By Hridoy Ahmed | Last updated: October 2026 | 8 min read
Short answer: A WordPress site keeps getting hacked after cleanup when the attacker still has a way back in: a hidden backdoor, a vulnerable plugin, a stolen password or a compromised hosting account. Close every entry point, change all credentials, then monitor files, users, backups and Google Search Console for at least 30 days. Use the checklist below.
In this guide
- Why sites get hacked again
- First 24 hours
- First week
- First 30 days and after
- Signs of reinfection
- FAQ
Why sites get hacked again
- A backdoor remains. Hidden code lets the attacker return. Read my guide on WordPress backdoors.
- The weak point is still open. An outdated plugin or theme, or a nulled (pirated) one, stays vulnerable.
- The password is still known. The attacker has your old password, or a stolen session stays active.
- Another site in the same account is infected. See my guide on a compromised hosting account.
- The database stays infected. Cleaned files plus a dirty database equal a reinfection. See malware in the WordPress database.
- A fake admin user returns. See unknown admin users.
First 24 hours after cleanup
- Change every password: WordPress, hosting panel, FTP, SSH, database and email.
- Generate new security keys and salts in wp-config.php.
- Update WordPress core, plugins and themes. Delete the ones you do not use.
- Check the list of administrators and remove unknown users.
- Turn on two-factor authentication for every admin.
- Take a fresh, clean backup and store a copy offsite.
- Clear every cache, including the CDN.
- If Google flagged your site, request a review. See how to remove the “This site may be hacked” warning.
First week
- Check the admin user list every day.
- Run a malware scan and compare core and plugin files with official copies.
- Look for new or changed files you did not make, especially PHP files in the uploads folder.
- Check Google Search Console for security issues and new, unknown pages.
- Search Google for
site:yourdomain.comand look for spam titles. - Watch your site on a phone and from a Google search result, because some malware hides from direct visits.
- Review your uptime monitor alerts.
First 30 days and after
- Run a scan once a week.
- Review users and file changes once a week.
- Test a backup restore at least once. A backup you never tested is a guess.
- Review access logs, if your host gives them, for unusual requests.
- Add a firewall. See my guide on the WordPress firewall.
- Apply a few hardening steps, such as disabling the file editor.
- Follow my WordPress security checklist every month.
Signs of reinfection
| Sign | What to do |
|---|---|
| Redirects or pop-ups return | Check theme files, .htaccess and third-party scripts |
| New admin user | Delete it, change all passwords and search for a backdoor |
| Unknown PHP files | Compare against clean files and remove them |
| Spam pages in Google | Remove the pages, fix the cause and request a review |
| Security plugin alerts | Read the alert, check the file and do not ignore repeated warnings |
| Sudden traffic drop | Check Search Console for manual actions and security issues |
If one of these signs returns, assume a backdoor remains. Stop patching and review all files, or ask for help through my WordPress security service.
FAQ
Why does my WordPress site keep getting hacked?
The attacker usually still has access through a backdoor, a vulnerable plugin, a stolen password or another infected site on the same account.
How long should I monitor after cleanup?
Watch the site closely for at least 30 days, then keep a weekly routine.
Can a security plugin stop reinfection?
A plugin helps with scanning and blocking, but it cannot replace updates, strong passwords and a full cleanup.
Should I change hosts after a hack?
Only if the host caused the problem or does not help. Clean first, or you carry the infection to the new host.
Is a restore from backup enough?
No. A restore removes the infection, but the entry point stays open. Update everything and change all credentials.
Tired of cleaning the same site again? I find the cause, close it and set up monitoring. See my WordPress malware removal service.
About the author: Hridoy Ahmed is an SEO specialist and WordPress security expert based in Dhaka, Bangladesh. He has 8+ years of experience and works with clients worldwide.