Depeche Code

// Creative Agency

WordPress Hacked? 7 Steps to Clean Your Site in 2026

WordPress Hacked? 7 Steps to Clean Your Site in 2026

If your WordPress site has been hacked, do three things now: document what you see, isolate the site so the damage stops spreading, and change every password tied to it. Then replace the WordPress core files with clean copies, clean or replace what is in wp-content, find the hole the attacker used, and close it. This guide walks you through each step in order, in plain language, for business owners and the people who look after their sites.

Depechecode
Restore Confidence in Your WordPress Site
Depeche Code provides website development, technical support, and ongoing maintenance to help businesses manage their online presence.

Explore Depeche Code’s services

TL;DR

  • Write down what you see and when you noticed it before you change anything, then isolate the site and change all passwords.
  • Replace /wp-admin and /wp-includes over SFTP with the same WordPress version from WordPress.org. Do not rely on the one-click reinstall.
  • Check wp-content, .htaccess and your user list for files and accounts you did not create.
  • Find the entry point (usually an outdated plugin, theme or weak login) or the attacker will come back.
  • Keep dated backups, updates and monitoring in place so the next incident is caught in days, not weeks.

Table of Contents

Signs your WordPress site has been hacked

Some hacks are loud. Others sit quietly for weeks while they send spam or redirect a slice of your visitors. WordPress.org’s documentation on hacked sites lists the signals that most often point to a compromise:

  • Google or Bing has blacklisted your site.
  • Your host has disabled the site.
  • The site is flagged for distributing malware, or visitors’ antivirus software warns them off.
  • Someone contacts you to say your site is being used to attack other sites.
  • New users appear that you did not create.
  • The site visibly shows it has been defaced when you open it in a browser.

Beyond that list, owners commonly notice less obvious symptoms: search results for your pages showing odd titles or foreign-language text, a sudden traffic drop, slow pages, contact form emails that stop arriving, or admin accounts you cannot explain. None of these proves a hack on its own, but two or three together mean you should act as if it is one.

Google can also tell you. The Security Issues report in Search Console shows Google’s findings when its evaluation decides a site was hacked or behaves in a way that could harm visitors. If you have not verified your site in Search Console, do it. It costs nothing and is often the first place a content-injection problem shows up.

Step 1: Document everything before you touch it

It is tempting to start deleting. Resist for ten minutes. WordPress.org says the first actionable step is to record what you see, when you noticed it and your timezone, any recent actions such as installing a plugin or changing a theme or widget, and details of your hosting environment. Take screenshots of defaced pages, warnings and strange admin screens.

This record matters later. It helps you work out when the attacker got in, it helps your host or a security professional help you faster, and it gives you the dates you need if you have to tell customers or insurers what happened.

Write down:

  1. The exact time you noticed the problem and the timezone.
  2. What changed recently: new plugins, theme edits, updates, new staff accounts.
  3. Your host, PHP version and WordPress version.
  4. Who has admin, FTP, SFTP, SSH or hosting access.

Step 2: Contain the damage

Containment means stopping the problem from spreading or getting worse. CISA’s guidance on eliminating web shells starts with isolating the compromised web server to reduce lateral movement, and preserving evidence such as disk contents and logs (web application, access, error, firewall, CDN and database logs) before cleanup. For a typical small business site on shared or managed hosting, that translates to practical moves:

  • Ask your host to suspend public access or put the site in maintenance mode while you work. Many hosts can do this in minutes.
  • Download a full snapshot of the files and database as they are now. You will clean a copy, and the original stays available for investigation.
  • Download your server’s access and error logs if your host provides them. Logs are often rotated and deleted automatically.
  • If the same hosting account runs other sites, treat them all as at risk until checked.

The NIST guide to malware incident handling describes the same sequence: validate that it is really malware, identify what is infected, then contain it to stop further spread and damage before you recover.

Step 3: Change every credential that matters

Assume the attacker has, or can get, your passwords. CISA lists the accounts to reset after a web shell: the web administrator, the database user, the hosting account and remote access such as FTP and SSH. For WordPress, that means:

  1. Every WordPress administrator, editor and author account.
  2. The database password, which you also update in wp-config.php.
  3. Your hosting control panel login.
  4. All FTP, SFTP and SSH accounts.
  5. The email accounts connected to the above, since password resets go there.

Use long, unique passwords from a password manager and turn on two-factor authentication wherever it is offered. Remove any user you do not recognize and any former employee or contractor who no longer needs access. WordPress.org also advises changing passwords again once cleanup is finished, because an attacker who is still in your files may capture the new ones.

Step 4: Replace WordPress core files

This is the most reliable way to remove malware from WordPress core. WordPress.org’s guidance is to use FTP or SFTP and replace the /wp-admin and /wp-includes directories with fresh copies of the same WordPress version your site runs. Download that version from WordPress.org.

Two details are easy to miss:

  • Use the same version. Mismatched versions can break the site or leave you on an outdated release.
  • Do not use the reinstall button in the dashboard. WordPress.org explains that those installers often only overwrite existing files, while hacks often introduce new files. Dragging and dropping the directories over SFTP replaces the folder contents properly.

After that, handle the loose files in the root folder. Compare the root PHP files to a clean download of the same version, and keep your own wp-config.php but read it line by line for code you did not write. Then update WordPress to the current release.

Step 5: Clean wp-content, the place most infections hide

The wp-content folder holds your themes, plugins and uploads, and it is where attackers tend to leave backdoors because it contains your unique files. WordPress.org tells owners to clean or replace files here carefully. A workable routine:

  1. Delete plugins and themes you do not use. Inactive code still runs vulnerabilities if it is reachable.
  2. Reinstall the rest from their official sources, at their current versions, rather than trusting the copies on the server.
  3. Look inside uploads. This folder should hold images, PDFs and similar media. PHP files in there are a red flag, because executable code does not belong in uploads in a normal setup.
  4. Check mu-plugins and any drop-in files such as advanced-cache.php for code you did not add.
  5. Inspect .htaccess. WordPress.org specifically calls out checking this file, since attackers use it to redirect visitors, often only those arriving from search results.

If you are comfortable with a command line, a diff against a clean install of the same WordPress version, plugins and themes will show you every file that differs. Replace the differences with clean versions and test the site after each batch so you can see what broke if something does.

If the site is heavily customized or you cannot tell what is yours and what is not, stop and bring in a professional. A half-clean site that you believe is clean is worse than one you know is still compromised.

Step 6: Restore from a clean backup if you have one

CISA’s web shell guidance includes restoring from a clean backup after you delete the malicious files. The catch is knowing which backup is clean. The WordPress hardening documentation gives the example of a site compromised on May 1 but not noticed until May 12. With regularly timed snapshots, the owner has pre-compromise backups to rebuild from, and post-compromise backups that help determine how the intrusion happened.

Owner reviewing website backup restore points

Use your timeline from Step 1 to pick a backup from before the earliest sign of trouble. Restore it to a test copy first if you can, then apply every update before it goes live, because an old backup also carries old vulnerabilities. Keep the infected snapshot until the investigation is done.

A few practical notes:

  • Restore the database too, but check the users table for admin accounts you do not recognize.
  • Keep backups off the same server, so an attacker cannot delete them along with the site.
  • Check how many days of history your host or backup tool keeps. Thirty days is more useful than three.

Step 7: Find how they got in

Cleaning without finding the entry point is the most common reason sites are hacked twice. CISA’s guidance puts it plainly: investigate the underlying vulnerability, then patch and harden the application or server.

Google’s documentation notes that typical routes for injected content include an insecure directory, a vulnerability in software such as an older version of WordPress, and compromised third-party plugins. In practice, check these in order:

  1. Plugins and themes. Which ones were out of date, abandoned or recently installed when your timeline begins? Search a plugin’s name with the word “vulnerability” and its version number.
  2. Logins. Look for long runs of failed attempts followed by a success, or logins from places your team is not.
  3. File timestamps. A cluster of PHP files modified within a few minutes that nobody on your team edited usually marks the moment of compromise.
  4. Access logs. Look at requests in the hours before that cluster. POST requests to plugin files, PHP files requested from the uploads folder, and very long query strings are typical signs of an exploit.
  5. Other accounts. A stolen FTP password or a compromised laptop can be the cause with no WordPress flaw involved at all.

If the logs are over your head, hand your snapshot, logs and timeline to your host or a security specialist. Your Step 1 notes will save them hours.

Confirm the site is clean and clear any warnings

Before you reopen the site:

  • Scan the files and database again, and compare core files against the originals.
  • Log in as a fresh admin and look at users, plugins, themes and scheduled tasks.
  • Browse the site on a phone using mobile data and by clicking through from a search result, since some malware only targets those visitors.
  • Check Search Console’s Security Issues report and request a review if Google flagged you.
  • Ask your host to lift any suspension.

Watch the site closely for the next few weeks. Reinfection often shows up as new files, new users or traffic that suddenly behaves strangely.

If customers’ data was involved

A hacked brochure site is a nuisance. A hacked store, booking system or client portal can expose personal information. The NIST Cybersecurity Framework 2.0 small business guide says to assess the severity and root cause, prioritize steps to contain and eradicate the incident, and communicate a confirmed incident to internal and external stakeholders as required by laws, regulations, contracts or policies. Notification duties differ by state and by industry, so speak with your attorney or cyber insurer early if customer data may have been exposed.

Prepare before the next incident

The calmest recoveries come from businesses that decided who does what before anything broke. CISA’s guidance for small businesses recommends a written incident response plan covering what to do before, during and after an incident, with roles and responsibilities, an address book that works if the network is down, sign-off from leadership and a quarterly review.

For a small firm, that can be one page: who calls the host, who talks to customers, who holds the passwords, who approves restoring a backup. If your team also handles signed contracts and client documents, it is worth reading about document security for teams, including defined roles, escalation procedures and staff training, because a website incident rarely stays on the website.

How to keep WordPress from being hacked again

Prevention is mostly routine work done on schedule. The basics:

  1. Update on a schedule. WordPress core, plugins and themes, weekly at minimum, with security fixes applied as soon as you can test them.
  2. Remove what you do not use. Every inactive plugin or theme is attack surface with no benefit.
  3. Limit who can log in. Give each person their own account with the lowest role they need, require two-factor authentication and remove access the day someone leaves.
  4. Keep versioned backups off-server. Test a restore at least once, so you know it works.
  5. Monitor. Uptime checks, file change alerts and Search Console notifications shorten the time between compromise and discovery, which is the main factor in how much damage is done.
  6. Choose plugins carefully. Prefer actively maintained ones with a recent update history and a clear support channel.

We have written practical companions to this list: fast wins to harden WordPress security you can finish in under an hour, a plain-language website security guide for SMB leaders, and an overview of what a WordPress maintenance plan covers.

Our perspective

Most hacked WordPress sites we see were not targeted. They were simply neglected: a plugin that stopped getting updates, an old admin account, a backup nobody had tested. Attackers scan for these gaps automatically, which is why the fix is never a single clever tool.

We build and run WordPress sites with security as part of the work from day one, and we measure the technical health of what we deliver with Google PageSpeed and SEO scores. We also believe you should own what you pay for, so every deliverable we produce is transparently yours.

Our view is that the best response to a hack is a boring one: dated backups, regular updates, limited access and someone responsible for watching the site. That is exactly what ongoing maintenance is for, and it is far cheaper than an emergency.

Donovan Wells - Founder and CEO

Let us look after your WordPress site

If you would rather spend your time running the business than patching it, we can take care of the routine work that keeps WordPress safe. Our WordPress hosting and maintenance services start at $39 per month for dedicated hosting and $99 per month for maintenance, with ongoing technical support included. See the details on our WordPress hosting and maintenance page.

Depechecode

If your site is down right now, contact us through our website and tell us what you are seeing.

FAQ

How do I know if my WordPress site has been hacked?

Common signs are a Google or Bing blacklist, a host suspension, antivirus warnings for visitors, a visibly defaced page, and new admin users you did not create. Search results showing odd titles or spam text are another clue. Check the Security Issues report in Search Console for Google’s own findings.

Can I remove malware from WordPress myself?

Yes, if you are comfortable with SFTP and file management. Take a snapshot, replace /wp-admin and /wp-includes with the same WordPress version from WordPress.org, clean or replace files in wp-content, inspect .htaccess, and change passwords again. If the site handles customer data or you cannot tell which files are yours, bring in a professional.

Should I restore from a backup or clean the site by hand?

A clean backup from before the first sign of compromise is usually the fastest route. Pick it using your timeline, apply all updates before going live, and keep the infected copy for investigation. If you have no trustworthy backup, clean the files manually as described above.

Why does my WordPress site keep getting hacked again?

Usually because the original entry point is still open: an outdated plugin, a weak or reused password, a leftover backdoor in wp-content or a compromised FTP account. Investigate how the attacker got in, patch that, and then change all credentials once more after cleanup.

How often should I back up a WordPress site?

Back up as often as your content changes, and keep several dated copies. The WordPress hardening documentation explains that regular snapshots give you pre-compromise versions to rebuild from, even when a hack goes unnoticed for days.

Sources

Recommended