Cleaning a Hacked WordPress Site and Root Cause

Search engine warnings

Google Search Console may show “Deceptive site ahead” or “Malware detected” while Bing flags phishing. These warnings come from injected JavaScript redirect scripts, hidden iframe payloads, or .htaccess rewrites that send organic traffic to spam domains. Do not request review until the site is actually clean, or you risk a repeat penalty.

Quick detection commands

Run these from the site root over SSH in 2026 to see what the crawler sees:

curl -s -A 'Mozilla/5.0 (compatible; Googlebot/2.1)' https://example.com/ | grep -i 'script|iframe'
grep -r 'base64_decode|eval(|gzinflate' wp-content/ wp-includes/ 2>/dev/null | head -20
cat .htaccess | grep -i 'rewriterule.*http'

Also check Search Console > Security Issues and compare the live HTML against a known-good backup diff. Pitfall: caching plugins may serve old malicious HTML; purge all caches (WP Rocket, LiteSpeed) before trusting the curl output. Rollback: if you break the site with edits, restore from the pre-cleanup backup you took first.

Finding the entry point

The entry point is how attackers got in: an outdated plugin with a known CVE, a nulled theme, weak wp-admin password, or an unprotected REST/XML-RPC endpoint. In 2026 most mass infections still enter via abandoned plugins removed from the directory and via compromised FTP credentials.

Locating the hole

Check access logs for POST floods to admin-ajax.php or xmlrpc.php and for 404s of plugin setup files:

grep 'POST.*xmlrpc' /var/log/nginx/access.log | tail -50
awk '{print $1}' /var/log/nginx/access.log | sort | uniq -c | sort -nr | head

Look at wp-content/uploads/ for PHP files — uploads should only hold media. Use wp plugin list --fields=name,version,status with WP-CLI 2.11 to spot plugins not updated since 2024. Compare each against the WordPress.org plugin directory for last-update date. If a plugin is abandoned, that is likely your door. If you need a maintained stack, see our guide on WordPress login, permissions and file monitoring hardening to close it after cleanup.

Cleanup order: Step-by-step removal process

Follow this exact sequence so you do not re-infect a partially cleaned site.

1. Put the site in maintenance mode and block traffic at the edge or with wp maintenance-mode activate.
2. Back up files and database even if infected: tar -czf infected-backup.tar.gz . and wp db export infect.sql.
3. Replace core with a fresh download: wp core download --force --version=6.8.
4. Reinstall plugins/themes from official sources only, then delete unused ones.
5. Remove rogue admins: wp user list --role=administrator and delete unknown IDs.
6. Rotate salts in wp-config.php, database password, FTP/SFTP keys, and API tokens.

Why this order: core first kills most backdoors; secrets last prevents the attacker from walking back in with stolen creds. Pitfall: running wp core download --force on a site with custom wp-content is safe, but never force-download into a child-theme-only custom path without checking. Rollback: the tar and SQL dump from step 2 let you revert in minutes if the site whitescreens.

Verifying cleanup

After the ordered steps, confirm no PHP lives in uploads and file checksums match:

find wp-content/uploads -name '*.php' -delete
wp core verify-checksums
wp plugin verify-checksums --all

Request a review in Search Console only after verify-checksums returns clean and no malicious cron remains in wp_options under the cron key.

Hardening and re-checking

Cleaning without hardening means reinfection within weeks. Install a file-integrity monitor, disable file editing, and enforce least privilege. Add to wp-config.php:

define('DISALLOW_FILE_EDIT', true);
define('FORCE_SSL_ADMIN', true);

Set uploads to 0644 files and 0755 dirs, and run PHP 8.3+ with open_basedir confined to the web root. Use official wp-config documentation for 2026 defaults. Re-check weekly with wp core verify-checksums and a malware diff against your clean backup. For teams that lack in-house ops, our WordPress maintenance and care plans include continuous monitoring so you do not repeat this fire drill. If you are rebuilding the stack anyway, the 2026 guide to building a trade website covers hardened hosting choices.

Common pitfalls and rollback

Do not delete the database to “start fresh” — you will lose orders. Do not trust a single scanner; use two (Wordfence CLI plus manual grep). If a hardening rule locks you out of wp-admin, comment the line in wp-config.php over SFTP to roll back instantly.

Frequently asked questions

How long does it take to clean hacked WordPress site?

A single-site manual cleanup takes 2–6 hours including log review. Reinfection from missed backdoors is the main delay.

Should I restore from backup instead of cleaning?

Yes if you have a pre-infection backup from before the attack; otherwise clean in place using the ordered process above.

Will Google remove the warning automatically?

No. After cleanup you must request review in Search Console; allow 3–7 days for the malware flag to lift.

Action checklist

• Isolate site and take full backup before any edit
• Run curl/grep to confirm search-engine-visible payloads
• Find entry point via access logs and abandoned plugins
• Execute the 6-step cleanup order and rotate all secrets
• Harden wp-config, permissions, and set weekly checksum checks

Need it done right? Get our WordPress maintenance team to clean, harden and monitor your site — see all services for details.

“, “faq”: [{“question”: “How long does it take to clean hacked WordPress site?”, “answer”: “A single-site manual cleanup takes 2-6 hours including log review. Reinfection from missed backdoors is the main delay.”}, {“question”: “Should I restore from backup instead of cleaning?”, “answer”: “Yes if you have a pre-infection backup from before the attack; otherwise clean in place using the ordered process above.”}, {“question”: “Will Google remove the warning automatically?”, “answer”: “No. After cleanup you must request review in Search Console; allow 3-7 days for the malware flag to lift.”}], “cover”: “Modern flat technical illustration of a WordPress site being cleaned: a shield over a server rack, malware scripts swept into a bin, magnifying glass on a plugin folder, blue and orange accents, no text or logos, 1200×630.

References & further reading

• WordPress Developer Documentation
• WordPress Theme Handbook
• WordPress Plugin Handbook