First: Don't Panic, and Don't Start Deleting Things

Discovering your WordPress site has been hacked is stressful — redirects to spam, a "This site may be hacked" warning in Google, or a dashboard you can't log into. The instinct is to start deleting suspicious files immediately. Resist it.

Random deletion destroys the evidence you need to understand how the attacker got in, and it often misses the hidden backdoors that let them straight back afterward. A hacked site recovers best with a calm, ordered process: contain, investigate, clean, harden. Rushing straight to "delete" is how sites get reinfected days later.

Here is the order that actually works.

Step 1 — Contain the Damage

Before cleaning anything, stop the site from harming visitors and stop the attacker from doing more.

• Put the site in maintenance mode or take it temporarily offline through your hosting panel. This protects visitors from malware and stops the spam being served in your name.
• Change every password now: WordPress admin, hosting control panel, SFTP/SSH, database, and any email tied to the site. A hack usually exposes credentials, so assume all of them are compromised.
• Revoke access for unknown users — but note them first (see Step 2).

Step 2 — Investigate Before You Clean

You can't remove an infection you haven't mapped. Take stock of what was hit:

• Make a full backup of the compromised site as-is. This sounds counterintuitive, but you want a copy to investigate later and to fall back on if the cleanup goes wrong. Label it clearly as the infected copy.
• Check for unknown admin accounts under Users, All Users, filtered by Administrator. Attackers create admin users to keep access.
• Review security and server logs for unusual logins or file changes, which point to how and when the attacker got in.
• Look for a clean backup from before the hack. Ask your host for all available snapshots and note the dates. A clean pre-hack backup is the single most valuable thing you can have right now.

Step 3 — Clean the Infection

There are two paths, depending on that backup.

If you have a clean backup from before the hack, restoring it is the fastest and most reliable route — it wipes the malicious files and database changes in one step. After restoring, immediately change all passwords again and update everything before the same vulnerability is re-exploited.

If you don't have a clean backup, cleanup is manual and careful:

1. Replace WordPress core. Download a fresh copy from the official source and replace the wp-admin and wp-includes folders with clean versions.
2. Reinstall plugins and themes from fresh downloads rather than trusting the existing files, which may be infected.
3. Inspect the database for injected code, especially in the posts and options tables, and remove rogue admin users and scheduled tasks.
4. Check the usual injection points — .htaccess, wp-config.php, and index.php — for malicious code.

The hard part isn't removing the obvious malware; it's finding every backdoor. Miss one and the infection returns. If the site keeps getting reinfected, the cleanup wasn't complete.

Step 4 — Get Off Google's Blacklist

If Google flagged the site, cleaning it isn't enough — you have to tell Google. But only after the site is genuinely clean; a failed review delays future ones.

In Google Search Console, open the Security Issues report, confirm the issues are resolved, and click Request Review, describing what you fixed. Google usually responds within a few days. If your host suspended the account, contact them separately with proof the malware is gone.

Step 5 — Harden So It Doesn't Happen Again

Cleanup without hardening just resets the clock — the same hole gets exploited again, often within hours.

• Update everything: core, all plugins, all themes. Delete anything unused — inactive plugins are still exploitable.
• Run a modern, supported PHP version. Old versions have unpatched, known vulnerabilities.
• Add a firewall and ongoing malware monitoring so the next attempt is caught early.
• Enforce strong passwords and two-factor authentication on all admin accounts.
• Set up automated offsite daily backups, so any future incident collapses into a single restore.

When to Bring in a Professional

Doing this yourself is realistic if you have a clean backup and you're comfortable working in the file system and database. Bring in an expert when: there's no clean backup, the infection is cloaked or spread across the server, the site keeps getting reinfected, or Google and your host are already involved and every hour of downtime is costing you.

With 25+ years of experience securing WordPress and PHP-based sites, WPSecureGuard does server-level malware removal, blacklist recovery, and hardening — and confirms the site is actually clean, not just clean-looking.

If your site is hacked right now and you want it handled properly, get emergency help and we'll clean it fast. →