Recovering a Hacked or Virus Infected WordPress Website
  • 15
    Oct

Recovering a Hacked or Virus Infected WordPress Website

If your WordPress site has been hacked, for example it is sending spam, redirecting visitors, showing content you did not add, or has been flagged as dangerous by Google or your host, there is a clear order of work that will usually clean it out and stop it happening again. This guide is aimed at web masters and technical users. If you are not comfortable with SFTP, the command line or editing site files, please get help from someone who is.

Before you start

  • Take a full backup of the infected site (files and database) and keep it aside. It is evidence of what happened and a fallback if a clean-up goes wrong. Do not restore it to the live site.
  • Tell your hosting provider. Many hosts can run a malware scan, restore a backup, or tell you how the attacker got in, and some will have suspended the site to protect other customers.
  • If you can, put the site into maintenance mode, or block public access, while you clean it.

Step 1: Change every password and key

Assume the attacker has any credentials that were stored on the site or used on it, and change them all from a clean computer:

  • Hosting control panel, SFTP/SSH and database passwords. Use SFTP or SSH rather than plain FTP.
  • All WordPress user passwords, especially administrators. Use long, unique passwords from a password manager.
  • The database password in wp-config.php, and replace the security keys and salts in it (generate new ones at the WordPress.org salt generator). New salts log out every logged-in user, including the attacker.
  • Review your Users list and delete any administrator you do not recognise. Don’t keep the username “admin”: create a new administrator with a different name, then delete the old one.
  • Turn on multi-factor authentication for administrator accounts and your hosting login.

Step 2 (A): Restore a known, clean backup

The quickest route is to restore a backup taken before the infection. Work out roughly when the site was compromised (for example from file modified dates or host logs) and restore from before that date. Restore both the files and the database if your backup includes them. A restored site is vulnerable to the same hole that let the attacker in, so do not skip Step 3: update everything immediately.

Step 2 (B): No clean backup? Replace the files manually

Replace WordPress core

First back up wp-config.php and check it for malicious code, usually a block of obfuscated junk code (often using eval or base64_decode) at the top or bottom. Then replace the WordPress core files with a fresh copy of the latest version. The simplest ways are Dashboard > Updates > Re-install now, or, with WP-CLI:

wp core download --force --skip-content
wp core verify-checksums

The second command compares every core file with the official release and lists anything that is modified or does not belong. If you do not have WP-CLI, download WordPress from wordpress.org, delete the wp-admin and wp-includes folders on the server, and upload the fresh ones, then overwrite the files in the root (but not wp-content or wp-config.php).

Replace plugins and themes

List what is in /wp-content/plugins and /wp-content/themes. Delete anything you do not use, then reinstall the rest from their official source: the WordPress.org directory, or the vendor for premium products. With WP-CLI you can check the plugins from the directory with wp plugin verify-checksums --all. Never reinstall “nulled” (pirated) plugins or themes, which are a common way sites get infected. If a developer customised your theme, back it up first and compare the changes carefully before copying anything back.

Check the rest of wp-content

The uploads folder and the rest of wp-content cannot simply be replaced, so they need checking by hand or with a scanner:

  • The uploads folder should contain images and documents, not PHP files. Any .php file in there is suspicious.
  • Look for PHP files with recent or odd modified dates, files with random names, and unfamiliar folders. Also check for a mu-plugins folder you did not create, and for changes to .htaccess.
  • Open suspect files and look for blocks of obfuscated code. Delete files that do not belong; where you are unsure, ask your developer or host.

Check the database

Attackers also hide in the database. Check for unknown administrator users, spam posts or links injected into pages, changes to the siteurl and home options, and unfamiliar scheduled tasks or code in widgets and theme options.

Step 3: Update everything

Once the site is clean, close the hole that let the attacker in. Update WordPress, every plugin and every theme to the latest versions, and consider turning on automatic updates for security releases. Out-of-date plugins and themes are the most common way WordPress sites are compromised.

Step 4: Check file and folder permissions

As a general rule, folders should be 755 and files 644, with wp-config.php tighter still (for example 600 or 640, depending on your host). Wrong permissions are rarely the original cause of a hack, but they can make an infection worse. Check the site for errors afterwards, as some hosts or plugins need slightly different settings.

Step 5: Harden the site

  • Use a well-maintained security plugin such as Wordfence or Sucuri Security for malware scanning, file-change monitoring and a login firewall, and check regularly that the plugin you choose is still being updated.
  • Limit login attempts, for example with Limit Login Attempts Reloaded, and consider a web application firewall from your host or a service such as Cloudflare.
  • Keep regular off-site backups and test restoring them.
  • Give each user only the access they need, and remove accounts for people who have left.
  • Follow the official WordPress hardening guide.

Step 6: After the clean-up

  • If Google or your host flagged the site, check Google Search Console’s security issues report and request a review once the site is clean.
  • If customer data may have been exposed, you may need to report it to the ICO within 72 hours.
  • Watch the site and your host’s logs for the next few weeks, because reinfection usually means a backdoor was missed or the original hole was not closed.

If you are not sure the site is fully clean, the safest option is often a rebuild: a fresh WordPress install, with your content, media and a reviewed set of plugins moved across.

We hope you found this post helpful. If you have any questions or need help restoring a hacked or compromised WordPress website, please get in contact with us.

Need a hand? Lennox IT provides IT support for businesses in Derby, Nottingham and across the East Midlands. Get in touch or see our IT support plans.

Last reviewed: October 2026.

Leave a Reply