Hacked WordPress site: cleanup and recovery step by step

You open your site in the morning and instead of the home page you see a gambling or pharmacy site. Or a customer says her browser shows a "This site is dangerous" warning. Or your host has suspended the site because of unusual resource usage. Each of these smells like an infection.

The first reaction is usually panic and deleting things at random. It is better to proceed calmly and in order, because order matters: if you delete files before closing the door, the infection comes back. If your site is still healthy and you want prevention, the WordPress security checklist is the right place.

1. Back up first, even the infected site#

Take a copy of all files and the database and keep it separate. This copy is infected and must not be restored to the live site, but you need it for later investigation and to find the way in. Then, if your host allows it, put the site in maintenance mode or show a simple page so visitors are not infected.

2. Change all access credentials#

Before any cleanup, close the door:

1. Change the passwords for the hosting account (cPanel or a similar panel), FTP/SFTP and the database.
2. Change the password of every WordPress user with the administrator or editor role; delete unknown users.
3. Change the security keys (salts) in wp-config.php so the attacker's active sessions are invalidated.
4. Change the password of the site administrator's email too; WordPress password resets come from that email.

If you have WP-CLI, you can change the salts with one command:

wp config shuffle-salts

3. Replace core and plugins from a clean source#

Instead of hunting through files, replace the core files completely with a fresh official version. Your content in wp-content and the wp-config.php file are not touched:

wp core verify-checksums
wp core download --force --skip-content
wp plugin verify-checksums --all

The first command lists modified core files. The second overwrites the core on itself. The third compares plugins from the official repository against the original version. Delete any plugins and themes that have been modified and reinstall them fresh from the official source. Never bring back a "nulled" plugin or one downloaded from unknown sites; these are a common cause of infection. You can also do this without WP-CLI: download the WordPress zip and replace the wp-admin and wp-includes folders and the root files.

4. Look for backdoors#

Attackers usually leave several ways back in. Check these places:

• The uploads folder: there should be no PHP files there.
• Users: unknown administrators.
• Root files: .htaccess, index.php, and new files with names similar to core files.
• The active theme and mu-plugins: extra code in functions.php or an unfamiliar folder.
• The database: scripts injected into content or options.

find wp-content/uploads -name "*.php"
find . -name "*.php" -mtime -7
grep -rIl "base64_decode\|eval(" wp-content --include=*.php
wp user list --role=administrator

A grep result is not necessarily malware; some legitimate plugins also contain base64_decode. Compare each hit with the plugin's original code. For the database, look for unfamiliar script and iframe tags in the posts table, and remove them only after taking a database backup.

5. If you have a clean backup#

Restoring a version from before the infection is sometimes the fastest route, provided you know when the infection started. See the method in restoring a WordPress backup. After restoring, update everything and change the passwords right away.

6. Lock down, verify, notify#

If the site holds user data, it is best to notify them and force a password reset on the site.

Preventing a repeat#

Most hacks come from an outdated plugin, a weak password or an abandoned file. Harden passwords and login with secure WordPress login, keep updates regular using the method in safe WordPress updates, and set up automatic backups: automatic WordPress backups.

Early warning signs#

Often an infection started weeks before it is noticed. A few small signs worth checking: a sudden rise in CPU or bandwidth usage in the hosting panel, spam email being sent from your site, your site's search results showing unfamiliar titles (for example in another language), sudden slowness, and files whose modification dates do not match your work.

To find spam pages, search site:example.com in Google and see which titles are indexed. If you see pages you did not create, it is almost certain the site has been tampered with.

What to ask after cleanup#

The cleanup is not finished until you can answer a few questions. Was the cause of the break-in found? If it was a vulnerable plugin, was it removed or updated? Were all users and keys changed? Do you have a fresh, clean backup? Have you tested the site in an incognito browser and from a mobile phone? Sometimes an infection redirects only visitors who come from Google, or only on mobile.

If you do not know any of this and do not have time, it is better to put the site in maintenance mode for now and get help from a specialist or your host's support. A site that is still infected and stays online hurts both your reputation and your Google ranking.

Summary#

• First back up the current state, then close the door; cleanup without closing the door is pointless.
• Change the hosting, FTP, database and user passwords and rotate the salts.
• Replace core with the official version and reinstall modified plugins from the official source.
• Search uploads, administrator users, the active theme and the database for backdoors.
• Find and close the cause of the break-in, or the infection will return.
• Monitor for a few days after cleanup and request a review in Search Console.