• Store backups somewhere other than the server they back up.

Our WordPress hardening guide works through each of these in detail.

Repair the damage in Google

This is the step most cleanup tutorials skip, and it is the one that decides whether your traffic comes back.

Removing malware from the server does not remove the spam pages from Google's index. Those URLs stay indexed until Google recrawls them and finds them gone. You need to:

• Regenerate the sitemap so it lists only real pages.
• Remove any Search Console user or property owner you did not add - attackers routinely verify themselves to speed up indexing of their spam.
• Submit removal requests for the injected URLs.
• File a reconsideration request if a manual action was issued, describing what was compromised and what you changed.

Expect recovery to run over weeks rather than days. Sites cleaned quickly usually return to their previous positions; sites that served spam for months sometimes settle slightly lower.

If the site keeps getting reinfected

Malware that returns within days of a clean means something was left behind. The usual culprits are a backdoor in a directory you did not check, a scheduled task in wp_cron that reinstalls the payload, a second administrator account, or - on shared hosting - a different infected site under the same account writing into yours.

At that point, file-by-file cleaning stops being economical. The faster route is a rebuild: a clean WordPress install, fresh copies of the plugins, and only the content migrated across after inspection.

When to hand it over

Cleaning a hacked WordPress site yourself is realistic when the infection is recent, limited to one plugin, and the site is small. It stops being realistic when the site is earning money while it is down, when a manual action is already in place, or when the second cleanup fails.

We do this work as a service: WordPress malware removal and hacked site cleanup. The initial check is free - send the URL and we will tell you what we find, whether or not you hire us.

If the spam pages on your site are in Japanese, start with our dedicated guide to the Japanese keyword hack, which covers that specific attack in more depth.