WordPress malware removal: clean a hacked site safely

How do you confirm your WordPress site is hacked?

Confirm with multiple signals: Google 'site:yourdomain.com' for spam pages, check for unknown admin users, scan with Wordfence or Sucuri, look for recently modified files you didn't touch, and test the site logged-out on mobile (some malware hides from logged-in owners). One signal is a hint; two or more is a diagnosis.

Don't trust a single symptom — confirm methodically:

• Search footprint: Google site:yourdomain.com and look for spam (pharmacy, casino, essay-writing pages). Also check Google Search Console → Security Issues for Google's own verdict.
• User accounts: Users → All Users — any administrator you didn't create is definitive proof of compromise.
• Scanner: install Wordfence or Sucuri and run a full scan — it compares core/plugin files against clean originals and flags modifications.
• File dates: via FTP, sort by modification date — clusters of recently changed files you didn't touch map the infection.
• Stealth test: visit the site logged-out, on mobile, from a different network. Some malware only shows spam/redirects to non-logged-in mobile visitors specifically to hide from owners.
• Outbound behavior: hosting warnings about spam email or resource abuse, or visitors reporting antivirus warnings.

Common malware behaviors to recognize: SEO spam (hidden pages/keywords injected to rank for spam terms — invisible on normal browsing), redirects (visitors sent to scam sites, often only mobile or only first-visit), backdoors (hidden admin access for later), crypto miners (server CPU maxed, site slow), phishing pages (fake bank logins hosted on your domain), and defacement (the noisy, obvious kind — actually the least harmful).

Document everything with screenshots before touching anything — file dates, unknown users, scan results. You'll need this for the host, for Google reconsideration, and for diagnosing the entry point later.

What should you do immediately after discovering a hack?

Contain first: enable maintenance mode or ask the host to suspend the site, change all passwords (hosting, FTP, database, WordPress) from a clean device, and preserve evidence (screenshots, file dates, scan logs). Don't start deleting files yet — hasty deletion destroys the evidence needed to find every backdoor and the entry point.

The first hour, in order:

• Contain. Maintenance mode immediately — every visitor served malware or spam damages your reputation and risks blacklisting. If the hack is actively sending spam or phishing, ask your host to suspend the account temporarily; it's the responsible move.
• Lock credentials — from a clean device. Change hosting panel, FTP/SFTP, database and all WordPress passwords. Use a device you trust; the one you normally use might be the infection source (stolen FTP credentials from local malware are a classic entry point). Enable 2FA everywhere as you go.
• Preserve evidence. Screenshot unknown users, scan results, file modification dates, Search Console warnings. Download web server access logs if you can — they show how the attacker got in.
• Notify stakeholders. If the site handles customer data (WooCommerce especially), you may have disclosure obligations. Check what data was exposed and take advice — silence is not a strategy.
• Don't delete yet. Removing 'the weird file' feels productive and achieves nothing — professional malware plants multiple backdoors. Deletion without diagnosis guarantees reinfection.

One critical question to answer early: do you have a clean backup? Check backup dates against the infection timeline (file modification dates tell you when it started). A verified clean backup changes the whole recovery — restore beats surgery. No clean backup means manual cleanup, which is where this guide (or a professional) earns its keep.

How do professionals clean a hacked WordPress site?

Professionals follow a sequence: contain and back up the infected state (for evidence), replace all core/plugin/theme files with fresh copies, surgically clean the database and uploads, remove backdoors and rogue users/cron jobs, then verify with scans and harden the entry point. Skipping verification and hardening is why DIY cleanups reinfect.

The professional cleanup sequence:

• 1. Quarantine backup. Back up the infected site *as-is* (labeled INFECTED) — it's evidence and a fallback, not for restoring.
• 2. Replace all executable code. Delete and reinstall WordPress core, all plugins and all themes from clean sources (wordpress.org / vendor). Don't 'clean' plugin files — replace them. Malware hides in legitimate files; fresh copies eliminate the question.
• 3. Clean the database. Search for injected scripts, spam links and rogue admin users (also check wp_usermeta for privilege escalation). Common hiding spots: wp_options (siteurl/home hijacks), post content (invisible spam divs), and widget text.
• 4. Scrub uploads. The /uploads/ folder should contain only media — .php files here are always malicious. Also check for disguised executables (image.jpg.php patterns) and unknown directories.
• 5. Remove persistence mechanisms. Delete unknown admin users, unknown cron jobs (wp-cron and server cron), malicious must-use plugins in /wp-content/mu-plugins/, and .htaccess redirects.
• 6. Reset everything secret. All passwords again, plus WordPress salts in wp-config.php (forces logout of every session, including the attacker's), API keys, and SMTP credentials.

Then verify like an adversary: rescan with two different scanners, re-check site:domain.com over the coming days, monitor file integrity (Wordfence alerts on changes), watch Search Console security issues, and check blacklist status (Google Safe Browsing, Sucuri SiteCheck). Verification isn't a single scan — it's a week of watching.

Finally — and this is the step that prevents repeat business — close the entry point. Outdated plugin? Update everything and enable auto-updates. Weak password? Generated passwords + 2FA. Nulled theme? Delete it permanently. Compromised host neighbor? Move hosts. The full program is in the hardening guide; cleanup without hardening is just scheduling the next incident.

Should you clean the hack yourself or hire a professional?

DIY cleanup suits simple, single-file infections on non-critical sites when you have a clean backup to restore from. Hire a professional for WooCommerce/customer-data sites, SEO-spam infections across hundreds of pages, reinfections (meaning you missed the backdoor), or when downtime costs money. A missed backdoor reinfects in days — the professional's value is thoroughness.

DIY is reasonable when: the infection is simple and contained (one spam file, caught early), the site is a low-stakes brochure, you have a verified clean backup (restore > surgery), and you're comfortable with FTP, phpMyAdmin and reading scan logs. Follow the sequence above meticulously — especially verification.

Hire when: the site processes payments or personal data (liability changes everything), it's a WooCommerce store (orders + customer data + downtime cost), SEO spam infected hundreds of database rows, this is a *repeat* infection (you've already proven the backdoor outsmarts DIY), you can't identify the entry point, or every hour offline costs real money.

The economics are straightforward: professional cleanup typically costs less than a day or two of lost business, while a botched DIY cleanup costs the business *plus* the professional cleanup when reinfection forces the call anyway. The most expensive cleanup is the one done twice.

What to expect from professional malware removal: full diagnosis with the entry point identified, complete backdoor removal, database cleaning, blacklist/delist assistance, hardening to prevent recurrence, and a written report of what happened and what was fixed. Ask for the entry point explicitly — 'it's clean now' without 'here's how they got in' is incomplete work.

Red flags in cleanup services: anyone who 'cleans' in 10 minutes (that's deletion, not cleanup), no mention of the entry point, or no hardening included. Thorough cleanup takes hours because verification takes hours.

How do you get Google to remove the 'hacked' warning?

After full cleanup and verification, request a review in Google Search Console → Security Issues; Google typically re-checks within days. Also verify removal from other blacklists (Google Safe Browsing, Norton, McAfee via Sucuri SiteCheck) and request re-indexing of cleaned pages. Warnings lift only when the site is genuinely clean — requesting review on a still-infected site wastes the review.

Google's hacked-site labels ('This site may be hacked', 'Deceptive site ahead') destroy traffic and trust — removing them is part of cleanup, not an afterthought:

• Finish cleanup first. Every backdoor, spam page and injected script must be gone. Google's re-check is automated and unforgiving — residual malware fails the review.
• Request review in Search Console → Security Issues → 'Request Review'. Describe what was cleaned (briefly, factually).
• Wait for re-crawl. Typically days; complex cases take 1–2 weeks. Don't resubmit repeatedly — it doesn't speed things up.
• Check other blacklists. Sucuri SiteCheck aggregates Google Safe Browsing, Norton, McAfee and others — clear each flagged one.
• Request re-indexing of previously-spammy URLs via URL Inspection so search results update to the clean versions.
• Monitor. Watch Security Issues and site: searches for 2–4 weeks. Reinfection re-triggers warnings fast.

While warnings are active, consider a temporary notice for direct visitors (email/social traffic still arrives) — a brief 'we experienced a security incident, it's resolved, here's what we did' builds more trust than silence. Transparency after an incident is a trust *builder* when handled honestly.

Prevention for next time, permanently: the hardening checklist (updates, 2FA, firewall, backups) is the post-incident program. Sites that harden after cleanup don't get repeat business from attackers — sites that don't, do.

How do you prevent the next hack?

Prevent recurrence by closing the specific entry point found during cleanup, then maintaining the fundamentals permanently: automatic updates, unique generated passwords with 2FA for all admins, a firewall, least-privilege user roles, no nulled software, and tested off-site backups. Add file-change monitoring so the next attempt triggers an alert instead of a disaster.

Post-cleanup hardening — non-negotiable:

• Close the entry point. The single most important action. Name it, fix it, verify it.
• Enable auto-updates for minor core and trusted plugins; schedule monthly manual update reviews.
• Reset all credentials to generated unique passwords (the password generator makes this instant) with 2FA on every admin account.
• Install a firewall (Wordfence/Sucuri + Cloudflare) — the attack traffic doesn't stop; make sure it's blocked.
• Remove nulled/pirated software permanently — if this was the vector, there is no second chance to give it.
• Prune users to least privilege; remove accounts of people no longer involved.
• Verify backups are automated, off-site and tested — your recovery path for next time.
• Enable file-change alerts so unauthorized modifications notify you within hours, not months.

Then build the habit: a monthly 20-minute maintenance session — updates, backup verification glance, security scan, user audit. Put it in the calendar as a recurring event. Every hacked site in this guide's experience had one thing in common: maintenance had lapsed. The attackers didn't get smarter; the defenses got older.

If maintenance isn't realistic for your schedule, that's what ongoing WordPress maintenance is for — updates, backups, scans and hardening handled continuously, so 'later' never arrives unprotected.

Frequently asked questions