To recover a hacked WordPress site, act in this order: take the site offline or into maintenance, back up the infected copy, change every password, scan and remove malware, replace WordPress core with clean files, reinstall plugins and themes from official sources, delete unknown admin users, then request a review from Google if the site was flagged. Finish by finding and closing the hole the hacker used.
- Speed matters, but order matters more. Clean first, restore trust second.
- Back up the hacked version before cleaning. You may need it to find out what happened.
- Reinstalling clean copies of core, plugins and themes removes most injected code.
- Hidden admin users, backdoor files in uploads and modified wp-config.php are the classic leftovers.
- If you skip finding the entry point, the site usually gets hacked again within days.
How do you know your WordPress site is hacked?
Imagine a travel agency owner who searches her company name and sees Google results in Japanese selling replica watches. Her homepage looks normal to her, because the malware only shows spam to search engines and visitors from Google. That is a typical modern hack: hidden, profitable for the attacker, and damaging for the business.
Common signs include:
- Visitors are redirected to scam, casino or pharmacy sites, often only on mobile.
- Google shows “This site may be hacked” or Chrome shows a red warning page.
- Spam pages appear in Google that you never created.
- New admin users you do not recognise.
- The host suspends the account for sending spam or using too many resources.
- Strange PHP files in wp-content/uploads.
What should you do in the first hour?
- Stay calm and do not delete everything. You may lose the evidence and the clean content you need.
- Put the site in maintenance mode or ask your host to restrict access, so visitors are not infected.
- Back up the hacked site (files and database) and label it clearly as infected.
- Change passwords: WordPress admins, hosting panel, FTP/SFTP, database user and the email account linked to the admin.
- Check for a clean backup. If you have a backup from before the hack, restoring it can be the fastest path. Then patch the vulnerability immediately.
How do you clean malware from WordPress step by step?
- Scan. Run a security plugin scan such as Wordfence and ask your host for a server-side malware scan.
- Replace core. Download WordPress from wordpress.org and replace the wp-admin and wp-includes folders and the root files, except wp-config.php and wp-content.
- Reinstall plugins and themes. Delete each plugin folder and install a fresh copy. Remove any nulled (pirated) themes or plugins completely. They are one of the most common infection sources.
- Clean wp-content/uploads. Uploads should hold images and documents, never PHP files. Delete any .php files you find there.
- Inspect wp-config.php and .htaccess for long encoded strings, eval, base64_decode or unknown redirects.
- Check the database. Look at the users table for unknown admins, and search posts and options for injected script tags or spam links.
- Regenerate security keys (salts) in wp-config.php so all stolen login sessions are logged out.
Malware removal, blacklist cleanup, updates and a hardened setup with backups and a firewall. Free first check of your site.
How do you remove the Google hacked warning?
Once the site is clean, open Google Search Console, go to Security Issues, confirm the problems are fixed and click Request Review. Reviews usually take from a day to a few days. Also submit a fresh sitemap and remove spam URLs with the Removals tool so they drop out of results faster. If your host or email provider blacklisted the domain, contact them with proof of the cleanup.
How did the hacker get in, and how do you close the door?
| Common entry point | How to close it |
|---|---|
| Outdated plugin with a known vulnerability | Update or replace it, turn on auto-updates for minor releases |
| Nulled theme or plugin | Delete it and buy a licensed copy |
| Weak or reused admin password | Unique password, two-factor login, limit login attempts |
| Old PHP version or neglected hosting | Move to a supported PHP version and a host with isolation between accounts |
| Infected site on the same hosting account | Clean or delete every site in the account, not just one |
For the full prevention plan, read how to secure a WordPress website from hackers.
Frequently asked questions
Can a hacked WordPress site be fully recovered?
Yes, in almost every case. Content lives in the database and can be cleaned. Core, plugins and themes can be replaced with fresh copies.
Should I just restore a backup?
If you have a clean backup from before the hack, restoring is often fastest. You must still update everything and change passwords, or the same hole lets the attacker back in.
How long does it take to remove the Google hacked warning?
After you request a review in Search Console, Google usually responds within a few days once the site is truly clean.
Will a security plugin remove all malware?
Not always. Scanners find most infections, but hidden backdoors, database injections and server-level malware may need manual cleaning.
Why does my site keep getting hacked again?
The entry point is still open: an outdated or nulled plugin, a reused password, or another infected site on the same hosting account.
Sources
Malware removal, blacklist cleanup, updates and a hardened setup with backups and a firewall. Free first check of your site.
More WordPress guides
Guide, 5 min readWordPress Maintenance: What It Includes and What It Costs
Guide, 4 min readHow to Secure a WordPress Website from Hackers (2026 Checklist)
Guide, 3 min readHow to Price Your WordPress Services for Clients (2026 Guide)
Guide, 4 min readHow to Speed Up Your WordPress Website: Advanced Tips (2026 Guide)Rather have an expert run your WordPress site?
Tanvir H is a Bangladesh-based WordPress and Elementor web designer with 7+ years of experience, 650+ projects and a 4.9 client rating. New websites, redesigns, fixes, speed, security and SEO, handled by one expert who explains everything in plain English and works with clients worldwide.
