Has your WordPress website been hacked and you’re unsure how to fix it safely? Want a clear, step-by-step guide to help you remove malware, restore your site, and secure it for the future?

You’ll find some WordPress basics in this infographic.

Here’s a summary of what’s covered:

• Understand Why WordPress Sites Get Hacked
• Know the Signs of a Hacked Site
• Backup Your Files Immediately
• Identify the Extent of the Hack
• Restore a Clean Backup (If Available)
• Manually Remove Malware and Infected Files
• Reinstall WordPress Core Files
• Reset All Passwords and User Accounts
• Reinstall Trusted Plugins and Themes
• Harden Your WordPress Security
• Request Removal from Blacklists
• Monitor and Maintain Your Website Regularly

Check out the post below for more.

 

If your WordPress website has been hacked, you’re not alone—and you’re not helpless. With thousands of WordPress sites compromised every day, knowing how to respond swiftly and effectively is crucial.

This guide walks you through each step of the clean-up process, helping you remove malware, restore your content, and harden your website security. Whether you’re a developer or a site owner, these actionable tips will get your site back online—and keep it there.

Understand Why WordPress Sites Get Hacked

Before fixing the damage, it’s helpful to understand how it happened. WordPress is a popular platform, which also makes it a common target for attackers. Vulnerabilities often arise from weak file permissions, outdated plugins, and poor hosting environments. Recognising the root causes is the first step to preventing a repeat attack.

• Incorrect File Permissions: Files and folders with the wrong permissions can be exploited by hackers to gain unauthorised access.
• Outdated Plugins or Themes: These often contain security flaws that have been patched in newer versions but remain vulnerable if not updated.
• Weak or Reused Passwords: Simple or recycled passwords make it easier for attackers to brute-force your login.
• Low-Quality Hosting: Shared or poorly maintained hosting services may lack the firewall and isolation needed to secure your site.

Know the Signs of a Hacked Site

Not every hack is obvious. While some defacements are dramatic, others are more subtle—like a sudden drop in traffic or a hidden redirect. Understanding what to look for helps you catch breaches early and avoid further damage. Don’t rely on visual clues alone; backend anomalies are often more telling.

• Unexpected Redirects: Your site may redirect visitors to spammy or malicious websites.
• Search Engine Warnings: Google may flag your site as unsafe in search results or browsers.
• Unrecognised Admin Users: If new users appear with admin access, your site may have been compromised.
• Unfamiliar Files or Code: Hidden malware scripts can reside in your theme, plugin, or core files.

Backup Your Files Immediately

Before you start deleting or cleaning anything, take a full backup of your website. This gives you a snapshot of your current setup, which may help with diagnostics or recovery later. Even if the backup contains malicious code, it’s valuable as a reference point. Use secure methods to ensure integrity.

• Use Hosting Tools: Many hosts offer one-click backup tools through cPanel or similar platforms.
• Include Database and Files: Ensure your backup includes both the MySQL database and the wp-content folder.
• Store Offsite: Save your backup to an external cloud service or secure local storage.
• Label Clearly: Name your backup with a date and brief description for easy identification.

Identify the Extent of the Hack

The next step is assessing what parts of your site have been affected. This determines the scope of your cleanup and helps you understand how deep the intrusion goes. Use a combination of manual checks and automated tools for a full picture. Look beyond the surface.

• Check for Login Anomalies: Review your admin dashboard for unfamiliar users or last login activity.
• Scan with Security Plugins: Tools like Wordfence or Sucuri can help detect malicious files and database entries.
• Verify Blacklisting Status: Use Google Search Console to check whether your site has been blacklisted.
• Review File Modification Dates: Sort files by date to spot anything recently added or changed.

Restore a Clean Backup (If Available)

If you have a backup from before the attack, restoring it can be the quickest way to recover. However, make sure the backup is clean and free of the same vulnerabilities that caused the breach. After restoring, take immediate steps to harden your site to avoid reinfection.

• Check Backup Integrity: Scan the backup files for malware before restoring them to your live site.
• Restore via Hosting Panel: Use your host’s backup tools or manually upload via FTP.
• Reset Database if Necessary: If the database is compromised, restore an older, clean version.
• Update Everything: Immediately update WordPress core, plugins, and themes after restoration.

Manually Remove Malware and Infected Files

If you don’t have a clean backup—or if you want to double-check your site—manual cleanup is essential. This involves going through your files line by line and deleting malicious code or unknown scripts. Caution is key, as removing the wrong file can break your site.

• Compare Core Files: Replace WordPress core files with fresh copies from wordpress.org.
• Delete Suspicious Files: Remove any unfamiliar files in wp-content, wp-includes, or root folders.
• Clean wp-config and .htaccess: These files are common targets and should be reviewed carefully.
• Remove Unused Plugins and Themes: Eliminate any inactive or outdated components that could contain backdoors.

Reinstall WordPress Core Files

Reinstalling the WordPress core ensures no system files have been modified or infected. This step helps re-establish the original structure of your website without affecting your content. It’s especially useful when malware has hidden itself in obscure system files.

• Download a Fresh Copy: Get the latest version of WordPress from the official site.
• Replace All Core Folders: Overwrite wp-admin and wp-includes completely.
• Leave wp-content Intact: This folder contains your media, plugins, and themes—don’t overwrite it unless necessary.
• Avoid Replacing wp-config.php: Unless it’s been compromised, keep your database settings as is.

Reset All Passwords and User Accounts

Once you’ve secured the site structure, it’s time to lock out any lingering intruders. Change all relevant passwords and clean up user accounts to eliminate unauthorised access. Every user with elevated privileges should go through a password reset.

• Change WordPress Admin Passwords: Reset passwords for all admin and editor-level users.
• Update FTP and Database Passwords: These credentials are critical entry points.
• Reassign Roles Carefully: Review user roles and reduce access where it’s not essential.
• Enable Two-Factor Authentication: Add a second layer of security to all login portals.

Reinstall Trusted Plugins and Themes

Even if they appear fine, compromised plugins or themes may still contain backdoors or hidden malware. The best course is to reinstall them from fresh, trusted sources. This not only secures your site but also ensures full compatibility with the latest WordPress version.

• Delete and Reinstall: Remove the old version and install a clean copy from the WordPress repository or trusted vendor.
• Avoid Abandoned Plugins: Don’t use plugins that haven’t been updated in years.
• Check Reviews and Updates: Use well-supported plugins with good reviews and active development.
• Limit Plugin Use: Keep your plugin count minimal to reduce security risks.

Harden Your WordPress Security

After cleaning up, strengthen your defences to prevent future attacks. Hardening your WordPress installation means putting extra barriers in place that make it more difficult for hackers to break in. Think of it as adding locks, alarms, and guards to your website.

• Install a Firewall Plugin: Use plugins like Wordfence or Sucuri to monitor traffic and block threats.
• Disable File Editing: Add define(‘DISALLOW_FILE_EDIT’, true); to wp-config.php to block access to editor.
• Use Strong File Permissions: Set file permissions to 644 and folders to 755.
• Limit Login Attempts: Prevent brute-force attacks by restricting failed login attempts.

Request Removal from Blacklists

If your site has been flagged by search engines or browsers, you’ll need to submit a review request after cleaning it. This process varies depending on the platform but generally involves confirming the issue has been fixed. Visibility won’t fully return until your site is cleared.

• Google Search Console: Use the “Security Issues” section to submit a reconsideration request.
• Other Search Engines: Submit removal requests to Bing and others if affected.
• Browser Warnings: Use diagnostic tools to check whether your SSL or reputation has been compromised.
• Allow Time for Review: It may take a few days for changes to be reflected across platforms.

Monitor and Maintain Your Website Regularly

Recovery doesn’t end when your site is back online. Ongoing monitoring and maintenance are key to long-term security. Set up systems to alert you of suspicious activity, run regular scans, and keep everything updated. Prevention is cheaper than repair.

• Use Monitoring Plugins: Tools like Jetpack, Sucuri, and Wordfence offer live alerts.
• Schedule Regular Backups: Automate daily or weekly backups to always have a clean copy.
• Update Weekly: Make plugin, theme, and core updates a weekly habit.
• Audit User Access: Periodically review who has access and adjust roles as needed.

Conclusion

Recovering from a WordPress hack is stressful, but it’s entirely manageable with the right approach. By understanding the warning signs, acting quickly, and following a structured recovery process, you can regain control of your website and protect it from future threats.

Use this opportunity to tighten your security, implement strong practices, and turn a crisis into a learning experience. With vigilance and preparation, your site can bounce back stronger than ever.