WordPress Site Hacked? A Step-by-Step Recovery Plan
Recover a hacked WordPress site by restricting access, preserving files, database and logs, and involving the host where the account may be compromised. Restore verified clean components, review confirmed malicious changes, and close the entry point. Rotate exposed credentials and sessions again after cleanup, update supported software and test recovery before reopening the site.
For WordPress site owners recovering a compromise without destroying evidence, deleting legitimate content or reopening an unverified backup.
knowledge
- Read time
- 4 min
- Sections
- 8
- Updated
- 14 Nov 2026
- Written by
- WebJi® team
Last editorial update: 14 November 2026.
How to tell a WordPress site is hacked
Look for a user you did not create, a plugin you did not install, or a redirect that appears for visitors but not for you while logged in. A slow page alone proves nothing; a new administrator account or a Google security warning is stronger evidence.
- A new administrator account, or your own role changed without your action.
- Files in wp-content with names or timestamps you cannot explain.
- The site redirects from search or on mobile but loads normally when you are signed in.
- Search Console reports new spam URLs, or Google shows a "site may be hacked" notice.
- The host sends an abuse or malware email about your account.
Record the misbehaving URL, the time it started and a screenshot before you delete anything. That record is what a host scan and a cleanup ticket need to work from.
Contain the hack before you delete a single file
Restrict access through the host and invalidate exposed sessions before cleaning a hacked WordPress site. A maintenance plugin changes what visitors see but is not, by itself, proof that malicious scripts can no longer execute. Preserve the infected state and logs before destructive changes.
- Ask the host to restrict public access and inspect the affected account; use a maintenance page only as a user-facing notice.
- Invalidate existing WordPress sessions by replacing exposed secret keys and salts through a trusted recovery path.
- Ask the host whether outbound mail is paused; a hacked site often sends spam.
- Take the backup in the next section before you remove any file or user.
Back up the hacked site before you change anything
Download the full file tree and export the database, then store both off the server. A backup taken after the infection still helps: it shows which files changed and lets you compare your install against a clean copy of the same version.
A known-clean backup can reduce recovery work, but verify it against the incident timeline and evidence. Attackers can modify file timestamps. Restore only after addressing the entry point and checking for changes to the hosting account or neighbouring sites.
The official WordPress hacked-site guidance prioritises documentation, host involvement, backups, trusted recovery and password changes again after cleanup. Treat an infected backup as evidence, not a safe copy to publish.
How to remove malware from WordPress files and database
Recover WordPress files from trusted sources and review confirmed malicious database changes against a preserved copy. Unfamiliar names, script tags or encoded strings alone are not enough to justify deleting data. Keep wp-content and wp-config.php backed up before replacing anything.
- Replace the wp-admin and wp-includes folders with the same WordPress version. Keep wp-content.
- Inventory plugins and themes, preserve suspicious copies and reinstall retained components from their official repository or verified vendor source. Do not delete merely unfamiliar folders.
- Open .htaccess and remove redirect or include lines you did not write. Back the file up first.
- Review confirmed injected content against database backups. Use the actual table prefix, preserve records and avoid broad deletion based only on script tags or base64 text.
- Review uploads, must-use plugins and account-level persistence with the host; determine whether suspicious executable files are malicious before removal.
When a scanner names a file you do not recognise, read it before deleting it, and keep a copy for the host. Ongoing cleanup and monitoring sit with WebJi® WordPress security if you would rather not do this alone.
Change every credential the site used
Change the WordPress admin password, the database password and its entry in wp-config.php, the hosting and SFTP passwords, and the salts in wp-config.php. New salts invalidate every existing login cookie, including the attacker's.
Review hosting, database, WordPress and external-service credentials from a trusted device. Revoke exposed keys and rotate credentials again after cleanup so residual access does not survive the initial reset.
When to rebuild instead of cleaning
Choose a controlled rebuild when the infection cannot be confidently removed or the surrounding account remains compromised. Validate a known-clean backup, close the entry point and test recovery on staging. A file timestamp alone cannot prove a backup predates the intrusion.
Deleting the site and starting over is the last option, not the first: without a backup it destroys content, orders and customer records that no cleanup needed to touch.
Harden WordPress so it does not happen again
Update core, themes and plugins, delete what you do not use, turn on two-factor for every administrator, and set DISALLOW_FILE_EDIT to true in wp-config.php. Keep a weekly backup stored off the server.
Confirm your hosting account’s backup retention and restore process rather than assuming every WordPress plan has a daily recovery point. The cPanel backup and restore guide explains the separate file and database checks.
After recovery, update WordPress and its components through a tested process. Keep the incident evidence and confirm that the original failing URL no longer redirects or serves injected content before requesting removal of security warnings.
Frequently asked questions
How do I fix a hacked WordPress site?
Back up, change the admin, hosting and database passwords, review and revoke unauthorised access, replace wp-admin and wp-includes from a clean copy of the same version, and review suspicious plugins and reinstall trusted components.
Can a hacked WordPress site be recovered?
Yes when you still have the files and the database, or a backup from before the change. If the account is re-infected at once, the host has to scan outside WordPress.
Should I reinstall WordPress after a hack?
Replace core files. Do not delete wp-content until you have a copy, or you will lose uploads and the theme you actually use. Preserve evidence and data before replacement, verify the recovery copy, and involve the host if compromise extends beyond the WordPress installation.
Should I delete the hacked files before taking a backup?
No. Take the backup first, because the infected file shows how the attacker got in and a clean restore needs a reference point. Delete the evidence only after the copy is off the server.
How do I stop a WordPress site being hacked again?
Update core, themes and plugins, remove unused ones, turn on two-factor for administrators, set DISALLOW_FILE_EDIT to true, and keep off-server backups. Recheck the user list for a week after cleanup.
Last editorial update: 14 November 2026.
Ready to get started with WebJi®?
Join 12,000+ businesses across India and overseas. INR pricing, 18% GST shown before payment and 24/7 email support in Hindi and English — average first reply under 60 minutes.