Quick answer: If your WordPress site is hacked: (1) don’t panic and don’t delete things randomly, (2) take a backup of the hacked site for checking, (3) change all passwords, (4) scan files and the database, (5) replace WordPress core, themes and plugins with fresh copies, (6) remove unknown admin users and hidden backdoor files, (7) update everything, and (8) ask Google to review the site if it shows a warning.
Signs your website is hacked
- Visitors are redirected to strange websites
- Google shows spam pages (often Japanese or pharma words) for your site
- “This site may be hacked” warning in Google
- New admin users you don’t know
- Your hosting suspends the account
- Unknown files in your hosting folders
Why malware keeps coming back
This is the most common problem. People delete the bad files, but the hacker left a backdoor — a hidden file or code that lets them get back in. Common hiding places:
- Fake plugin folders
- Files inside
wp-content/uploadsending in.php - Changed
wp-config.php,.htaccessor themefunctions.php - Code inside the database (posts, options, widgets)
- Unknown admin users or scheduled tasks (cron)
Step-by-step cleanup
1. Take a copy first
Download the files and database. You may need them to find how the hacker got in.
2. Change all passwords
WordPress admins, hosting, FTP/SFTP, database and email. Use long, unique passwords.
3. Remove unknown users
Check Users in WordPress and in the database. Remove anyone you don’t recognise.
4. Replace core files
Download fresh WordPress and replace wp-admin and wp-includes. Never edit these folders.
5. Reinstall plugins and themes
Delete and reinstall from the official source. Remove anything you don’t use. Never install cracked or “nulled” plugins from unknown websites — they often contain hidden malware and are a very common cause of hacks.
6. Check uploads and other folders
The uploads folder should contain images and documents — not PHP files.
7. Clean the database
Search for suspicious scripts, iframes and links in posts, options and widgets.
8. Regenerate security keys
Create new salts in wp-config.php so all logged-in sessions end.
9. Scan again
Use a security plugin like Wordfence or Sucuri to scan again.
10. Ask Google to review
In Google Search Console, check “Security issues” and request a review after cleaning.
How to stop hacks in future
- Keep WordPress, themes and plugins updated
- Use strong passwords and two-factor login
- Limit login attempts
- Daily off-site backups
- A firewall (Wordfence, Cloudflare or your host’s)
- Use only trusted plugins and themes
- Correct file permissions
Questions people ask
Why does my WordPress site keep getting hacked again?
Usually because a backdoor was left behind, a vulnerable or nulled plugin is still installed, or passwords were not changed after cleaning.
Can I fix a hacked WordPress site myself?
Simple infections can be fixed with careful steps. For repeat infections, database malware or hosting suspension, professional help is safer.
Will Google remove my site from search if it is hacked?
Google may show warnings or drop spam pages. After cleaning, request a review in Search Console, and rankings usually recover.
How do I know if a plugin is safe?
Download only from WordPress.org or the official developer, check recent updates and reviews, and avoid nulled copies.
Need help cleaning a hacked site?
We clean hacked WordPress websites, find backdoors, and secure them so the malware doesn’t come back. See our website maintenance and security service or get a free quote.