How to clean a hacked WordPress site

This guide walks through cleaning up a WordPress site that has been hacked, and making it harder to break into again.

Signs your site has been hacked

• Visitors are sent to spam, gambling or pharmacy sites.
• Google or your browser warns that the site is dangerous.
• There are admin users, pages or plugins you didn’t add.
• You can’t log in, or your password has changed.
• Your account is sending spam email.
• You get a malware warning from us.

Scan the site

1. Log in to cPanel and open Imunify360.
2. Run a scan and look at the list of infected files.
3. Use the clean option where offered.

See how to scan your site for malware for more detail. A scan can clean known infections, but it can’t always find every change a hacker made, so carry on with the steps below.

Restore a clean backup

JetBackup keeps copies of your account taken every six hours. Restoring files and the database from before the hack is often the quickest fix.

1. Work out roughly when the problem started.
2. In cPanel, open JetBackup and pick a backup from before that date.
3. Restore the files and the database.

See how to restore a backup with JetBackup. Anything added to the site since that backup will be lost, so copy any new orders or posts first.

Change every password

Change all of these, not just your WordPress one:

1. Every WordPress admin password.
2. The database user password. In cPanel, go to MySQL Databases, change it, then put the new one in wp-config.php.
3. FTP account passwords, under FTP Accounts.
4. Your cPanel and client area passwords.

Clean up WordPress

1. Go to Users and delete any admin you don’t recognise.
2. Go to Plugins and delete any you didn’t install or don’t use. Do the same in Appearance, then Themes.
3. Reinstall WordPress core. In WP Toolkit in cPanel, or in WordPress under Dashboard, then Updates, use the Reinstall option. This replaces the core files without touching your content.
4. Update every plugin and theme. See how to update WordPress themes and plugins.

If it doesn’t work

• The hack comes back. Something is still left behind, often in a plugin or the uploads folder. Run the scan again, and look for .php files inside wp-content/uploads, which shouldn’t be there.
• Google still shows a warning. Once the site is clean, request a review in Google Search Console.
• You’re not sure what’s safe to delete. Open a ticket before deleting anything and tell us what you’ve found.

Good to know

Most hacks come through out-of-date plugins and weak passwords. Once you’re clean, see how to secure WordPress. Cleaning a site by hand can be a big job. If you’d like our help, open a ticket and we’ll tell you what we can do.

Still stuck? Open a support ticket and we’ll help.