WordPress Site Hacked? A Step-by-Step Malware Removal and Recovery Guide

By Ali Shabbir (CTO), reviewed by Mustafa Zakir Hussain. Last updated: October 2026.

If your site is hacked, follow the correct order for WordPress malware removal. Contain first. Keep a forensic copy. Clean from known-good sources. Then close the entry point or the hack will come back.

That order matters. Many site owners clean files first, skip passwords, and miss the backdoor. The site looks fine for two days. Then spam pages return. Search warnings return. This guide shows you how to clean hacked WordPress site files in a safe sequence so you remove malware from website files and stop reinfection.

If you have not confirmed the hack yet, read this first: Is My Website Hacked? Warning Signs and First Steps. If you already see Japanese spam, redirects to betting sites, or a Google red warning, stay here and work through the steps below.

Keep this page open. You will need the links to WordPress docs, Sucuri SiteCheck, and Google Safe Browsing during cleanup.

Before you touch anything: contain and copy

Do not start deleting files yet. Your first job is to stop damage and save evidence.

Take the site offline or limit access. If you use maintenance mode, use a 503 status, not a redirect. In Hostinger hPanel or cPanel, you can also pause the site, password protect it, or block all IPs except yours with .htaccess. This stops visitors from hitting infected pages while you work.

Next, make two copies.

First, make a forensic copy. Zip the full public_html folder and export the database. Label it hacked-before-clean-date.zip and store it on your laptop, not only on the server. This copy helps you compare later. It also protects you if cleaning breaks something.

Second, check for a clean backup. Look in Hostinger backups or your backup plugin. Note the date. Only restore from a backup made before the hack date. If you are not sure of the hack date, do not restore yet. Keep the info for later.

Also take screenshots. Save the warning message, the spam URL, and the Google result. You will need these for the delisting step.

Write down the basics: when you noticed it, what changed, who has admin or FTP access, and what changed recently (new plugin, new user, new theme). This note becomes your WordPress hack recovery log.

Change every password and key

Do this before deep cleaning. If an attacker still has a login, cleaning is pointless.

Change in this order:

1. Hosting panel and FTP/SFTP password. Create a separate FTP user for cleanup if possible. Delete old or unknown FTP accounts.
2. WordPress admin passwords. Change your own password from the database or hosting panel if wp-admin is redirecting.
3. Database password. You will update wp-config.php after.
4. Email passwords linked to admin accounts. Attackers often reset passwords through email.

Use long, unique passwords. Store them in a password manager. Do not share them over plain chat or email.

Remove unknown users now. Go to Users in wp-admin, or check via database if you cannot log in. Look for new Administrators you did not create. Demote or delete them. Also check FTP accounts and hosting users for extra entries.

This is the core of any WordPress hacked fix. Lock the doors, then clean the rooms.

WordPress malware removal scan: plugin scanners, server scans and manual checks

Now scan to map the problem. No single scanner finds everything. Use three layers.

1. Plugin scanner. Install Wordfence or Sucuri Security from wordpress.org on a staging copy if possible. Run a full scan. Save the list of modified core files, unknown files in uploads, and suspicious code in themes. Do not click auto fix for all items yet. You want the list first.

2. External scan. Run your URL through Sucuri SiteCheck. It shows blocklist status, injected scripts, and spam links visible from outside. Take a screenshot. Run it again after cleanup to compare.

3. Server scan and manual checks. In Hostinger File Manager or via SSH, check recent file changes. Sort by modified date. Look for files changed around the hack date. Common red flags:

• New .php files inside /wp-content/uploads/ (uploads should be images, PDFs, videos, not PHP)
• Random files in root like wp-sec.php, alfa.php, cache.php
• Modified index.php, wp-config.php, .htaccess
• Large functions.php in theme with base64 or long encoded strings

You can list recently changed PHP files with SSH:

find public_html -type f -name "*.php" -mtime -30 -ls | sort -k9

This does not prove infection by itself. It tells you where to look. Copy the list into your recovery log.

For official background steps, keep WordPress docs open: FAQ: My site was hacked.

Clean core files from wordpress.org

WordPress core should come from only one place: wordpress.org. Do not try to edit hacked core files line by line. Replace them.

Here is the safe method:

1. Note your WordPress version from wp-includes/version.php.
2. Download the exact same version from wordpress.org.
3. Back up wp-config.php and .htaccess separately.
4. Delete wp-admin and wp-includes folders on the server. Upload fresh copies from the zip.
5. Replace all root files except wp-config.php and .htaccess. Replace index.php, wp-login.php, wp-settings.php and others with fresh copies.

Do not overwrite wp-content. You will handle that next. Do not overwrite wp-config.php.

After replacement, re-run the plugin scanner. Core file warnings should drop to zero. If warnings remain, you replaced the wrong version or missed a folder.

This step alone fixes many cases where attackers edited core to load spam. But do not stop here. Core is rarely the entry point.

Replace plugins and themes with fresh copies

Outdated plugins and themes cause most WordPress hacks. To remove malware from website extensions, delete and reinstall. Do not just click update.

List all plugins and themes. Note active vs inactive. Delete any inactive theme or plugin you do not need. Fewer parts means fewer holes.

For each needed item:

1. Delete the plugin folder from /wp-content/plugins/ via FTP.
2. Download a fresh copy from wordpress.org or the paid vendor account.
3. Upload and activate the clean copy.
4. Do the same for themes in /wp-content/themes/. Keep only your active theme and one default theme like Twenty Twenty-Four. Delete the rest.

Never use nulled themes or plugins. If you find one, remove it. Buy a license or find a free alternative. Nulled packs often include the backdoor itself.

After reinstall, update everything to the latest version that fits your PHP version. Check the vendor changelog for security fixes. If a plugin has not been updated in over a year, replace it with a maintained option.

Hunt in uploads: PHP files that should not be there

The uploads folder is a favorite hiding place. It is writable, so attackers drop shells there.

Open /wp-content/uploads/ in File Manager. Search for *.php. In a normal site, you should find zero PHP files here. If you find any, treat them as suspect.

Common tricks:

• uploads/2024/09/logo.png.php or image.jpg.php
• uploads/cache.php or uploads/thumb.php
• Hidden folders like uploads/.temp/ or uploads/js/

Download one suspect file to view locally if you have skills. Look for eval(, base64_decode(, move_uploaded_file, or calls to strange domains. Do not open the PHP URL in your browser. That can run the shell.

Delete suspect PHP from uploads. Then check for legitimate files that were altered. Open a few recent images. If an image file contains PHP code at the top, delete it and re-upload the original from your media backup.

Block PHP execution in uploads after cleanup. Add this to .htaccess inside the uploads folder on Apache hosts:

<Files *.php>
deny from all
</Files>

On Nginx or Hostinger setups, ask support for the correct rule to block PHP in uploads. This one setting stops many reinfections.

Clean the database: injected scripts, spam posts, rogue admins

File cleanup is not enough. You must clean the database to finish WordPress hack recovery.

Back up the database again before you edit. Name it before-db-clean.sql.

wp_users and wp_usermeta. Look for Administrators you did not add. Check user_email domains you do not know. Delete rogue users or change their role to Subscriber, then delete. Also check wp_usermeta for capabilities set to admin for strange IDs.

wp_posts. Search for spam. Use SQL:

SELECT ID, post_title, post_type, post_status FROM wp_posts WHERE post_title LIKE '%casino%' OR post_content LIKE '%<script%' OR post_content LIKE '%viagra%' LIMIT 50;

Look for draft posts with casino, loan, or adult keywords. Look for posts with publish status that you did not write. Move them to trash, then delete permanently.

wp_options. Check siteurl, home, admin_email. Attackers change admin email to theirs. Check blog description and widgets for injected scripts.

If your scanner offers database cleanup, review each change before you accept. Keep a list of what you removed.

Find and close the entry point

Cleaning without closing the hole guarantees a second hack. You need to find how they got in.

Check these in order:

1. Old plugin or theme. Compare install dates and versions against vendor security posts. If an old slider, form, or gallery plugin was present, that is often the path. Remove it.
2. Weak admin login. Check access logs for many wp-login.php hits from one IP. Check for user admin with a short password. Remove the admin username. Use a unique login name and 2FA.
3. Extra admin or FTP user. If you found a rogue user, note creation date. That date points to when the hole was used.
4. Nulled extension. Remove it fully.
5. Hosting cross infection. On shared hosting, ask Hostinger support if other sites on the same account show infection. Clean all sites together or they will reinfect each other.

Update everything after you remove the cause. Update WordPress core, PHP version (use a supported PHP 8.x), themes, and plugins. Turn on auto updates for minor core and security releases.

Write the cause in your log: what version was old, what you removed, what you updated. If you cannot find the cause after two passes, assume passwords or a plugin hole and reset both.

Rotate salts, database and FTP passwords

Salts log out all sessions, including attacker sessions. Many owners skip this and stay logged in with a stolen cookie.

Open wp-config.php. Find the eight AUTH_KEY, SECURE_AUTH_KEY lines. Replace them with new values from the WordPress salt generator. Save. All users will need to log in again. That is expected.

Now rotate secrets again, in order:

1. Change database password in hosting panel. Update DB_PASSWORD in wp-config.php to match. Test the site.
2. Change FTP/SFTP password again after cleanup. Malware on your PC can steal old FTP logins. Scan your own computer for malware too.
3. Change WordPress admin passwords one more time after salts.
4. Reconnect backup plugin, SMTP plugin, and payment keys with new passwords.

Store new keys in your password manager. Remove old FTP users. Keep only one admin per person. Give Editors only Editor rights, not Admin.

Get delisted: Search Console and Safe Browsing

If Google shows This site may be hacked or a red warning, you need a review after cleanup. Warnings do not clear on their own.

1. Verify ownership in Google Search Console if you have not done so.
2. Confirm cleanup is complete. Re-run Sucuri SiteCheck and check Google Safe Browsing status. Both should show clean.
3. In Search Console, go to Security Issues. Read each issue. Fix any listed sample URLs. If spam pages were indexed, delete the posts, return 404 or 410, and request removal for those URLs.
4. Click Request Review. Explain what you fixed in plain words. Example: contained site, replaced core from wordpress.org, reinstalled plugins and themes, removed PHP from uploads, cleaned database, updated all passwords and salts.
5. Check Bing Webmaster Tools as well if you use it.

Review can take a few days. Do not submit again and again on the same day. Keep the site clean during review. If warnings persist, re-scan. One leftover file can fail the review.

Also check your sitemap for spam URLs and resubmit it. Check search results with site:yourdomain.com to spot leftover hacked pages.

Harden and monitor

Hardening means making the next attack harder and making detection faster.

Do these basics:

• Keep daily backups off server. Keep at least 7 days. Test restore once.
• Turn on 2FA for all admins. Use limit login attempts.
• Use a firewall plugin or Hostinger firewall. Block xmlrpc.php if you do not need it.
• Disable file editing from dashboard: add define('DISALLOW_FILE_EDIT', true); to wp-config.php.
• Set correct file permissions: 644 for files, 755 for folders, 600 for wp-config.php where possible.
• Keep only needed plugins. Delete the rest.
• Monitor file changes. Turn on alerts for new admin users, plugin installs, and core changes.

If you host with DeskBees in Secunderabad, your client sites run on Hostinger with managed updates, daily backups, and firewall rules set for WordPress. You still need 2FA and least privilege users on your side. Hosting protects the server. You protect logins and plugins.

Set a weekly check: updates pending, users list, SiteCheck result, Search Console messages. Ten minutes a week catches most issues early. Save your Hacked Site Emergency Card near your passwords so you can act fast next time.

When to call a professional

You can clean a simple hack yourself if you are comfortable with FTP, phpMyAdmin, and backups. Call for help in these cases:

• The site gets reinfected within days after a full clean
• wp-admin stays locked, redirects, or shows a white screen after core replacement
• The database is large and spam is spread across hundreds of posts
• Payment data or customer data may have been touched
• Google review fails twice

A professional WordPress hacked fix should include containment, clean reinstall from known sources, database cleanup, entry point closure, password and salt rotation, and delisting help. Ask for a list of what was removed and what was updated. Ask what caused it. Without that, you cannot prevent the next one.

If you need managed website hosting and cleanup help, DeskBees can check the site, clean it, and move it to hardened hosting. For urgent cases, use the contact page or WhatsApp below.

FAQs

How do I know if my WordPress site has malware?

Common signs are redirects to unknown sites, casino or betting pages you did not create, a Google red warning, new admin users, unknown plugins, or a sudden drop in traffic. Confirm with Sucuri SiteCheck and Search Console Security Issues. Compare with the signs listed in Is My Website Hacked? Warning Signs and First Steps. One sign is enough to start containment.

Can I clean a hacked WordPress site myself?

Yes, if the hack is recent and you can use FTP and phpMyAdmin. Follow the order in this guide: contain, save copies, reset passwords, scan, replace core and extensions from clean sources, clean uploads and database, close the hole, rotate salts, and request review. Call a professional if reinfection happens, if customer data is involved, or if you cannot find the entry point after a full pass.

How long does WordPress malware removal take?

A small site with a clear cause can take 4 to 8 hours of focused work plus waiting time for Google review. A large shop, multisite, or repeated hack can take 2 to 4 days including monitoring. Delisting adds extra waiting time after cleanup. Keep backups and logs so each step does not need rework.

Site hacked right now? Get help fast

Site hacked right now? WhatsApp us the address. You will get a quick check and a clear note on what the clean-up involves.

Open WhatsApp

Want to be ready next time? Ask for the Hacked Site Emergency Card. It lists contain, copy, reset, clean, close, and delist steps on one page for your team.

Written by Ali Shabbir (CTO), DeskBees Secunderabad. Reviewed by Mustafa Zakir Hussain.