WordPress Hacked? How to Recover Your Website and Remove Malware

If your WordPress website has been hacked, the priority is to contain the damage, find out how the attacker got in and restore a clean copy before you ask Google to lift any warnings. Most hacked WordPress websites can be recovered without a rebuild, provided you work through the problem in order rather than deleting files in a hurry. Organisations with WordPress development and support for UK businesses in place usually have backups, logs and an incident process ready and the steps below follow the same order a support team would.

A hack rarely announces itself with a defaced homepage. Modern malware tends to stay hidden, redirecting some visitors to scam pages or adding spam links, so the first sign is often a warning from Google, your host or a customer. The recovery process breaks down into four stages.

Each stage is covered below, starting with the signs to look for if you only suspect a problem. If the website holds personal data, keep a written record from the moment you notice the issue.

Signs Your WordPress Website Has Been Hacked

The clearest signs of a hacked WordPress website are warnings from Google or your host, administrator accounts nobody created and visitors being sent somewhere you did not send them. The WordPress.org FAQ on what to do after a hack calls these indicators of compromise and it lists Google flagging the website, a host disabling it and unauthorised new users among the clearest examples. Check your website against the list below.

• A malware, phishing or hacked content warning in Google Search Console or in the browser.
• A suspension or abuse notice from your hosting provider.
• Administrator accounts with usernames or email addresses nobody on your team recognises.
• Redirects to unfamiliar websites, often only for visitors arriving from search results or on a phone.
• Spam pages, pharmaceutical links or foreign language content appearing in Google results for your domain.
• Unfamiliar PHP files in wp-content/uploads, or files with double extensions such as image.jpg.php.
• Changes nobody made to .htaccess, wp-config.php or theme files such as header.php and footer.php.
• Customers reporting that their antivirus software blocks your website, or email from your domain landing in spam folders.

Many infections are conditional, which is why a website can look perfectly normal when you visit it yourself. Malware often targets visitors who are not logged in or people arriving from Google, so check from a private browser window on a different device and search Google for your domain to see which pages are indexed.

How to Check If Your WordPress Website Is Hacked

The quickest reliable check is to compare your files against the official versions and review who has administrator access. WordPress publishes checksums for every core release and for plugins in the WordPress.org directory and the WP-CLI core verify-checksums command compares your installed files against them.

If you have command line access, the commands below give a fast first picture. Plugin checks only cover plugins hosted on WordPress.org, so premium and custom plugins need comparing against a fresh download.

# Check WordPress core files against the official checksums
wp core verify-checksums --include-root

# Check every plugin installed from the WordPress.org directory
wp plugin verify-checksums --all

# List administrator accounts with their registration dates
wp user list --role=administrator --fields=ID,user_login,user_email,user_registered

Any modified core file, unexpected file in the root directory or recently registered administrator needs investigating. Search Console is the other place to look, since its Security Issues report shows whether Google has detected hacked content, malware or phishing on your domain.

What to Do First When WordPress Is Hacked

The first job is containment, not deletion. Removing suspicious files straight away destroys the evidence you need to understand how the attacker got in and an attacker who still has a way back will simply reinfect the website.

Start by taking a full copy of the files and database as they are now, stored somewhere separate from your normal backups. The WordPress.org guidance recommends this snapshot even when the copy is infected and it doubles as evidence if you need to report the incident. Write down what you saw, when you noticed it and any recent changes such as a new plugin.

Next, put the website behind a maintenance page or restrict access to your own IP address so visitors stop being exposed to malicious code. Then change every credential that touches the website, which means WordPress accounts, the hosting control panel, the database user, SFTP and any API keys stored in plugins. Generate new security keys and salts in wp-config.php to log out every active session and run a malware scan on the computers your team uses to log in, since stolen credentials often come from an infected laptop.

Contact your hosting provider at this stage. On shared hosting an infection can spread to other accounts and the host can usually supply access logs showing when suspicious requests started. If you are locked out of the WordPress dashboard, the database can be edited through a tool such as phpMyAdmin to change an administrator email address and reset the password.

Restore From a Clean Backup or Clean Up Manually

Restoring a backup taken before the infection is usually the fastest route to a clean website, but only if you are confident the backup predates the compromise. Many hacks sit unnoticed for weeks, so the newest backup may already contain the backdoor that let the attacker in.

Check file modification dates and the first suspicious entries in the access logs before choosing a restore point. If no backup is clearly clean, cleaning the current website is the safer option.

For WooCommerce stores and websites that collect enquiries, the answer is often a mix of the two. Restore the files from a clean point, keep the current database and then check that database carefully for injected content.

How to Remove Malware From a WordPress Website

WordPress malware removal means replacing everything you can with clean copies from official sources and then inspecting what is left. Reinstall the same version of WordPress your website runs by uploading fresh wp-admin and wp-includes folders over SFTP. The WordPress.org guidance advises against the reinstall option in the dashboard for this job, as it overwrites existing files and can leave files added by the attacker in place.

Plugins and themes need the same treatment. Delete the plugin and theme folders and reinstall each one from the WordPress.org directory or the developer’s own website, then remove anything you no longer use rather than leaving it deactivated. Nulled premium plugins and themes, downloaded free from unofficial sources, often contain hidden backdoors and should be replaced with licensed copies or maintained alternatives.

The wp-content/uploads folder should hold media, not executable code, so any PHP file in it needs investigating and almost always removing. Check .htaccess files throughout the installation, compare wp-config.php line by line against wp-config-sample.php and search the remaining custom code for functions commonly abused in backdoors, such as eval combined with base64_decode, shell_exec, system and passthru.

The database comes next. Remove administrator accounts you do not recognise, confirm the siteurl and home values in wp_options still point to your own domain and search wp_posts for injected scripts, iframes and hidden links. Once the website is clean, change every password again and rotate the security keys a second time, since anything changed during the clean up may have been seen by an attacker who still had access.

Close the Hole So It Does Not Happen Again

Cleaning a website without finding the entry point usually leads to reinfection, so identify how the attacker got in before you bring it back online. Access logs and file modification dates normally point to the cause, which commonly turns out to be an outdated plugin or theme, a reused password or a compromised hosting account.

Update WordPress core, plugins and themes to their latest versions and replace any plugin its developer no longer maintains. The official WordPress hardening guide notes that older versions of WordPress are not maintained with security updates and that plugins you are not using should be deleted from the system.

Check the server’s PHP version too. WordPress recommends PHP 8.3 or greater and the PHP project’s supported versions table shows that each branch receives security fixes for four years in total before it reaches end of life.

File permissions and access controls close the remaining gaps. The WordPress guide to changing file permissions recommends 755 or 750 for directories, 644 or 640 for files and 440 or 400 for wp-config.php and adding DISALLOW_FILE_EDIT to wp-config.php removes the theme and plugin editors from the dashboard.

Two factor authentication for every administrator, limited login attempts and SFTP instead of FTP all reduce the chance of stolen credentials being used. A web application firewall, run as a plugin, a server module or a service in front of your host, filters malicious requests before they reach WordPress.

How to Get Google to Trust Your Website Again

Once the website is clean and back online, ask Google to review it through the Security Issues report in Search Console. Make sure the cleaned pages can be crawled, with no noindex tags or robots.txt rules blocking Googlebot, otherwise Google cannot confirm the problem has gone.

Google’s guidance on requesting a review asks you to explain what you did for each issue, such as the plugin you updated and the code you removed and warns that a request made before the problem is fixed only prolongs the warning. It says malware reviews take a few days, phishing reviews take about a day and reviews for websites hacked with spam can take several weeks, with browser and search warnings removed within 72 hours once a website is found to be clean.

Spam pages the attacker created should return a 404 or 410 status so they drop out of the index. A new wave of unfamiliar URLs in Search Console in the following weeks is a sign that something was missed.

When to Report a WordPress Hack to the ICO

If the hack exposed personal data, such as enquiry form submissions, customer accounts or WooCommerce orders, it may count as a personal data breach. Under Article 33 of the UK GDPR, the controller must notify the regulator without undue delay and, where feasible, not later than 72 hours after becoming aware of the breach. The exception is a breach that is unlikely to result in a risk to people’s rights and freedoms.

The ICO’s data breach reporting guidance says you must assess the likely risk to people, report to the ICO if a risk is likely and tell the affected individuals without undue delay if the risk is high. The page notes its guidance is under review following the Data (Use and Access) Act 2025, so check it for updates.

The ICO suggests telling your insurer too and considering reports to the National Cyber Security Centre and Report Fraud where criminal activity is involved. If an agency or host manages your website, it acts as a processor and must tell you without undue delay, so your support contract should state how incidents are reported to you.

Preventing Another Hack With Ongoing Maintenance

Most of the measures that prevent a repeat hack are routine rather than technical and they only work if someone carries them out every week. Regular updates, backups that are tested by restoring them, file integrity monitoring and regular reviews of user accounts close the gaps attackers rely on.

Backups deserve particular attention, since a backup you cannot restore offers no protection. Store copies away from the server they protect and test restores on a schedule, not for the first time during an incident.

Hosting matters as well. Account isolation, a current PHP version and server level firewalls remove several risks before WordPress even loads, which is the reasoning behind managed WordPress hosting. Malware that uses your server to send spam can slow page loads too, so a sudden drop in speed is worth checking alongside the causes in our guide to why a WordPress website is slow to load.

Priority Pixels maintains over 200 WordPress websites and our WordPress maintenance and security services include daily malware scans, file integrity monitoring on core files and nightly encrypted backups stored offsite. Updates are tested on staging first, high risk and critical patches are applied within 14 days and critical zero day issues are addressed on the day.

If your website has already been compromised, our WordPress support team treats it as an urgent incident, with a response within two hours during working hours and work continuing until it is resolved. We investigate how the attacker got in, remove the infection and harden the website against the same route and we are Cyber Essentials certified under the government scheme backed by the National Cyber Security Centre.