How to clean a hacked WordPress site: step-by-step guide

If your WordPress site shows signs of compromise, this guide gives a practical, end-to-end playbook to identify, contain, clean, and harden an infected site, and to request Google reindexing once cleaned.

Method note: This guide is an editorial synthesis based on documentation from Wordfence and Sucuri (consulted September 27, 2026). It does not replace forensic services.

Quick checklist (first 15–60 minutes)

Act quickly but carefully. First actions aim to stop further damage and preserve evidence. Take a snapshot backup of the site files and database before making changes. Put the site in maintenance mode or serve a static page to visitors while you investigate. Change all passwords for WordPress admin accounts, hosting control panel, database, FTP/SFTP and any exposed API keys, and revoke existing sessions. If you see a Google or browser security warning, check Search Console for Security Issues and use the Removals tool for urgent URL suppression if needed. For these initial steps and their rationale, see Wordfence and Sucuri guidance (consulted September 27, 2026) (source : Wordfence) (source : Sucuri).

Backup & Price caution: Remediation services and hosting plans change frequently — verify current offers on the provider’s site (date of consultation shown).

How to confirm you are hacked (symptoms and quick scans)

Recognize common compromise signs: visible defacement, unexpected redirects, spammy pages indexed by search engines, new admin users you did not create, or browser warnings for malware. Abnormal spikes in traffic or unexplained outbound email patterns can also indicate abuse. Use external scanners to get an initial indication: Sucuri SiteCheck and Google Safe Browsing will flag visible issues, and security plugins such as Wordfence can run server-side scans to list modified core, theme or plugin files and injected JavaScript. These tools indicate indicators of compromise but do not guarantee removal of every backdoor; treat results as starting points for investigation (source : Sucuri) (source : Wordfence).

Expect false positives: a scanner flag is an indicator that requires hands-on verification. When in doubt, preserve evidence and escalate the investigation rather than deleting data immediately.

Take a snapshot: backup and evidence preservation

Create a full backup before any modification: complete site files, database dump, and available server logs. Back up via hosting control panel, SFTP, or reliable backup plugins, and store the copy offsite so it cannot be overwritten by the attacker. Date-stamp backups and document where each copy is stored. A preserved forensic copy enables later analysis of the infection vector and supports communication with hosts or incident responders. Wordfence recommends preserving backups prior to remediation for this reason (source : Wordfence).

Contain the incident (short-term steps)

Containment reduces exposure while you plan remediation. Put the site into maintenance mode or serve a temporary static page to stop search engines and users from encountering malicious content. Change all passwords and revoke sessions across WordPress, hosting, FTP/SFTP, database and any affected services. Consider using Search Console Removals if malicious URLs are actively damaging traffic or reputation; remember that removals are temporary and do not replace a full cleanup (source : Google).

Notify the hosting provider immediately if you suspect server-level access, hidden cron jobs, or reappearing payloads. Hosts can run server-side scans, check SSH logs, and quarantine accounts; coordinating with them is essential when evidence points beyond the WordPress application layer (source : Sucuri).

Decide: restore a clean backup vs manual cleanup

Choose a remediation route based on available evidence. If you have a known-clean backup from before the compromise, restoring that backup and then hardening the site is often the fastest route. If no clean backup exists, a manual cleanup is required: replace core, themes and plugins with fresh copies from official sources, scan and clean the database for injected content, and remove rogue admin users. Professional remediation services are an option when manual cleanup exceeds your capacity or when persistence suggests deeper compromise. See Sucuri’s remediation guidance for pros and cons of each approach (source : Sucuri).

Manual cleanup — step-by-step

Manual remediation follows a sequence designed to remove visible infections and reduce the chance of missed backdoors. Work methodically and document each change.

Use SFTP for file replacement and trusted tools for database inspection. Wordfence documents one-click repair options within its plugin and explains scan results to guide manual edits; Sucuri details database cleanup and backdoor hunting techniques (source : Wordfence) (source : Sucuri).

When the malware is persistent: host-level checks and migration

Indicators of server-level persistence include files or payloads that reappear after a full WordPress reinstall, hidden cron entries, or injections at the webserver or root filesystem level. In those cases, involve the hosting provider for server-side scans. Hosts can check other accounts on the same server, inspect SSH and system logs, and identify root-level backdoors. If the server cannot be proven clean, migrate to a clean hosting environment and restore from known-good backups. Sucuri’s blog and remediation resources detail scenarios where host-level investigation and migration are required (source : Sucuri).

Post-cleaning hardening (prevent reinfection)

After removing malicious code and restoring integrity, harden the site to reduce future risk. Update WordPress core, themes and plugins to supported versions and remove unused items. Enforce strong passwords and enable MFA on admin accounts. Restrict file permissions and consider disabling in-dashboard file editing by adding define(‘DISALLOW_FILE_EDIT’, true) to wp-config.php. Install a reputable Web Application Firewall (WAF) or enable host WAF features. Schedule regular backups and automated scans to detect regressions early. Wordfence and Sucuri both outline these hardening steps as part of a complete remediation plan (source : Wordfence) (source : Sucuri).

Checklists for plugins, themes, and users

Audit each installed plugin and theme for provenance: confirm downloads originate from official repositories or vendor sites, and remove any nulled or pirated items. Identify abandoned or unmaintained plugins that carry risk and replace them with maintained alternatives. Audit WordPress users and roles: remove stale admin accounts, reset passwords for remaining privileged users, and limit the number of accounts with full administrative privileges. Keep an inventory of critical plugins and themes and their update practices so you can respond quickly to disclosed vulnerabilities.

Testing and validation (how to confirm site is clean)

After cleanup and hardening, re-scan with multiple tools: run the site through Wordfence scans and Sucuri SiteCheck, test major user journeys, validate forms and login flows, and monitor for unexpected redirects. Check Google Search Console Security Issues and request a review once you are confident the site is clean; use the Removals tool where temporary suppression is needed during reindexing (source : Google). Continue monitoring logs and scans closely during the weeks following a cleanup to detect any reappearance of indicators.

When to call a professional (and how to choose one)

Engage professional remediation when server-level persistence is suspected, when the site is used to distribute malware or phishing, when forensics are required for legal or brand reasons, or when internal resources cannot safely complete a thorough cleanup. Ask potential providers for a forensic report, a list of cleaned files, the methods used, and how they will validate the site is clean. Request clarity about backup and restore procedures and whether the provider coordinates with your hosting provider. If you use a paid remediation service, check the provider’s published process and credentials before contracting. Sucuri and other remediation providers publish service overviews and case studies that explain expected deliverables (source : Sucuri).

My site keeps reinfecting — what now?

Reinfection after cleanup commonly means a server-level backdoor or leftover credential. Request a host-side scan, check for hidden cron jobs and root-level files, and consider migrating to clean hosting if host scans cannot demonstrate a clean environment. Sucuri documents scenarios where migration is the proper remediation step (source : Sucuri).

Can I pay to get my site clean fast?

Yes, professional remediation services exist and can speed recovery, but verify deliverables: ask for a forensic report, list of cleaned files, and post-cleaning validation steps. Compare providers’ published processes before choosing one; consult Sucuri and Wordfence resources for what a remediation engagement should include (source : Sucuri) (source : Wordfence).

Will Google blacklist my site forever?

Google warnings and delistings are reversible after a thorough cleanup and a successful review request in Search Console. Use the Security Issues report to see flagged URLs and request review when remediation is complete; removals can temporarily suppress malicious content during the process (source : Google).

What we do NOT know

Related guides

• How to Migrate a Website Without Losing SEO
• How to Back Up a Website Properly
• Best WordPress security plugins and cloud WAFs
• Security & Backups