How to Clean a Hacked WordPress Site, Step by Step

A hacked site is not fixed in the order panic suggests. The most common mistake is to start deleting suspicious files immediately. After that the site stops working, the evidence is gone, and the attacker is still inside.

Step 0. Freeze the current state

Before deleting anything, take a full copy: files and database. Yes, the infected one.

You need it for two reasons. If something necessary breaks during the cleanup, you have somewhere to return to. And that copy is what later shows you how they got in and what they did.

Step 1. Work out what actually happened

• Spam in search results - pages on your domain that are not yours. The classic case is the japanese keyword hack.
• Visitor redirects - the site sends people elsewhere, often only on mobile or only from search.
• Defacement - someone else's page instead of your homepage. Obvious immediately, easiest to fix.
• Spam sending - the host blocks your mail and the domain lands on blocklists.
• A hidden miner or backdoor - the site seems fine but server load has climbed.

Useful places to look: Security Issues in Search Console, hosting access logs for the period when things went odd, and file modification dates.

Step 2. Close the way in

This is the most important step and the one usually skipped. While the attacker still has access, cleaning is pointless.

1. Change passwords: every WordPress administrator, the hosting panel, FTP and SFTP, the database user.
2. Update the security keys in wp-config.php. That logs out everyone, including whoever is sitting in your admin right now.
3. Delete unknown WordPress users.
4. Check property owners in Search Console and remove anyone who should not be there.

Step 3. Replace what can be replaced

Core, plugins and themes can always be fetched fresh from the official source, so they are not cleaned, they are reinstalled.

• WordPress core: reinstall the same version over the top.
• Plugins: delete and install again from the repository. Anything no longer maintained should be replaced, not kept.
• Theme: reinstall a stock theme; a custom one has to be reviewed by hand.

Step 4. Clean what cannot be replaced

• wp-content/uploads - there should be no .php files here at all;
• .htaccess in the root and in subfolders - appended redirect rules;
• wp-config.php and index.php - foreign lines at the top of the file;
• active theme files, particularly functions.php and header.php;
• in the database: the options table, post content, scheduled tasks.

Step 5. Clean up the search aftermath

1. Spam URLs should return 410, not 404 and not a redirect home.
2. Delete the attacker's sitemap and submit your own.
3. File a review request in Search Console describing the work performed.
4. Check site:yoursite.com again a week later.

When not to do it yourself

• The infection returns after cleaning, which means something was missed.
• The site is commercial and downtime costs money every day.
• Several sites share the server: the infection moves between them and all of them need cleaning at once.
• Google is already showing a warning to visitors.
• There is no backup and no certainty about what changed.