How to Fix a Hacked WordPress Site: Step-by-Step Removal Guide

If you are reading this because your WordPress site is redirecting visitors to spam, Google has flagged it, or your host just emailed you about malicious activity, take a breath first. WordPress malware removal is stressful but almost always fixable, and most infections follow a predictable pattern once you know where to look.

This guide walks through exactly what to do, in order, from the moment you suspect a hack to completing full WordPress malware removal and getting your site back in Google’s good graces.

Do this first, before anything else: put your site into maintenance mode or take it temporarily offline so the infection cannot keep spreading or serving malicious content to visitors while you work.

Signs your WordPress site has been hacked

Before jumping into WordPress malware removal, confirm what you are actually dealing with. Common signs include:

• Visitors get redirected to unfamiliar or spammy websites
• Google Search Console shows a security issue or manual action warning
• Your browser or antivirus flags the site as unsafe
• New admin users appear in your dashboard that you did not create
• Unfamiliar files or folders show up in your file manager or FTP client
• Your host suspends the account or emails you about malicious activity
• A sudden, unexplained drop in traffic or search rankings

If this has you second-guessing WordPress as a platform entirely, it’s worth reading our is WordPress secure breakdown, since most hacks trace back to maintenance gaps rather than the software itself.

How to fix a hacked WordPress site: step-by-step WordPress malware removal

Work through these steps in order.

Skipping ahead, especially to the cleanup step before backing up, is the most common mistake people make.

1. Take the site offline or into maintenance mode

This stops the infection from spreading further or serving malicious redirects to visitors while you investigate. Most hosting control panels offer a one-click maintenance mode, or you can use a maintenance mode plugin if you still have dashboard access.

2. Back up the infected site before touching anything

This feels counterintuitive, but you need a snapshot of the infected state in case something goes wrong during cleanup, and so a security professional can inspect it later if you end up needing one. Store this backup separately from your clean backups so the two never get mixed up.

3. Scan the site with a security plugin

Install Wordfence or a similar scanner and run a full scan. This identifies infected files, injected code, and known malware signatures so you are not searching blindly. If you already run a security plugin, check its scan history first, since it may have already flagged the infection before you noticed anything visibly wrong.

4. Change every password and secret key

Update your WordPress admin passwords, database password, hosting account password, and FTP credentials. Also regenerate your WordPress secret keys and salts in wp-config.php, which invalidates any stolen session cookies.

define('AUTH_KEY',         'put your unique phrase here');
define('SECURE_AUTH_KEY',  'put your unique phrase here');
define('LOGGED_IN_KEY',    'put your unique phrase here');
define('NONCE_KEY',        'put your unique phrase here');

You can generate fresh values from the official WordPress secret key generator rather than writing them yourself.

5. Remove unfamiliar admin users and check existing ones

Go to Users, sort by role, and delete any administrator account you do not recognize. Hackers commonly create a hidden admin account as a backdoor to regain access even after you think you have cleaned everything.

6. Reinstall WordPress core, plugins, and themes

Download fresh copies of WordPress core and every plugin and theme from the official WordPress repository or the original developer, then replace the versions on your server. This overwrites any files an attacker modified, without touching your database or uploads folder.

7. Manually inspect wp-config.php and .htaccess

These two files are common hiding spots for injected malicious code since they load on every single page request. Look for unfamiliar functions, base64-encoded strings, or redirect rules you did not add yourself.

8. Run a second full scan to confirm the site is clean

Once you have completed the steps above, run another full scan. If it comes back clean, you can move forward. If it still flags issues, repeat the manual inspection step or consider bringing in a professional cleanup service at this point.

9. Submit a reconsideration request if Google flagged your site

If Search Console shows a security issue, use the Security Issues report to request a review once you have confirmed the site is clean. This typically takes anywhere from a few hours to a few days to process.

10. Bring the site back online and monitor closely

Turn off maintenance mode, then keep a close eye on your security plugin’s alerts for the next week or two to make sure nothing was missed.

Should you do WordPress malware removal yourself or hire a professional?

Services like Sucuri’s paid plans include hands-on malware removal as part of the subscription, which is often worth it if you would rather not dig through infected files yourself or if the infection has already come back once.

Common mistakes that make a hack worse

These mistakes during WordPress malware removal tend to undo otherwise good cleanup work:

• Cleaning the visible symptom but not the backdoor. Deleting one suspicious file often is not enough. Attackers frequently leave hidden backdoors so they can regain access even after obvious malware is removed, which is why the second full scan step matters.
• Restoring from a backup that is already infected. If your backups run on a schedule, the infection may already be in your last several snapshots. Check the file modification dates before assuming any backup is clean.
• Skipping the password reset. If credentials were compromised, cleaning the files without changing every password just gives the attacker a way back in.
• Not finding out how they got in. Cleaning up without identifying the original vulnerability, usually an outdated plugin, means you are likely to get hacked again the same way.

Prevent it from happening again

Once your site is clean, the real work is making sure this does not repeat. Our full WordPress security checklist covers every layer you need: updated plugins, strong login protection, backups, and firewall monitoring.

If you are still deciding on a security plugin, see our comparison of the best WordPress security plugins, or our Wordfence vs Sucuri breakdown if you have narrowed it down to those two.

Login-specific hardening, including two-factor authentication and rate limiting, is covered in our guide on how to secure your WordPress login page.

Want the fastest path to a clean site? A security plugin with built-in malware removal, like Wordfence Premium, automates several of the steps above and can catch reinfections before they spread.

How to fix a hacked WordPress site: frequently asked questions

A few questions that come up constantly once people start dealing with WordPress malware removal on their own site.

How do I know if my WordPress site has been hacked?

Watch for unexpected redirects, new admin accounts you did not create, a security warning in Google Search Console, your host suspending the account, or a sudden unexplained drop in traffic or rankings.

Can I clean a hacked WordPress site myself?

Yes, for most small to mid-sized infections, especially if you are comfortable using FTP and a security plugin. Ecommerce sites, sites handling sensitive data, or infections that keep returning are better handled by a professional cleanup service.

How much does professional WordPress malware removal cost?

Standalone cleanup services typically range from $100 to $300 for a one-time fix, while ongoing plans that include cleanup as part of a security subscription often run $200 to $500 per year depending on the provider.

Why does my WordPress site keep getting hacked?

Usually because the original vulnerability was never fixed, most often an outdated plugin, a weak password, or a hidden backdoor left behind from the first infection. Cleaning the visible symptoms without finding the entry point leads to repeat infections.

Will Google penalize my site permanently after a hack?

No. Google removes security warnings once you submit a reconsideration request and the site is confirmed clean. Rankings typically recover over the following weeks, though the exact timeline varies by site and how long the infection was active.

How long does it take to clean a hacked WordPress site?

A straightforward DIY cleanup usually takes two to four hours. Professional services often complete cleanup within 24 to 48 hours. Complex infections with multiple backdoors can take longer either way.

Can a hacked WordPress site infect my computer?

Directly, no. But if the site is serving malware to visitors, and you visit it yourself while investigating, your own device could be at risk. It is safer to inspect files through your hosting control panel or FTP rather than browsing the live infected site.

Should I restore from a backup instead of cleaning the hack?

Only if you have a backup from before the infection occurred and can confirm it is clean. Restoring an infected backup just brings the malware back with it.

Some links on this page are affiliate links, meaning we may earn a commission if you sign up through them, at no extra cost to you.