How to Fix Hacked WordPress Site: Proven Recovery Steps That Actually Work (2026)

To fix a hacked WordPress site, scan your files for malware, remove all infected code, replace corrupted core files with fresh copies from wordpress.org, close every backdoor, change all passwords, and harden your security settings to prevent reinfection. The full How to Fix Hacked WordPress Site cleanup takes 4-8 hours following the step-by-step process below.

Your WordPress site’s been compromised and you need to know How to Fix Hacked WordPress Site fast. The redirect hijacking has started, Google’s throwing warnings, and you’re staring at defaced pages wondering how the hell this happened. Before you panic or shell out $500 to some “security expert” who’ll do exactly what you can learn right here, take a breath. Most WordPress hacks follow predictable patterns, and the cleanup process is straightforward if you know what you’re doing.

This How to Fix Hacked WordPress Site guide isn’t another fluffy security article full of theory. This is the step-by-step playbook I’ve used to clean dozens of compromised sites — from small business blogs to e-commerce stores that got hit with payment skimmers. We’ll cover everything you need to know about How to Fix Hacked WordPress Site — from identifying the infection to hardening your site against future attacks.

The hard truth? Most WordPress hacks happen because site owners ignore the basics — outdated plugins, weak passwords, and the “set it and forget it” mentality. But here’s the good news: once you understand How to Fix Hacked WordPress Site properly, you’ll never be caught off guard again.

Here is what every site owner needs to know about How to Fix Hacked WordPress Site — the steps are predictable, the tools are free, and the knowledge you gain protects you permanently.

Signs Your WordPress Site Has Been Hacked (How to Confirm the Worst)

Before we dive into How to Fix Hacked WordPress Site, you need to confirm you’re actually dealing with a compromise and not just a broken plugin or server issue. Here are the telltale signs that scream “you’ve been hacked”:

Redirect Hijacking: Your site automatically redirects visitors to pharmacy ads, adult content, or fake security warnings. This is the most common symptom and usually indicates malicious JavaScript injection or .htaccess manipulation.

Defaced Pages: Your homepage displays content you didn’t put there — political messages, hacker group signatures, or complete visual destruction of your design.

Unknown Admin Accounts: Check your wp-admin → Users section. If you see administrator accounts you didn’t create, especially with cryptic usernames like “admin2” or random strings, you’ve got unauthorized access.

Google Warning Messages: The big red “This site may be hacked” or “Deceptive site ahead” warnings in search results. Once Google flags your site, you’re looking at massive traffic drops until your How to Fix Hacked WordPress Site cleanup is complete.

To confirm the hack, check these resources immediately:

1. Try accessing wp-admin: Can you still log in? If passwords have been changed or you’re locked out, that’s confirmation.
2. Google Safe Browsing: Visit Google Safe Browsing and enter your URL. This free tool shows exactly what Google sees.
3. Sucuri SiteCheck: Run a free external scan at sitecheck.sucuri.net to identify malware, blacklist status, and injected code.

Common Hack Symptoms That Business Owners Miss

Knowing How to Fix Hacked WordPress Site starts with recognizing the subtle symptoms that indicate ongoing compromise:

Mysterious Traffic Spikes: Your analytics show traffic from countries you don’t serve, especially if it’s all bouncing immediately. This often indicates your site is being used in a botnet or spam operation.

Contact Form Spam Explosion: If your contact forms suddenly receive 10x more spam, hackers might have injected code that’s harvesting email addresses or using your forms for spam relay.

Server Resource Usage: Check your hosting panel for CPU and memory spikes. Cryptocurrency mining scripts and spam operations consume significant server resources.

Immediate Steps Before You Touch Anything

Hold up. Before you start the actual How to Fix Hacked WordPress Site process, you need to secure the evidence and prevent further damage. Skipping these steps is like performing surgery without gloves — you’ll likely make things worse.

Take a Full Backup of the Hacked Site: Yes, you read that right. The first step in How to Fix Hacked WordPress Site is to back up the compromised site before cleaning it. Why? Because you need to analyze how the hack occurred, and sometimes cleanup goes wrong. Use your hosting panel’s backup tool or download everything via FTP. Store this backup separately from your clean backups.

Put the Site in Maintenance Mode: Protect your visitors and prevent further damage by enabling maintenance mode. Add this to your wp-config.php file above the “That’s all, stop editing” line:

define('WP_MAINTENANCE', true);

Or use your hosting control panel’s maintenance mode feature. Don’t let visitors interact with a compromised site.

Isolating the site is a non-negotiable first move in any How to Fix Hacked WordPress Site playbook because it stops the bleeding while you work on the cure.

Change ALL Passwords Immediately: This critical How to Fix Hacked WordPress Site step means everything — WordPress admin passwords, FTP/SFTP credentials, database passwords, and hosting cPanel access. Use strong, unique passwords for each service. Many hacks exploit weak passwords or credential reuse across services, which is why password rotation is a foundational step in any How to Fix Hacked WordPress Site recovery.

Why You Should NOT Panic-Delete Everything

One of the biggest mistakes when learning How to Fix Hacked WordPress Site is nuking the entire site the moment a hack is discovered. Here’s why controlled cleanup beats scorched earth:

You’ll Lose Legitimate Data: Wholesale deletion often destroys customer data, recent content updates, and customizations that aren’t backed up elsewhere.

Backup Contamination: If your recent backups are infected (which is common), you’ll restore the malware along with your content. Understanding the infection timeline helps identify clean restore points.

Learning Opportunity: Analyzing the hack teaches you exactly what went wrong, preventing future incidents. Delete everything and you’ll repeat the same security mistakes.

The systematic How to Fix Hacked WordPress Site approach I’ll show you preserves your data while eliminating the threats. It’s more work upfront but saves massive headaches later.

Step 1 — Scan for Malware and Identify Infected Files

Now we get into the actual How to Fix Hacked WordPress Site process. First step is reconnaissance — identifying exactly what you’re dealing with. Think of this as the diagnostic phase before treatment.

Free Scanning Tools That Actually Work:

• Wordfence Security (Free Version): Install from the WordPress plugin repository and run a full scan. It’s excellent at detecting known malware signatures and file modifications.
• Anti-Malware Security and Brute-Force Firewall: Another free plugin that catches what Wordfence sometimes misses. Run both for comprehensive coverage.
• Sucuri SiteCheck (External): This scans your site from the outside, catching client-side injections that internal scanners miss.

Running multiple scanners is a core part of How to Fix Hacked WordPress Site because no single tool catches everything — each scanner has blind spots the others cover.

Manual Red Flags to Look For:

base64_decode() Functions: Search your files for “base64_decode” — this PHP function is used to hide malicious code. Legitimate plugins rarely use it.

eval() Statements: The eval() PHP function executes code from strings, making it perfect for obfuscated malware. Any eval() in your files deserves investigation.

Modifications in wp-includes/: WordPress core files should never be modified. If your scanner flags changes in wp-includes/ or wp-admin/, you’re dealing with core file injection.

Unknown .php Files in wp-content/uploads/: The uploads directory should contain media files, not PHP executables. Any .php files here are likely backdoors.

Manual File Comparison Using WordPress Core Checksums

Here’s an advanced How to Fix Hacked WordPress Site technique most security guides skip — verifying your WordPress core files against official checksums. If you have SSH access to your server, run:

wp core verify-checksums

This WP-CLI command is essential for anyone following How to Fix Hacked WordPress Site — it compares every core file against WordPress.org’s official versions and reports discrepancies. Modified core files are smoking guns for malware injection.

Don’t have SSH? This How to Fix Hacked WordPress Site step still works — use the file comparison feature in security plugins, or manually download fresh WordPress files from wordpress.org and compare file sizes/dates in your FTP client.

Step 2 — Remove Malicious Code and Clean Core Files

Time for the surgical part of How to Fix Hacked WordPress Site. We’re going to systematically remove infected code while preserving your legitimate data. This requires precision — one wrong move and you’ll break functionality that wasn’t related to the hack.

Replace wp-includes/ and wp-admin/ Completely: This How to Fix Hacked WordPress Site step is critical — don’t try to surgically remove malware from core directories. Download the latest WordPress from wordpress.org, extract it, and upload fresh wp-includes/ and wp-admin/ folders via FTP. This nuclear option eliminates all core file infections without touching your content or customizations.

Inspect wp-config.php Manually: This part of How to Fix Hacked WordPress Site requires careful attention — open wp-config.php in a text editor and look for anything that doesn’t belong. Malware commonly injects itself here because this file executes on every page load — making wp-config.php a top priority when you need to How to Fix Hacked WordPress Site. Look for:

• Extra require() or include() statements
• base64_encoded strings
• Code that creates files or sends HTTP requests
• Anything after the “That’s all, stop editing!” comment

Clean Critical Theme Files: In any How to Fix Hacked WordPress Site procedure, these files are malware magnets because they load on every page:

• functions.php: Check for unauthorized function additions, especially ones that register new admin users or modify HTTP requests
• header.php: Look for injected JavaScript, especially obfuscated code or external script inclusions
• footer.php: Common location for SEO spam links and tracking code injections

Audit Your .htaccess File: Download your .htaccess file and review every line. Malicious redirects often hide here. Look for:

• RewriteRule directives you didn’t create
• Redirects to external domains
• Code that only affects certain user agents (mobile, search engines)

If you’re unsure what belongs during your How to Fix Hacked WordPress Site cleanup, backup your current .htaccess and replace it with a minimal version. You can always add legitimate rules back later.

Cleaning the Database (wp_options Spam Links, Rogue Users)

Database cleanup is where most DIY security efforts fall short, but it’s crucial for complete How to Fix Hacked WordPress Site recovery. Malware often injects spam links and creates persistent backdoors through database modifications.

Remove Unauthorized Admin Users: Access phpMyAdmin through your hosting control panel and examine the wp_users table. Look for accounts you didn’t create, especially those with user_login values like “admin”, “administrator”, or random strings. Before deleting, check the wp_usermeta table for corresponding entries and remove those too.

Clean wp_options Table: This is where hackers hide persistent malware. In phpMyAdmin, search the wp_options table for:

• option_name values containing “cron” — look for fake cron jobs that download/execute code
• option_value fields with suspicious URLs or base64_encoded content
• Recent entries (check option_id numbers) that you don’t recognize

Pro tip for anyone following this How to Fix Hacked WordPress Site guide: export a backup of wp_options before making changes. Database edits during How to Fix Hacked WordPress Site are unforgiving.

Check for Injected Posts and Comments: Scan wp_posts for content you didn’t create, especially posts with post_status = ‘private’ that might contain spam links. Also check wp_comments for spam that might affect your site’s reputation.

Thorough database inspection is what separates a professional How to Fix Hacked WordPress Site cleanup from a half-measure that lets the infection return within days.

Step 3 — Find and Close Backdoors

Here’s where the How to Fix Hacked WordPress Site process gets critical. You can clean infected files all day, but if backdoors remain, hackers will reinfect your site within hours. Backdoors are the hidden entrances that allow persistent access even after passwords are changed.

Common Backdoor Locations:

wp-content/uploads/: Check every subdirectory for .php files that shouldn’t exist. Legitimate uploads are images, videos, PDFs — not executable PHP scripts. Common backdoor names include “wp-config.php” (fake), “index.php”, or random string filenames.

mu-plugins Directory: Files in wp-content/mu-plugins/ execute automatically on every page load, making this prime real estate for persistent malware. This directory might not exist on clean installations, so any mu-plugins folder deserves scrutiny.

Theme Directories: Backdoors often masquerade as legitimate theme files. As part of your How to Fix Hacked WordPress Site search, look in wp-content/themes/ for PHP files with names like “404.php” or “functions.php” in inactive themes — these might be disguised backdoors.

Finding Recently Modified Files: If you have SSH access, this command reveals files modified in the last 30 days:

find /path/to/wordpress -name "*.php" -mtime -30 -ls

Cross-reference this list with your site changes as part of your How to Fix Hacked WordPress Site investigation. Files modified on dates when you weren’t working on the site are suspicious.

File Permissions Audit: Backdoors often modify file permissions to ensure persistence. Check for:

• Files with 777 permissions (read/write/execute for everyone)
• Directories that shouldn’t be writable by the web server
• Core WordPress files with modified permissions

Locking down file permissions is the final step in How to Fix Hacked WordPress Site backdoor removal — it ensures attackers cannot write new malicious files even if they find another entry point.

When completing your How to Fix Hacked WordPress Site cleanup, correct file permissions should be 644 for files and 755 for directories. Your WordPress File Permissions guide covers the security implications in detail.

Hidden Admin Accounts and Cron Job Backdoors

This is where the How to Fix Hacked WordPress Site process gets tricky — sophisticated attacks create multiple persistence mechanisms. Even after cleaning files and removing obvious admin accounts, backdoors can remain through these vectors:

Hidden Admin Creation Scripts: Some malware injects code that recreates admin accounts automatically. Check your theme’s functions.php and any custom plugins for code that calls wp_create_user() or similar functions. This is especially common in backdoors that appear to create “support” or “maintenance” accounts.

WordPress Cron Backdoors: Malicious cron jobs can download and execute code on a schedule. In wp-admin, go to Tools → Site Health → Info → Scheduled Events and look for events you don’t recognize. You can also check the wp_options table for option_name = ‘cron’ to see raw cron data.

For a deeper dive into WordPress scheduling, check our comprehensive WordPress Cron Jobs guide which covers both legitimate uses and security implications.

Skipping the backdoor hunt is the number one reason How to Fix Hacked WordPress Site efforts fail — the visible malware gets cleaned but the hidden access points remain active.

Step 4 — Harden Your Site Against Reinfection

Cleaning the hack is only half the How to Fix Hacked WordPress Site battle. Without proper hardening, you’re just waiting for the next attack. This phase of How to Fix Hacked WordPress Site focuses on making your site a harder target than 90% of WordPress installations out there.

Update EVERYTHING Immediately: Start with WordPress core, then themes, then plugins. Yes, all of them. The WordPress update process includes security patches that close known vulnerabilities. Hackers specifically target outdated installations because exploits are publicly available.

Delete Unused Themes and Plugins: Any How to Fix Hacked WordPress Site checklist will tell you: every inactive theme and plugin is a potential attack vector. If you’re not using it, delete it completely — don’t just deactivate. Inactive code can still be exploited if it contains vulnerabilities.

Implement Security Headers: Add these to your .htaccess file to protect against common attacks:

# Security Headers
Header always set X-Frame-Options "SAMEORIGIN"
Header always set X-Content-Type-Options "nosniff"
Header always set Referrer-Policy "strict-origin-when-cross-origin"
Header always set Permissions-Policy "geolocation=(), microphone=(), camera=()"

Install a Web Application Firewall (WAF): The Wordfence free tier blocks most automated attacks and brute force attempts. For more advanced protection, consider Sucuri’s firewall, but honestly, Wordfence free plus proper site maintenance stops 95% of attacks.

Enable Two-Factor Authentication: This single change prevents 99% of brute force attacks. Use Google Authenticator, Authy, or a hardware token. Our WordPress Two Factor Authentication guide walks through setup for major plugins.

Limit Login Attempts: Install a plugin that locks out IP addresses after failed login attempts. This stops brute force attacks cold and reduces server load from bot traffic.

The WordPress Security Checklist Every Site Owner Needs

This How to Fix Hacked WordPress Site prevention checklist should be run quarterly. Most hacks exploit basics that take 30 minutes to fix:

Security Task	Frequency	Priority
Update WordPress Core	Within 48 hours of release	Critical
Update All Plugins	Weekly	High
Change Admin Passwords	Every 6 months	High
Remove Unused Plugins/Themes	Quarterly	Medium
Review User Accounts	Monthly	Medium
Security Scan	Weekly	Medium

The key to How to Fix Hacked WordPress Site permanently is consistency. A site that follows this checklist religiously is exponentially harder to compromise than one that ignores basic maintenance.

How to Fix Hacked WordPress Site When You Can’t Access wp-admin

Not every How to Fix Hacked WordPress Site scenario gives you dashboard access. When you are locked out completely, these emergency methods become your lifeline.

Sometimes the hack is so severe that wp-admin is completely inaccessible — passwords don’t work, login pages redirect to malware, or the admin area is completely broken. Don’t panic. This scenario requires a different approach to How to Fix Hacked WordPress Site, but it’s still manageable.

FTP/SFTP File Cleanup: This alternative How to Fix Hacked WordPress Site method starts with FTP — connect to your server and begin with the core file replacement strategy. Upload fresh wp-admin/ and wp-includes/ directories, then work through theme and plugin files methodically. Without wp-admin access, you’ll need to clean files manually, but the process is the same.

phpMyAdmin Database Fixes: Access your hosting control panel and open phpMyAdmin. Here’s how to reset admin access:

1. Reset Admin Password: Find your user in wp_users table, click Edit, and replace the user_pass field with an MD5 hash of your new password (use an online MD5 generator).
2. Remove Rogue Users: Delete any wp_users entries you don’t recognize, then find corresponding entries in wp_usermeta (same user_id) and delete those too.
3. Clean wp_options: Look for malicious entries in option_name and option_value fields, especially anything containing base64_encoded strings or suspicious URLs.

Emergency Recovery via Hosting cPanel: Most hosting providers offer automatic WordPress recovery tools in their control panels. Look for options like “WordPress Toolkit” or “Softaculous” that can restore core files or reset installations while preserving your database and uploads.

If all else fails, you can manually recreate wp-config.php with your database credentials and authentication keys from the WordPress Secret Key Generator. This often restores basic functionality when the config file is corrupted.

What to Do After Cleanup — Notifying Google and Rebuilding Trust

Completing the technical How to Fix Hacked WordPress Site process is just the beginning. Now you need to repair your site’s reputation and ensure the hack doesn’t tank your search rankings permanently.

This post-cleanup phase of How to Fix Hacked WordPress Site is where many site owners drop the ball — they clean the infection but never tell Google the site is safe again.

Submit Google Reconsideration Request: If your site was flagged in Google Search Console, submit a reconsideration request immediately after cleanup. Be specific about what you found and how you fixed it. Google reviews these requests manually, so honesty and detail help your case.

In your request, include:

• Specific malware types you identified and removed
• Security measures implemented to prevent reinfection
• Timeline of when cleanup was completed

Monitor Google Safe Browsing Status: Check Google Safe Browsing daily for the first week after cleanup. It can take 72 hours for Google to re-scan your site and remove warnings.

Set Up Reinfection Monitoring: Install uptime monitoring (UptimeRobot is free) and file change detection. Many cleaned sites get reinfected within 30 days because the original vulnerability wasn’t properly patched.

Notify Your Email List and Social Followers: If the hack was visible to users, brief transparency builds more trust than trying to hide what happened. A simple “We had a security incident, here’s what we did about it” message shows professionalism.

“The average small business takes 197 days to detect a breach. By then, the damage to customer trust and search rankings is often irreversible.”

— IBM Cyber Security Intelligence Index

How Much Does WordPress Hack Cleanup Cost? (DIY vs. Hiring)

Before you decide whether to tackle How to Fix Hacked WordPress Site yourself or hire help, understand the real costs involved. The security industry loves to scare business owners into expensive cleanup services, but the math isn’t always in their favor.

The real question behind How to Fix Hacked WordPress Site is not whether you can do it — you absolutely can — but whether your time or money is more valuable in the moment.

Option	Cost	Time Required	Pros	Cons
DIY (This Guide)	Free	4-8 hours	Learn the process, no recurring costs	Time investment, learning curve
Security Plugin Premium	$99-$299/year	1-2 hours	Automated scanning, ongoing protection	Subscription lock-in, may miss custom malware
Professional Cleanup	$200-$500+ per incident	24-48 hours turnaround	Expert knowledge, guaranteed results	Expensive, no learning, dependency
Hosting Provider Service	$50-$150 per incident	12-24 hours	Convenient, server-level access	Limited scope, may not address vulnerabilities

Hidden Costs to Consider:

Downtime Revenue Loss: Every hour your site is compromised or in maintenance mode costs potential sales. For e-commerce sites, this often exceeds cleanup costs.

SEO Recovery Time: Google ranking recovery can take 3-6 months after a hack, especially if the site was blacklisted. The traffic loss during recovery often costs more than professional cleanup.

Repeat Infections: DIY cleanups that miss backdoors often lead to reinfection within 30 days. Professional services typically include reinfection guarantees.

My recommendation? Learn the DIY process (you’re here anyway), but consider professional help for e-commerce sites or mission-critical business websites where downtime costs exceed cleanup fees.

For comprehensive ongoing security without the SaaS subscription trap, check our complete WordPress security hardening guide that covers prevention better than any plugin.

The most important part of How to Fix Hacked WordPress Site is not the cleanup itself — it is the hardening steps that prevent the next attack from ever getting through.

Learning How to Fix Hacked WordPress Site yourself builds the security awareness that prevents future attacks from succeeding in the first place.

Every site owner should bookmark this How to Fix Hacked WordPress Site guide before they need it — because when the attack hits, you want the playbook ready, not the panic button.

The process to How to Fix Hacked WordPress Site follows the same systematic approach regardless of the attack type — identify, isolate, clean, harden, and verify.

Understanding How to Fix Hacked WordPress Site is essential knowledge for every business owner who depends on their website for revenue and customer trust.

Take Back Control of Your WordPress Security

Understanding How to Fix Hacked WordPress Site gives you something more valuable than any premium security plugin — confidence. You now know the exact steps: identify the infection, secure the perimeter, scan and clean files, close backdoors, harden against reinfection, and rebuild your reputation with Google. The entire process takes a single afternoon of focused work.

The businesses that survive hacks aren’t the ones with the biggest security budgets — they’re the ones that respond fast, learn from the incident, and implement preventive measures that stop the next attack before it starts. You’ve got the playbook. Now go secure your site before you become one of those 30,000 daily statistics.

Have you dealt with a hacked WordPress site before? What was the attack vector? Drop your experience in the comments — the community learns from every battle story.