How to Recover a Hacked WordPress Site

Signs your site was hacked

Some hacks are loud. Many are silent, because attackers want the site to keep working while it earns them money.

• Your site redirects some visitors to spam or scam pages, often only visitors who come from Google.
• Search results show strange titles, pages in another language or pharmaceutical keywords.
• Your browser, Google or your host shows a security warning.
• There are administrator accounts you did not create.
• Files you do not recognise appear in the plugins, themes or uploads folders.
• Your host suspends the account, or outgoing email suddenly floods or fails.
• The site is slow or your host reports unusual traffic or CPU use.

Contain it first

Before you clean anything, stop the damage from spreading and keep a record of what you found.

1. 1Put the site into maintenance mode, or ask your host to take it offline, if visitors are being redirected or served malware.
2. 2Take a full copy of the site as it is now, files and database, and keep it somewhere safe. It is evidence, and you will want it if the cleanup removes something it should not.
3. 3Tell your host. They can often show you access logs and tell you when files changed.
4. 4Change the passwords you control from a computer you trust: hosting account, SFTP, database and your email account.
5. 5Warn anyone else with access, and tell them not to sign in until you say so.

How to recover a hacked WordPress site: the cleanup order

There are two routes: restore a clean backup, or clean the site in place. A clean backup from before the hack is the cleaner choice, but only if you know when the hack began and you fix the way in afterwards. Otherwise the attacker simply returns.

In both cases, the order below keeps you from reinfecting the site.

1. 1Decide on a restore point: the newest backup made before the first sign of the hack. If you cannot tell, clean in place.
2. 2Replace WordPress core with a fresh copy of the same version, leaving wp-content and wp-config.php alone.
3. 3Delete every plugin and theme and reinstall them from the official directory or your vendor. Restore your own custom code from version control, not from the infected site.
4. 4Search for files you do not recognise, especially PHP files in uploads, extra files in the WordPress root and anything in mu-plugins.
5. 5Inspect wp-config.php, .htaccess and your theme's functions.php for code you did not write.
6. 6Remove rogue users and review who has the Administrator role.
7. 7Check the database for injected spam links, scripts in posts and options, and a changed site address.
8. 8Reset every secret (next sections), update everything, then bring the site back online.

Find the backdoors

Attackers rarely leave one way in. They leave several, so deleting the obvious malware is not enough. If you have command line access, WP-CLI checks files against the official copies quickly.

Expect false alarms from custom files and premium plugins. Treat the output as a list to inspect, not a list to delete.

# Compare core and wordpress.org plugin files with the official copies
wp core verify-checksums
wp plugin verify-checksums --all

# Replace core files with clean ones (leaves wp-content and wp-config.php alone)
wp core download --force --skip-content --version=$(wp core version)

# Who is an administrator?
wp user list --role=administrator --fields=ID,user_login,user_email,user_registered

# Scheduled tasks can reinstall malware
wp cron event list

# PHP files in uploads are almost always bad
find wp-content/uploads -name "*.php"

# PHP files changed in the last 7 days
find . -name "*.php" -mtime -7 -not -path "./wp-content/cache/*"

Where malware usually hides

Knowing the usual hiding places saves hours.

• The uploads folder, disguised as an image or inside a date folder.
• wp-content/mu-plugins, which loads automatically and does not show in the normal plugin list.
• Inactive plugins and themes, and lookalike folders with names close to real ones.
• functions.php and other theme files, often with long scrambled strings and calls such as eval or base64_decode.
• The database: scripts injected into posts, widgets or the options table, and rogue administrator accounts.
• Scheduled tasks, which reinstall the malware after you delete it.

Reset every secret

Assume anything the attacker could read is known. That includes anything stored in wp-config.php and anything saved in the database.

1. 1Change every WordPress password, starting with administrators, then force a reset for everyone else.
2. 2Change the database password at your host and update it in wp-config.php.
3. 3Generate new authentication keys and salts. This signs everyone out, including the attacker, and you can get fresh values from the official WordPress secret-key service.
4. 4Rotate API keys for email, payment, CRM and any other service the site talks to.
5. 5Delete application passwords that you do not recognise, and remove old SFTP and SSH users.
6. 6Turn on two-factor sign-in for every administrator.

Close the way in

A cleanup that does not find the cause is a pause, not a fix. Work out how they got in.

• An out-of-date plugin or theme with a known flaw is the most common cause. Look at what was outdated.
• A weak or reused administrator or hosting password.
• A nulled (pirated) plugin or theme.
• Another site on the same hosting account that was infected first. Clean or isolate every site in that account.
• Access logs from your host showing which request first created or changed a file.

Clean up search results and warnings

If Google flagged your site, add it to Google Search Console and look at the Security issues report. Once the site is clean, request a review there. Reviews can take days, so do not wait to get the cleanup right.

If the hack exposed personal data, check what your local law and your own policies require you to tell customers. When in doubt, ask a lawyer.

Stay clean afterwards

For the next few weeks, look more closely than you normally would.

• Scan the site again after a day, a week and a month.
• Watch for file changes and new users, and read your activity log.
• Keep backups from after the cleanup so you have a known-good restore point.
• Write down what happened and what you changed, so the next incident is faster.