Quick answer: To fix a hacked WordPress site, contain the incident, preserve a backup of the compromised state for investigation, secure hosting and administrator accounts, identify and remove malware and backdoors, update vulnerable software, restore clean files or a verified backup, and check Google Search Console for security warnings. Simply installing a security plugin or deleting one suspicious file may not remove the attacker’s access.
First: protect the site and its visitors
If the site is redirecting visitors, distributing malware, showing spam pages or exposing customer data, treat it as an incident—not just an SEO issue. Contact your host, restrict access where appropriate and consider temporarily placing the site in maintenance mode. If personal or payment information may be involved, follow your legal, contractual and payment-provider incident procedures.
Step 1: preserve evidence and create a backup
Before deleting files, make a copy of the current files, database, logs and relevant timestamps. Store it securely and do not restore the compromised copy as if it were clean. Evidence can help identify the entry point and distinguish malicious changes from normal plugin or theme files.
Step 2: secure the hosting and account layer
- Change passwords from a clean device for hosting, WordPress administrators, SFTP/SSH, database, email and any connected services.
- Revoke unknown WordPress users, application passwords, API keys and active sessions.
- Enable two-factor authentication where available.
- Ask your host to check account-level compromise, scheduled tasks, PHP processes and other sites on the same hosting account.
- Do not share your primary hosting password with a cleanup contractor; create temporary named access if needed.
Step 3: identify the infection
Review recent file changes, unknown administrator accounts, unexpected redirects, injected scripts, unfamiliar PHP files, suspicious scheduled tasks and modified core, theme or plugin files. Use a reputable scanner as one signal, not as proof that the site is clean. Compare WordPress core files against official versions and reinstall trusted copies of plugins and themes from their original sources.
Check the database too. Malicious code can be stored in posts, options, widgets or injected scripts, so a file-only scan may miss it. If you cannot confidently distinguish malicious code from legitimate code, ask an experienced incident responder before deleting files.
Step 4: remove malware and backdoors
Remove unrecognized accounts and malicious code only after confirming what it is. Replace modified core files with clean official copies. Reinstall plugins and themes from trusted sources rather than trying to repair every unknown edit by hand. Remove abandoned or nulled software. Check uploads for executable files where they should not exist, and inspect persistence mechanisms such as cron jobs and must-use plugins.
Backdoors are especially important: an attacker may return if a hidden access path remains. See our guide to finding WordPress backdoors.
Step 5: restore from a known-clean backup if appropriate
A clean backup can be safer than uncertain manual cleanup, but first verify its date and whether the vulnerability or compromised credentials existed at that time. Restoring a backup without fixing the original entry point can lead to reinfection. Test the restored site before making it public.
Step 6: update and harden WordPress
- Update WordPress core, themes and plugins to supported secure versions.
- Delete unused plugins and themes.
- Replace weak or reused passwords and use unique administrator accounts.
- Check file ownership and permissions with your host or developer; avoid blindly applying broad permission changes.
- Keep regular off-site backups and test restoration.
- Use a firewall and monitoring appropriate to the site’s risk.
- Review least-privilege access for all users and contractors.
Step 7: check SEO and Google security status
Open Google Search Console and review the Security Issues and Manual Actions reports. Search for unexpected URLs and check whether Google displays a hacked-site warning. Once the site is cleaned and the underlying issue fixed, follow Google’s review process if a security warning remains. A review request should be made only after the remediation is complete.
Useful related guides: remove the “This site may be hacked” warning, Google Safe Browsing blacklist removal, and the WordPress security checklist.
How long does WordPress malware removal take?
It depends on the number of infected files, database changes, hosting access, backups, and whether the attacker has compromised the hosting account or other sites. A simple infection may be contained quickly; a persistent compromise can require deeper investigation. Be suspicious of a service that promises a guaranteed cleanup time without inspecting the site.
Frequently asked questions
Can I fix a hacked WordPress site with a plugin?
A security plugin can help detect issues and reduce risk, but no scanner can guarantee that every backdoor or database injection has been found. Complex incidents may require manual investigation.
Should I delete every suspicious PHP file?
No. First verify whether it is malicious and preserve evidence. Deleting legitimate files can break the site, while missing a backdoor can allow reinfection.
Will a hack damage SEO?
It can. Spam pages, malicious redirects and security warnings can harm visibility and visitor trust. Clean the site, fix the cause, then review indexing and security status.
Should I reinstall WordPress?
Replacing core files with clean official copies can help, but it does not automatically clean the database, uploads, themes, plugins, hosting account or persistence mechanisms.
When to hire a specialist
Get professional incident response if the site handles customer data, the compromise keeps returning, you cannot identify the entry point, multiple sites share the account, or the site is blacklisted. Ask for a written scope covering cleanup, root-cause analysis, verification and post-cleanup hardening—not just “malware removal.”
Security note: steps vary by host and incident. Preserve evidence, avoid destructive changes you cannot verify, and involve your hosting provider or a qualified incident responder for high-impact compromises.