If your WordPress site has been hacked — showing spam pages, redirecting visitors somewhere else, or your host just emailed you about malware — stop scrolling for a diagnosis and start working through this recovery checklist in order. Every step below matters more than the last, and doing them out of order is how a hacked WordPress site gets reinfected within days of being “cleaned.”
How to confirm your WordPress site is actually hacked
Before you touch anything, rule out a false alarm. A hacked site usually shows more than one of these at once:
- Google Chrome or Search Console flags the site as “deceptive” or shows a red warning screen
- Visitors get redirected to a pharmacy, gambling, or shopping site they never asked for
- New admin users appear in Users that you didn’t create
- Your host suspends or throttles the site and mentions malware, resource abuse, or a blacklist
- Unfamiliar PHP files sit in
wp-content/uploadsor plugin folders, or a plugin/theme you don’t recognize is active - Search results for your own site show garbled Japanese, Chinese, or pharma keyword spam in the title/description
If you’re only seeing a broken layout or a fatal error with no spam content or redirects, that’s more likely a plugin conflict — see our white screen of death guide first before assuming a breach.
Step 1: Take the site offline without deleting anything
Put the site in maintenance mode or, if your host allows it, pause it at the server level rather than deleting files. The goal is to stop the malware from serving more spam to visitors and search engines while you work — not to destroy the evidence you’ll need to find the entry point. Don’t delete plugins, themes, or uploads yet; you may need to compare the infected files against clean copies later.
Step 2: Change every password and key, from a different device
Assume every credential stored on or near the site is compromised: WordPress admin accounts, hosting/cPanel login, database password, SFTP/SSH keys, and any API keys stored in plugin settings (payment gateways, email services, CRMs). Do this from a device you’re confident isn’t already compromised — if the same laptop had a keylogger or malicious browser extension, resetting passwords from it doesn’t help. Revoke and reissue API keys rather than just changing passwords where the plugin supports it.
Step 3: Find the entry point before you clean anything
Cleaning malware without finding how it got in just buys you a few days before it comes back. The most common entry points, in order of how often they actually happen: an outdated plugin or theme with a known vulnerability, a stolen or weak admin password (no two-factor authentication), a nulled/pirated premium plugin with a backdoor built in, or leftover access from an old developer or agency account nobody removed. Check Users → All Users for accounts you don’t recognize, and check installed plugins against your own memory of what you actually installed.
Step 4: Restore from a clean backup, or clean manually if you don’t have one
If you have a backup from before the infection started, this is almost always faster and safer than manually hunting for injected code across thousands of files. Restore the database and files together, then immediately apply Step 5 before bringing the site back online — restoring an old, unpatched version of WordPress just reopens the same door. If you don’t have a clean backup, a malware scanner (Wordfence, Sucuri, or a scan from your host) can flag suspicious files, but manual review by someone who can read PHP is what actually catches obfuscated backdoors that scanners miss. This is the point where most site owners bring in a developer rather than continuing solo — see “When to stop doing this yourself” below.
Step 5: Update everything, then remove what you don’t need
Update WordPress core, every theme, and every plugin to their latest versions — most real-world hacks exploit a vulnerability that was already patched months earlier. While you’re in there, delete any plugin or theme you’re not actively using; an inactive plugin with a known vulnerability is still an open door even when it’s deactivated, not just when it’s active.
Step 6: Harden the site against reinfection
Once the site is clean and updated, close the gaps that let this happen: turn on two-factor authentication for every admin account, limit login attempts, remove any user accounts you don’t recognize or no longer need, and set your uploads folder to block PHP execution (a common way malware persists even after a “clean”). If you don’t already have a security plugin in place, our security plugins comparison covers which ones are actually worth running, and our broader guide on essential WordPress security practices is worth applying in full, not just the parts that stopped this specific attack.
Step 7: Check for blacklisting and monitor after you’re back online
Even after cleaning, Google, Chrome, and some hosts may still show a warning until they rescan the site. Submit a review request in Google Search Console’s Security Issues report once you’ve confirmed the site is clean — this is what actually clears the red warning screen, not just fixing the files. Keep an eye on traffic and rankings for the next few weeks; a site that lost search visibility during the hack usually recovers within days of the blacklist clearing, not months, as long as the content itself wasn’t altered long-term.
When to stop doing this yourself and call a developer
DIY cleanup makes sense for a single injected redirect script you can find and delete in five minutes. It stops making sense the moment you’re not sure you found every infected file, the site has real revenue or customer data on it (WooCommerce stores especially — see our guide on backup and disaster recovery for why a clean restore point matters more for stores), or you’ve already tried a plugin-based clean and the symptoms came back. A developer doing this professionally isn’t just faster — they can read the injected code well enough to confirm the actual entry point, which is the step DIY cleanups most often skip and the reason reinfections happen.
