TL;DR: If your WordPress site is hacked right now, the very first thing to do is take it offline. Put up a static maintenance page, revoke all admin access, and change every password -- hosting panel, database, FTP, and WordPress admin. This stops the bleeding. Everything else -- malware removal, backup restoration, hardening -- comes after containment. We typically begin triage within 2 hours of first contact during business hours, and most hacked WordPress sites are cleaned and back online within 12 to 48 hours depending on severity. Here is exactly how to work through it.

How do you know your WordPress site is actually hacked?

Before you panic, confirm the hack is real. False positives happen -- a bad plugin update can break a site without any malicious activity. Here are the reliable signs:

  1. Google Safe Browsing warnings. Your site shows a red interstitial page saying "This site may harm your computer." You can verify this in Google Search Console's security report.
  2. Unfamiliar admin users. Log into wp-admin and check Users. If you see accounts you did not create, that is a clear indicator.
  3. Redirects to spam or phishing pages. Visitors (or you) get sent to pharmaceutical spam, fake login pages, or ad-heavy sites.
  4. Modified files. Your theme's header.php, functions.php, or wp-config.php have base64-encoded strings or obfuscated code you did not write.
  5. Host suspension. Your hosting provider emails you that your account has been suspended for malware or abuse.
  6. Spikes in outbound traffic. Your server is sending thousands of spam emails or making requests to unknown IPs.

If two or more of those match, you are dealing with a real compromise. Move immediately to containment.

How do you contain a hacked WordPress site safely?

Speed matters here. Every minute the site stays live, the attacker can deepen access, exfiltrate data, or use your server to attack others.

  1. Put up a static maintenance page. Replace your index.php with a simple HTML file that says the site is undergoing maintenance. Do this at the server level -- not with a WordPress plugin, since you cannot trust any plugin right now.
  2. Change all credentials immediately. This means your hosting control panel password, FTP/SFTP passwords, WordPress database password (and update wp-config.php to match), and every WordPress admin password. Do not reuse any previous password.
  3. Revoke all active sessions. In wp-admin (if accessible), go to Users and click "Log Out Everywhere Else" for every admin account. Better yet, change the WordPress salts in wp-config.php -- this invalidates every session cookie instantly.
  4. Disable SSH/FTP access temporarily if your host allows it. Lock the doors while you clean.
  5. Notify your hosting provider. They may have additional logs or can isolate your account to prevent cross-contamination on shared hosting.

If you need hands-on help right now, our emergency WordPress support team handles exactly this -- we start triage within 2 hours during business hours and typically have sites contained within the first call.

How do you find and remove the malware?

This is the most labor-intensive step. Rushing it leads to reinfection within days.

  1. Take a forensic copy first. Download a full backup of the compromised site -- files and database -- before you change anything. You may need this for investigation, especially if customer data was involved.
  2. Scan all files. Use a server-side scanner like Wordfence CLI, WPScan, or your host's built-in malware scanner. Look for base64_decode calls, eval() statements, files with recent modification dates that should not have changed, and anything in wp-content/uploads that ends in .php.
  3. Check the uploads directory. Attackers love hiding backdoors in /wp-content/uploads/ because many security plugins skip it. Any .php file in an uploads folder is suspicious -- there is almost never a legitimate reason for one to be there.
  4. Inspect themes and plugins. Compare your theme and plugin files against clean copies from wordpress.org or the vendor. A single line of injected code in a theme's functions.php is enough to maintain persistent access. Pay special attention to inactive themes and plugins -- attackers target these because site owners forget they exist.
  5. Audit the database. Check wp_users for rogue accounts. Search wp_options for unfamiliar URLs in siteurl or home. Look in wp_posts for injected JavaScript or iframes, especially in post_content fields.
  6. Remove every backdoor. This is critical. If you miss even one, the attacker walks right back in. Common backdoor patterns include standalone PHP files with names like wp-xmlrpc.php or class-db.php in the root directory, and web shells disguised as legitimate files.

WordPress.org maintains a detailed guide on cleaning hacked sites that is worth reading alongside this process.

Should you restore from a backup instead?

If you have a clean backup from before the compromise, restoring it can be faster and more reliable than manual cleanup -- but only if you know when the hack occurred. Many compromises sit undetected for weeks. Restoring a backup from last Tuesday does not help if the backdoor was planted last month.

Here is how to use backups effectively:

  1. Identify the compromise date. Check file modification timestamps, server access logs, and your host's records. This gives you a "known good" date.
  2. Restore files and database from before that date. Use a backup you trust -- ideally one stored off-server (S3, external backup service), since on-server backups can also be compromised.
  3. Immediately apply all updates after restoring, since the restored version likely has the same vulnerability that let attackers in.
  4. Re-scan after restoration to confirm the backup is clean.

If you do not have usable backups, manual cleanup is your only path. Either way, our emergency website repair process covers both scenarios.

How do you patch the vulnerability that let them in?

Cleaning malware without fixing the entry point is like mopping the floor while the pipe is still leaking. You need to find what was exploited.

  1. Update WordPress core, every plugin, and every theme. Check changelogs for recent security patches -- these often reveal what was vulnerable.
  2. Delete unused plugins and themes. Every plugin is attack surface. If you are not actively using it, remove it entirely -- do not just deactivate.
  3. Check plugin vulnerability databases. WPScan's vulnerability database and Patchstack track known exploits. Cross-reference your plugin list against recent disclosures.
  4. Review custom code. If you have custom plugins or theme modifications, audit them for SQL injection, file upload flaws, and unauthenticated access.

Our ongoing WordPress maintenance plans include monthly vulnerability audits and updates specifically to prevent this cycle.

How do you harden WordPress so it does not happen again?

Once clean and patched, layer your defenses:

  1. Enable two-factor authentication (2FA) on every admin and editor account. This single step blocks the majority of credential-stuffing attacks.
  2. Apply least-privilege access. Not everyone needs to be an Administrator. Use Editor, Author, and Contributor roles appropriately. Remove accounts that are no longer active.
  3. Set up a Web Application Firewall (WAF). Cloudflare, Sucuri, or a server-level WAF like ModSecurity can block known exploit patterns before they reach WordPress.
  4. Disable file editing in wp-admin. Add define('DISALLOW_FILE_EDIT', true); to wp-config.php. This prevents attackers who gain admin access from editing theme or plugin files through the dashboard.
  5. Move wp-config.php above the web root if your hosting environment supports it.
  6. Automate updates. Enable auto-updates for minor core releases and security patches for plugins. Test major updates in staging first.
  7. Monitor continuously. File integrity monitoring, uptime checks, and login attempt logging give you early warning if something changes.

How do you clear a Google Safe Browsing blacklist?

If Google flagged your site, visitors see a scary red warning and your search traffic drops to near zero. After cleanup:

  1. Verify your site in Google Search Console if you have not already.
  2. Review the Security Issues report. Google tells you what it found -- malware, phishing, unwanted software.
  3. Request a review. Once you have cleaned and hardened the site, submit a review request through Search Console. Be specific about what you found and what you fixed.
  4. Wait 24 to 72 hours. Google typically processes review requests within this window. If they find remaining issues, they will tell you what and where.

Do not skip this step. Until the blacklist is lifted, your site is effectively invisible to most of the internet.

What if your site keeps getting hacked?

Here is the honest long-term reality: WordPress powers roughly 40% of the web, which makes it the single biggest target for automated attacks. The plugin ecosystem -- while flexible -- is the primary attack surface. Every plugin is third-party code running with full server access. If your site has been compromised more than once, or if you are running 20+ plugins to achieve functionality that modern frameworks handle natively, it is time to consider a different architecture.

Moving to a Next.js or Astro front end with a headless CMS eliminates most of the risk. There is no public-facing PHP. No plugin vulnerabilities exposed to the internet. The attack surface shrinks dramatically because your content API is the only entry point, and it can be locked down with authentication and rate limiting.

We have built this exact setup for clients through our WordPress headless work -- keeping the familiar WordPress editor while serving a static or server-rendered front end that is effectively unhackable through traditional WordPress exploit vectors. A typical migration takes 3 to 6 weeks depending on site complexity.

For regulated industries, this is not optional. If your WordPress site handles patient data under HIPAA or processes payments under PCI DSS, a breach carries legal and financial consequences far beyond the cost of cleanup. Fines for HIPAA violations can reach $50,000 per incident. PCI non-compliance after a breach can result in fines of $5,000 to $100,000 per month. The cost of migrating to a more secure architecture is a fraction of one penalty.

Frequently asked questions

How long does it take to clean a hacked WordPress site? Most sites are fully cleaned and back online within 12 to 48 hours. Simple malware injections can be resolved in under a day. Complex compromises with multiple backdoors, database infections, or cross-site contamination on shared hosting can take 2 to 3 days of focused work.

How much does emergency WordPress malware removal cost? Our emergency cleanup typically runs between $1,500 and $4,000 depending on the scope of the compromise and the size of the site. Sites with e-commerce, membership systems, or multiple subsites tend toward the higher end. We provide a fixed quote after initial triage.

Can I just reinstall WordPress to fix a hack? Reinstalling core files helps but is not enough on its own. Backdoors typically live in theme files, plugin files, the uploads directory, and the database -- none of which are touched by a core reinstall. You still need to scan and clean those areas, patch the vulnerability, and harden credentials.