My WordPress Site Was Hacked: Step-by-Step Recovery Plan

If your WordPress site has been hacked, take a backup of the infected site first, then lock down every login, find and remove the malicious code, update everything, and ask Google to review the site once it is clean. The order matters: if you restore or delete files before you know how the attacker got in, you can wipe out the evidence and leave the door open for a second attack. Below is a step-by-step recovery plan, plus when it makes sense to hand the job to our WordPress security and malware cleanup service.

How to tell if your WordPress site has been hacked

Some hacks are obvious. Others stay hidden for weeks because the attacker wants your site’s search rankings, not your attention. Look for any of these:

• Google shows “This site may be hacked” under your listing, or Chrome shows a red warning page.
• Visitors from Google or mobile get redirected to a spam, pharmacy or “you won a prize” site, while you see the normal site when you type the address in directly.
• Search Console has a message in the Security Issues report, or Google suddenly indexes thousands of pages you never wrote (often Japanese or pharmaceutical spam).
• New admin users you don’t recognize, or your own password no longer works.
• Unknown files in the site root or wp-content/uploads, especially .php files in uploads.
• Your host suspends the site or emails you about malware or outbound spam.
• Your contact form or server starts sending spam email, and your domain lands on blocklists.

If you see one of these, treat the site as compromised until you prove it isn’t. Running a single plugin scan and getting an “all clear” doesn’t prove much, because many infections hide in the database or in files that scanners skip.

Step 1: Don’t panic, and don’t start deleting

The first instinct is to delete the strange files or restore last week’s backup. Hold off for 20 minutes. You need to know three things before you change anything: when the site was compromised, how the attacker got in, and what they changed. Restoring blindly can bring back the same vulnerable plugin, and deleting files destroys the clues.

If the site is actively harming visitors (redirecting to malware or phishing pages), put it in maintenance mode or ask your host to take it offline temporarily. A short outage is better than Google flagging your domain.

Step 2: Back up the hacked site

Yes, back up the infected version. Download a full copy of the files and an export of the database and store them somewhere off the server. This gives you a record to investigate and a fallback if a cleanup step breaks something. If your host keeps automatic nightly backups, note the dates of the last few so you can find a clean restore point later.

Step 3: Lock down every way in

Assume every password connected to the site is known to the attacker. Change them in this order:

1. Hosting control panel and SFTP/SSH accounts.
2. The database password (update wp-config.php to match).
3. Every WordPress administrator account, and remove any admin users you don’t recognize.
4. The email account that receives password resets for the site.

Then replace the WordPress security keys and salts in wp-config.php (WordPress.org offers a generator). That logs out every session, including any the attacker still has open. Turn on two-factor authentication for all admin users while you’re at it.

Step 4: Find out how they got in

WordPress hacks usually come through one of a few doors: an outdated plugin or theme with a known vulnerability, a stolen or weak password, a “nulled” (pirated) premium plugin with a backdoor built in, or an outdated version of WordPress itself.

That last one is not theoretical. In July 2026, WordPress patched a chain of two vulnerabilities nicknamed “wp2shell” (CVE-2026-63030 and CVE-2026-60137). On WordPress 6.9.x and 7.0.x, the chain let an attacker run code on a default install remotely, with no login and no plugins required. Fixes shipped on July 17, 2026 in versions 6.9.5 and 7.0.2 (6.8.6 for the SQL injection piece), WordPress.org pushed forced automatic updates, and security firms confirmed attacks in the wild within days. If your site was still on an affected version over the summer, check it carefully even if it looks fine today.

To find the entry point, check:

• Your server access logs around the time the problems started (your host can pull these).
• The “last modified” dates of files in wp-content/plugins, wp-content/themes and the site root.
• Every plugin and theme version against a vulnerability database such as Wordfence Intelligence, Patchstack or WPScan.
• The Users table for accounts created recently.

Step 5: Remove the malware

This is the hard part, and it’s where a rushed cleanup usually misses something.

Replace core files. Download a fresh copy of your exact WordPress version and replace the wp-admin and wp-includes folders entirely. Don’t touch wp-config.php or wp-content yet.

Reinstall plugins and themes from the source. Delete each plugin and theme folder and reinstall a clean copy from WordPress.org or the vendor. Delete anything you don’t use. Remove any nulled plugins for good.

Search wp-content/uploads for code. The uploads folder should hold images and documents, not PHP. Any .php file there is almost always a backdoor.

Check the database. Look in wp_options (especially siteurl, home and autoloaded options), wp_posts for injected <script> tags or spam links, and wp_users for extra admins.

Check .htaccess and wp-config.php. Attackers like to add redirect rules or include lines that load malicious code before WordPress starts.

Scan again. Run a server-side malware scan and a remote scan (such as Sucuri SiteCheck) after cleanup. Neither is perfect, which is why the manual steps above come first.

If you have a backup from before the infection date and you’ve identified how the attacker got in, restoring that backup and then patching the hole is often faster than cleaning file by file. You’ll lose content added since that date, so weigh it against how much has changed.

Step 6: Update and harden

Once the site is clean, close the door the attacker used and the ones next to it:

• Update WordPress core, every plugin and every theme to current versions.
• Remove unused plugins, themes and admin accounts.
• Keep two-factor authentication on for every admin.
• Set file permissions correctly and disable file editing in the dashboard (DISALLOW_FILE_EDIT in wp-config.php).
• Put a web application firewall in front of the site.
• Make sure nightly off-site backups are running and that you’ve tested a restore.

Hardening is not a one-time task. A site that was cleaned once can be reinfected as soon as one plugin falls behind again. Our monthly WordPress maintenance checklist covers what to check each month.

Step 7: Get Google to remove the warning

If Google flagged your site, log in to Search Console and open the Security Issues report. Fix every listed issue on every affected page first; Google says partial fixes won’t get you a partial return. Then click Request Review and explain what the problem was, what you did to fix it, and how you’re preventing a repeat.

Google says these reviews can take from a few days to a few weeks. Don’t resubmit while a request is pending, because it can slow things down. If the hack created spam pages, remove them (let them return a 404 or 410) and use the Removals tool for the worst ones so they drop out of results faster.

Step 8: Tell the right people

If your site collects personal data, such as form submissions, customer accounts or orders, check whether that data could have been accessed. Depending on what was exposed and where your customers live, you may have notification obligations. Talk to your attorney or insurance carrier if there’s any chance customer data was involved. Also let your team know about the password changes so nobody logs in with the old ones.

What a hacked-site cleanup costs

If you don’t have a maintenance plan with us, we handle emergency cleanup as on-demand WordPress help, billed hourly starting at $200/hour. How many hours it takes depends on how deep the infection goes: a single compromised plugin is a much smaller job than a site that has been reinfected several times.

The better deal is not getting hacked twice. Our WordPress plans are built around prevention:

• Essentials ($125/mo): managed WP Engine hosting, SSL, nightly backups, CDN and uptime monitoring, so you always have a clean restore point and know the moment the site goes down.
• Managed ($325/mo): everything in Essentials plus monthly core, plugin and theme updates tested on staging, a monthly security scan and cleanup, Search Console review and a monthly report.
• Priority ($525/mo): everything in Managed plus 3 hours of dev/content time, quarterly speed and SEO checks, and priority same-business-day response.

Running several WordPress sites? We offer custom multi-site plans. You can compare the details on our WordPress hosting and maintenance pages.

Frequently asked questions

How do I know if my WordPress site is hacked?

Common signs include a “This site may be hacked” label in Google, redirects to spam sites (often only for mobile or search visitors), new admin users, unknown PHP files in the uploads folder, spam pages in Google’s index, and warnings in Search Console’s Security Issues report.

Can I fix a hacked WordPress site myself?

Yes, if you’re comfortable with SFTP, the database and server logs. Back up the infected site, change every password, replace core files, reinstall plugins and themes from clean sources, remove backdoors, then update and harden. If the site keeps getting reinfected, a backdoor was likely missed and it’s time to bring in help.

Should I just restore a backup?

Only if the backup is from before the infection and you’ve found and fixed the entry point. Otherwise the attacker can get back in the same way, sometimes within hours.

How long does it take Google to remove the “This site may be hacked” warning?

After you fix every issue and request a review in Search Console, Google says the review can take from a few days to a few weeks.

Why does my WordPress site keep getting hacked?

Usually because a backdoor was left behind, a vulnerable plugin or theme is still installed, or a compromised password wasn’t changed. Monthly updates, two-factor authentication and a firewall close most of those gaps.

Get your site back, and keep it clean

If your site is hacked right now, contact us for emergency WordPress help. We start by finding how the attacker got in, then clean, harden and request Google’s review. If you’d rather never deal with this again, compare our WordPress hosting and maintenance plans and pick the one that fits your site.