My WordPress Website Has Been Hacked — WordPress Malware Removal Guide

Any WordPress website can be hacked. When it happens, the instinct is to panic — don’t. Here’s exactly what to do: how to confirm it’s actually a hack, remove the malware, and secure the site so it doesn’t happen again.

Immediate first steps

Before diving into cleanup, do these three things right away:

1. Take the site offline or into maintenance mode if possible, to limit further damage while you investigate
2. Change all passwords — WordPress admin, hosting account, FTP/SSH, and database — since a hacker may already have credentials
3. Confirm you have a clean backup from before the compromise, if one exists — this becomes your fastest recovery path

How do you know if your WordPress site has been hacked?

Sometimes it’s obvious: the site has crashed, you can’t log in, it redirects to another page, or a store’s payment form has been swapped for a fake one. Your host may warn you directly, or Google may have blacklisted the site — often the first sign for site owners who don’t check daily.

Just as often, it’s not obvious at all. Malicious scripts are frequently designed to hide and keep running as long as possible without visible symptoms. That’s why every site should be scanned regularly with a security tool, rather than waiting for something to look wrong.

Why do hackers target WordPress sites?

Most attacks are financially motivated: phishing to steal banking credentials, ransomware to extort a payment for restoring access or not leaking data, or simply hijacking server resources to mine cryptocurrency in the background. Targeted attacks against a specific site owner (rather than opportunistic, automated ones) are much rarer, and usually only happen when the site publishes something the attacker specifically objects to.

WordPress malware removal: finding the infection

Malware is code, and code has to live somewhere — in the file system or in the database. Search methodically rather than guessing.

1. Search for recently modified files

The most reliable way is server access via SSH, then searching for files modified after a known-good date:

find /path/to/your/website/root -type f -newermt 2021-02-01

Review the contents of anything unexpected. Pay particular attention to functions like eval, exec, system, preg_replace, move_uploaded_file, base64, or obfuscated hex-encoded strings that don’t resemble normal code. These functions do appear in legitimate WordPress core and plugin code too, so check what each instance actually does before assuming it’s malicious.

2. Check WordPress core files

Compare the files in the root, wp-includes, and wp-admin directories against a fresh copy of the same WordPress version:

diff -r /path/to/your/website/root /path/to/fresh/wordpress/copy/

WordPress doesn’t modify its own core files on its own, so any unexpected difference is worth investigating directly.

3. Check plugins

Most successful attacks exploit vulnerable plugins. If you can observe the malware’s behaviour (redirects, replaced content), disabling plugins one at a time can help isolate which one is compromised — then compare its code against a clean copy of the same plugin version.

4. Check Google’s information about your site

If the site has been blacklisted, Google typically provides some detail on why through Search Console. This is often the fastest way to narrow down what was compromised.

5. Check the database

Malware in WordPress isn’t limited to files — it shows up in the database too. Download a database dump and search it locally for the same suspicious function patterns, plus unexpected links and spam-related text injected into content or options tables.

How to remove malware from a hacked WordPress site

1. Replace or remove infected files. If you have a clean, verified-uninfected backup, restore it — but confirm the backup itself isn’t compromised first. Otherwise, manually replace infected files with clean WordPress core files, plugins, or themes via FTP or the command line, and remove any new files the malware created.
2. Clean the database. Either edit the database dump directly (careful with MySQL syntax), use a dedicated database search-and-replace tool, or use a GUI client like phpMyAdmin or Adminer to edit tables directly.
3. Investigate how the attack happened. Removing the malware doesn’t fix the vulnerability that let it in — the problem can reoccur within hours otherwise. Check vulnerability disclosures for any plugins you use, and review server access logs around the time of the attack if you can identify roughly when it started.
4. Scan every computer with admin access. Malware can be introduced through a compromised local machine during a legitimate edit, not just through a server-side vulnerability.

How to secure WordPress after a hack (and prevent the next one)

• Keep WordPress, plugins, and themes updated — outdated software is the single most common infection vector; monthly checks are a reasonable minimum
• Reset every password and require the same of all users
• Remove unused user accounts entirely
• Update PHP, MySQL, and the web server to supported, current versions
• Set up a firewall if the server doesn’t already have one
• Lock down file permissions — 644 for files, 755 for directories is standard, and restricting write access to wp-content/plugins and wp-content/themes adds another layer (at the cost of needing manual updates instead of admin-panel updates)
• Disable file editing from the admin panel by adding define( 'DISALLOW_FILE_EDIT', true ); to wp-config.php
• Disable XML-RPC if pingbacks/trackbacks and remote publishing aren’t in use — via a plugin or by blocking access in .htaccess
• Limit login attempts with a plugin to blunt brute-force attacks
• Maintain real backups — confirm retention period with your host, or set up your own via a plugin (UpdraftPlus and similar)
• Never use “admin” as a username — it’s the first username most automated attacks try
• Enable two-factor authentication for all admin accounts
• Monitor file and log changes on an ongoing basis, so a future compromise is caught early rather than discovered weeks later

Should you use a WordPress security plugin?

Popular options like Sucuri, Wordfence, and iThemes Security offer real value, particularly for site owners without deep technical expertise, and have large, active user communities. There’s a genuine debate among developers about whether they’re strictly necessary on a well-secured, properly maintained site — some point to occasional performance overhead or the plugins’ own past vulnerabilities. In practice, they’re a reasonable safety net for most site owners, and closer to essential the less technical oversight the site otherwise gets.

What about a Web Application Firewall (WAF)?

A WAF is the more advanced layer of protection — actively detecting and blocking malicious requests before they reach the site’s code at all, rather than cleaning up after an infection. Some hosts include this in standard packages; third-party options like Cloudflare or Sucuri’s WAF are also common. It typically comes with an ongoing fee, but is worth serious consideration for any business-critical site where downtime or a data breach carries real financial or reputational cost.

FAQ

How long does it take to recover a hacked WordPress site? With a clean, verified backup, recovery can take under an hour. Without one, manually locating and removing malware from files and database can take considerably longer, and often benefits from professional help to make sure nothing is missed.

Will I lose my Google rankings if my site was hacked? A blacklisting or malware infection can affect rankings while it’s active, but recovers once Google re-crawls the cleaned site and confirms it’s safe — requesting a review in Search Console after cleanup speeds this up.

Do I need a security plugin if I already keep everything updated? Updates close known vulnerabilities, but a security plugin adds monitoring, malware scanning, and brute-force protection that updates alone don’t provide — especially useful without dedicated technical oversight.

What’s the very first thing I should do if I think my site is hacked? Change all passwords (WordPress, hosting, FTP/SSH, database) and, if possible, take the site offline or into maintenance mode while you investigate — this limits further damage while you work through cleanup.

---

Prevention is genuinely cheaper than cleanup. Regular updates and a correct initial security setup are the minimum for any WordPress site — and for e-commerce sites specifically, the stakes (stolen customer data, payment information) are much higher than for a simple brochure site. If you’re dealing with a hack right now, or want a proper security review before one happens, get in touch — we’re happy to help.Coders are always happy to help!