WordPress Website Hacked? A Malware Cleanup and Recovery Guide

A suspicious redirect, an unfamiliar administrator account, or a malware warning can quickly turn a normal business day into a website emergency. Customers may lose access, search traffic may suffer, and your hosting provider may suspend the affected account.

Recovering a hacked WordPress website involves more than deleting the file that triggered an alert. You need to contain the incident, remove malicious changes, close the entry point, and verify that the website works safely again.

This guide explains how to approach that recovery.

Signs Your WordPress Website May Be Compromised

Some infections are obvious. Others operate quietly while your homepage continues to look normal.

Common warning signs include:

• Visitors being redirected to unfamiliar websites.
• Unexpected advertisements, pop-ups, or injected links.
• Administrator accounts you do not recognize.
• Unexplained changes to files, plugins, or settings.
• Spam pages appearing in search results.
• Malware alerts from your hosting provider.
• Unusual outgoing email or repeated resource spikes.

These symptoms warrant investigation, but they are not all proof of malware. For example, a slow website can also result from an overloaded database or a faulty plugin.

Record what happened, when it started, and any recent changes before beginning cleanup.

1. Contain the Incident and Preserve Evidence

If your website is redirecting visitors or serving harmful content, ask your hosting provider to temporarily restrict public access. A maintenance page served independently of WordPress can help protect visitors during recovery.

Before modifying anything, preserve a copy of the website files, database, and available logs. Store it privately, outside the public website directory, and clearly label it as potentially infected.

This copy is evidence—not a clean recovery backup. It can help an administrator investigate the attack and recover legitimate content accidentally removed during cleanup.

Contact your hosting provider early. Request the malware report, affected file paths, detection times, and any relevant access logs.

2. Identify the Scope and Likely Entry Point

The first malicious file you find may be only one part of the incident.

Review the affected website alongside other installations under the same hosting account. Forgotten staging sites, old applications, and unused WordPress copies can leave additional entry points open.

Investigate:

• Outdated or vulnerable plugins and themes.
• Stolen WordPress or hosting credentials.
• Untrusted software downloads.
• Unexpected administrator accounts.
• Unusual scheduled tasks.
• Files created or modified around the suspected incident.

The aim is to understand both what changed and how the attacker gained access. WordPress’s recovery guidance emphasizes investigating the attack vector so it can be addressed during recovery.

3. Choose a Recovery Method

A verified clean backup can provide a useful starting point. However, the latest backup may already contain the infection.

Check when the backup was created, what it includes, and whether it predates the earliest evidence of compromise. Where possible, restore it into an isolated environment for inspection.

Consider legitimate changes made since the backup, including orders, customer registrations, uploads, and new content.

If no trustworthy backup exists, recovery may require rebuilding the installation from clean software packages and carefully recovering legitimate content. A broad or recurring compromise may justify moving recovery to a fresh hosting environment.

Whichever route you choose, address the original vulnerability before reopening the website.

4. Clean the Files and Database

Use trusted packages to replace compromised WordPress core files, plugins, and themes. Preserve legitimate customizations for review, rather than copying them back without inspection.

Simply uploading clean files over an infected installation can leave attacker-added files behind.

The review should cover configuration files, uploads, must-use plugins, custom code, and unexpected files elsewhere in the hosting account. Database checks should examine unauthorized users, injected content, suspicious settings, and unwanted redirects.

For administrators with SSH access, WP-CLI checksum verification can help identify differences from official WordPress core files and supported WordPress.org plugin releases. However, passing checksums does not establish that the whole website is clean, and some commercial or custom plugins have no published checksums.

Avoid deleting files solely because their names look unusual. Confirm their purpose and preserve a recoverable copy first.

5. Secure Accounts and Close the Entry Point

From a trusted device, revoke suspicious access and change exposed credentials. Repeat credential rotation after cleanup if the compromised environment could have captured replacement passwords.

Depending on the incident, this may include WordPress, hosting, SFTP, SSH, database, and connected service credentials. Review active sessions, application passwords, and administrator privileges.

Then harden the recovered installation:

• Update WordPress, plugins, and themes.
• Remove unnecessary software.
• Replace abandoned or untrusted extensions.
• Enable two-factor authentication where available.
• Give users only the access they need.
• Review file ownership and permissions.
• Disable dashboard file editing if it is unnecessary.

WordPress recommends keeping software updated, obtaining official core releases from WordPress.org, and limiting unnecessary write access. Permission settings should suit your hosting environment.

6. Verify Recovery Before Reopening

A working homepage is only one recovery check.

Test important pages, login access, contact forms, checkout, uploads, scheduled tasks, and email delivery. Check for redirects while logged out and on different devices.

Run follow-up scans, review logs, and investigate unexpected file changes. Clear relevant caches after the cleaned version is ready.

If search engines or browsers flagged the website, request a review through the relevant service after addressing the reported issues. Warning removal may take time.

Continue monitoring after reopening. Returning malware is a reason to revisit the investigation, not simply repeat the same file deletion.

Common Mistakes That Lead to Reinfection

Recovery often fails when the visible symptom is removed but the attacker’s access remains.

Avoid restoring an unchecked backup, ignoring other sites in the account, retaining vulnerable software, or treating a single clean scan as conclusive evidence.

A security plugin can support detection and protection, but it does not replace a complete investigation.

When to Get Professional Help

Seek experienced support if malware returns, several websites are affected, hosting access is compromised, or you cannot confidently distinguish legitimate code from malicious changes.

For an online store or a website handling sensitive information, recovery should also assess whether information was accessed or altered.

Ask for a clear account of what was found, what was changed, what likely allowed the compromise, and what remains uncertain.

Recover Your Website with HostGree

HostGree offers WordPress malware cleanup and security hardening support for businesses, agencies, and hosting customers.

If your website is showing suspicious redirects, triggering malware alerts, or experiencing repeated infections, contact HostGree with your domain, symptoms, and hosting provider’s report.

A successful recovery restores more than the homepage—it restores a maintainable website with the weaknesses behind the incident addressed.