Discovering that your website has been hacked is stressful. Customers call to say your site sends them to a betting page, Google shows a red warning, or your host suspends the account for sending spam. Do not panic. Most infections can be cleaned with a careful, methodical process. This guide explains how to clean a hacked WordPress website, step by step, and how to stop it happening again.
Signs your WordPress site has been hacked
- Visitors are redirected to unknown websites, especially on mobile.
- Google search results show strange titles, foreign language text or spam products under your domain.
- Browsers or Google Search Console show "This site may be hacked" or "Deceptive site ahead" warnings.
- New admin users appear that nobody in your team created.
- Your host warns you about malware or suspends your account.
- Your website is suddenly very slow, or your emails start bouncing because your domain is blacklisted.
- Unknown files or folders appear in your hosting account.
Before you start: stay calm and contain the damage
Take these first actions straight away:
- Tell your host. They may already know about the infection and can help, scan the account or restore backups.
- Put the site in maintenance mode if visitors are being redirected, so customers are not harmed while you work.
- Change key passwords from a clean device: hosting control panel, FTP or SFTP, database, WordPress admin accounts and the email account linked to WordPress.
- Take a backup of the hacked site. It sounds strange, but you want a copy of the current state in case something goes wrong during cleaning and for investigation.
How to clean a hacked WordPress website: step by step
Step 1: Check whether you have a clean backup
The fastest route is often restoring a backup from before the hack. Look in your hosting control panel or backup plugin for daily copies. Pick one from before the first sign of trouble. Be aware that you will lose any content added since, and that restoring alone does not fix the weakness the attacker used. You must still complete the hardening steps below.
Step 2: Scan the site
Use a reputable WordPress security plugin to scan for malware, and use your host's malware scanner if available. Note every file flagged. Online scanners that check your public pages can also show injected spam or redirects.
Step 3: Replace WordPress core files
Core files should never be modified. Download a fresh copy of the same WordPress version from wordpress.org and replace the wp-admin and wp-includes folders completely. Replace the root files too, but keep your wp-config.php and the wp-content folder. Then inspect wp-config.php carefully for any unfamiliar code.
Step 4: Reinstall plugins and themes from trusted sources
Attackers often hide code inside plugins and themes. The safest approach is:
- Make a list of the plugins and themes you need.
- Delete everything you do not use.
- Delete and reinstall each remaining plugin and theme from the official WordPress directory or the developer's own website.
- Never reinstall "nulled" or pirated premium plugins; they are a frequent source of infections.
Step 5: Inspect the uploads folder
The wp-content/uploads folder should contain only media such as images and PDFs. PHP files there are a strong sign of a backdoor. Search for files ending in .php inside uploads and remove them after checking. Also look for oddly named files and recently modified files.
Step 6: Clean the database
Using phpMyAdmin in cPanel or a database tool, look for:
- Unknown administrator accounts in the users table. Delete them.
- Injected scripts or spam links in posts, pages and widgets. Search for terms like "script", "eval" or unfamiliar domains.
- Changes to the siteurl and home values in the options table that redirect visitors.
Take a database backup before editing, and work carefully.
Step 7: Check server level files
Review the .htaccess file in your site's root and in subfolders for redirect rules you did not add. Also check for unknown cron jobs in cPanel and unfamiliar files in the home directory outside public_html.
Step 8: Reset all credentials again
Once the site is clean, change every password one more time, including all WordPress user passwords. Generate new security keys and salts in wp-config.php, which logs everyone out and invalidates stolen sessions.
Step 9: Update everything
Update WordPress core, every plugin and every theme to the latest versions. Make sure your server runs a supported PHP version.
Step 10: Request a review from Google
If Google flagged your site, open Google Search Console, go to the Security Issues report, confirm the problems are fixed and request a review. Once approved, the warnings are removed. If your domain was blacklisted for spam, request delisting from the relevant blacklist services.
How to stop it happening again
Cleaning without fixing the cause means you will be hacked again. Work out how the attacker got in. Common causes include an outdated plugin, a weak admin password, a nulled theme or a compromised computer used to log in. Then put these protections in place:
- Use strong, unique passwords and two factor authentication for all admin users.
- Limit the number of administrator accounts.
- Update plugins, themes and core weekly.
- Install a security plugin with a firewall and login protection.
- Keep automatic daily backups stored off the server.
- Choose hosting that isolates accounts and scans for malware.
When to call in professional help
If the infection keeps returning, if you are not comfortable with file managers and databases, or if customer data might have been exposed, get help from an experienced professional. If personal data was involved, you may also need to consider your obligations under Uganda's Data Protection and Privacy Act, so seek proper advice. Baasa Cloud's support team can help clients investigate infections, restore from our daily backups and secure their WordPress sites on LiteSpeed hosting.
Frequently asked questions
Can I just delete the infected files the scanner finds?
Sometimes, but scanners do not catch everything. Replacing core files, reinstalling plugins and checking the database is more reliable.
How long does it take to clean a hacked site?
A simple infection with a good backup can be fixed within hours. Complex infections without backups can take a day or more.
Will I lose my Google rankings?
Short infections cleaned quickly usually have limited long term impact. Long running spam injections can do more damage, so act fast.
Conclusion
Knowing how to clean a hacked WordPress website gives you control in a stressful moment. Contain the damage, restore or clean methodically, reset every credential, update everything and fix the original weakness. Then keep strong habits and good backups so you never have to do it again.