Hacked WordPress site? The cleanup checklist we follow

The signs are hard to miss once you look: spam pages showing up in Google under your domain, mobile visitors redirected to another site, a warning from your host, or a red screen in Chrome. This is the order we work in when a WordPress site has been compromised. Speed matters, but doing the steps in order matters more.

1. Take a snapshot before you change anything

Back up the files and the database exactly as they are, infection included. You may need them to work out how the attacker got in, and you will want a fallback if a cleanup step breaks something.

2. Lock the doors

• Change the passwords for hosting, SFTP, the database and every WordPress administrator.
• Remove administrator accounts you do not recognise.
• Replace the security keys and salts in wp-config.php, which signs everyone out of every session.
• Put the site into maintenance mode if it is redirecting visitors or serving malware.

# with WP-CLI on the server
wp user list --role=administrator
wp config shuffle-salts

3. Replace what you can, inspect what you can't

WordPress core and plugins from WordPress.org can be checked against their official checksums. Anything that fails, and any premium plugin or theme, should be reinstalled from a fresh vendor download rather than cleaned by hand.

wp core verify-checksums
wp plugin verify-checksums --all

What remains is the part only you own: the uploads folder, the database and wp-config.php. Look for PHP files inside wp-content/uploads, which should only ever hold media, unfamiliar code at the top of wp-config.php or .htaccess, and injected scripts in posts, widgets and the options table.

4. Close the hole they came in through

Most WordPress compromises come through an outdated plugin or theme, a nulled premium plugin, or a reused password. Update everything, delete plugins and themes you are not using, and replace any nulled software with a licensed copy. Then stop PHP from running in the uploads folder:

# wp-content/uploads/.htaccess (Apache 2.4)
<FilesMatch "\.php$">
  Require all denied
</FilesMatch>

5. Tell Google the site is clean

In Google Search Console, check the Security issues report and look for spam URLs in the Pages report. Spam pages that now return 404 or 410 drop out as Google recrawls them. If Google flagged the site, request a review once it is clean, and use the Removals tool to hide spam URLs from results in the meantime.

6. Keep it clean

• Automatic updates for minor core releases and for plugins you trust
• A firewall plugin or a firewall at the host or CDN
• Daily off-site backups, with a restore you have actually tested
• Two-factor login for every administrator
• One named person who checks updates every week

Where to start

If the site is redirecting visitors right now, change the passwords and switch on maintenance mode first; everything else can follow within the day. If you would rather hand it over, our WordPress team handles malware cleanup and ongoing care, and you can book a call to talk it through.