Hacked WordPress Site? How to Recover It, Step by Step

If your WordPress site is redirecting visitors to spam, showing pages you didn't write, or Google has flagged it as hacked, this guide gets it back in the right order. Work from top to bottom. Cleaning up before you close the hole the attacker used usually means you get hacked again a week later.

Before you start: contain the damage

1. Take the site offline or put it in maintenance mode if visitors are being sent to malicious pages. Your host can do this for you if you can't log in.
2. Tell your host. They can scan the whole account, check the server logs and tell you whether other sites on the same account are infected.
3. Copy the hacked site as it is now, files and database. You'll want it later to compare against and to work out what changed.

Step 1: Restore a clean backup, if you have one

A real backup is the fastest fix. That means a full copy of your files and database, made by your host or a backup plugin. The Tools → Export screen in WordPress is not a backup: it exports posts and pages as an XML file, restores nothing, and can carry injected links and scripts straight into the "clean" site.

• Pick a backup from before the first sign of trouble. If you don't know when the hack started, go further back.
• Restore files and database together.
• Then carry on from Step 4 anyway. A restore puts back the same outdated plugin the attacker came in through.

No backup? Clean the site by hand with Steps 2 and 3.

Step 2: Replace WordPress core, plugins and themes with clean copies

Attackers hide code in files nobody opens. Replacing files is more reliable than reading them line by line.

• WordPress core: go to Dashboard → Updates and click Re-install version x.x. With WP-CLI, wp core verify-checksums lists core files that have been changed, and wp core download --force --skip-content replaces core without touching wp-content.
• Plugins: wp plugin verify-checksums --all flags plugins from WordPress.org whose files don't match the official release. Delete those and install fresh copies. For premium plugins, download a new copy from the vendor.
• Your theme: compare a custom or child theme against your own copy in version control or the original download. If you can't be sure it's clean, switch to a default theme such as Twenty Twenty-Five under Appearance → Themes while you work, then reinstall your theme from a fresh download.

Step 3: Look for malicious files, users and database changes

• Uploads folder: /wp-content/uploads/ should hold media, not code. Any .php file in there is a red flag. Find them with find wp-content/uploads -name "*.php" over SSH, or browse the folder in SFTP, and delete anything you can't explain.
• Root folder and wp-content: look for files that don't belong to WordPress, such as random names like wp-xyz.php, and for new rules in .htaccess that redirect visitors.
• Users: go to Users → All Users, filter by Administrator, and delete any admin account you didn't create. Attackers often add one so they can come back.
• Database: check the siteurl and home rows in the wp_options table, and search post content for <script> tags or links to domains you don't know.
• Scheduled tasks: the free WP Crontrol plugin lists cron events. Delete any that call code you don't recognise.

A security scanner such as Wordfence or Sucuri Security (both have free versions) is a useful second opinion here, not a guarantee.

Step 4: Reset every password and key

Assume the attacker knows every password connected to the site:

• WordPress admin and editor accounts
• Hosting control panel, SFTP/FTP and database (after changing the database password, update DB_PASSWORD in wp-config.php)
• The email account your WordPress admin address uses

Then replace the security keys (salts) in wp-config.php. Run wp config shuffle-salts, or generate a new set at https://api.wordpress.org/secret-key/1.1/salt/ and paste it over the lines from AUTH_KEY to NONCE_SALT. Everyone is logged out, including the attacker.

Step 5: Close the hole they came in through

Most WordPress hacks start with an outdated or abandoned plugin or theme, or a reused password.

• Update WordPress, every plugin and every theme.
• Delete plugins and themes you don't use, from Plugins → Installed Plugins and Appearance → Themes. A deactivated plugin is still on the server and can still be exploited. Keep one default theme as a fallback.
• Replace abandoned plugins. If a plugin on WordPress.org hasn't been updated in over a year, or has been closed, find an alternative.
• Add two-factor login for every administrator.
• Turn off the built-in file editor, so a stolen admin login can't be used to edit PHP from the dashboard. Add this to wp-config.php:

define( 'DISALLOW_FILE_EDIT', true );

If nobody needs to install or update plugins from the dashboard, this line goes further and blocks plugin and theme installs and updates as well. Remove it when you want to update.

define( 'DISALLOW_FILE_MODS', true );

Step 6: Ask Google to review the site

If Google flagged the site, open Google Search Console → Security & Manual Actions → Security issues, check that every listed problem is fixed, then click Request Review. Google says reviews for hacked sites can take several days.

Step 7: Stop it happening again

• Automatic off-site backups, daily for shops and weekly for brochure sites, and a test restore now and then so you know they work.
• Auto-updates for plugins you trust: on Plugins → Installed Plugins, click Enable auto-updates next to each one.
• One security plugin with a firewall and login protection. Our comparison of WordPress security plugins explains what each one covers.
• Decent hosting with server-level caching. A cheap, overloaded server is slow and often poorly patched. See how to speed up WordPress with LiteSpeed server caching.

When to call in help

If the site gets reinfected after all of this, something is still hidden: a backdoor file you missed, a compromised hosting account, or another infected site on the same server. That's the point to hand it to your host's security team or a professional cleanup service.