# WordPress hack cleanup: the recovery process I follow > Contain, remove malware, harden, and verify a compromised WordPress site - a practical post-hack checklist before you call it clean. Source: https://larsik.com/blog/wordpress-security-cleanup-after-hack/ Security # WordPress hack cleanup: the recovery process I follow Contain, remove malware, harden, and verify a compromised WordPress site - a practical post-hack checklist before you call it clean. July 6, 2026· Updated August 4, 2026· 4 min read·[Lars Koudal](/about/) - WordPress - Security - Malware ![WP Security Ninja malware scanner and firewall dashboard](/images/products/wp-security-ninja.webp) When a WordPress site gets hacked, panic is normal. The host suspends your account, Google shows a warning, or customers report spam pages you never created. I have cleaned up more hacked sites than I can count - and I build [WP Security Ninja](https://wpsecurityninja.com/) because the same boring failures keep repeating. Here is what I do first, in order, when you call me in. ## 1\. Contain - stop the bleeding Before cleanup, limit further damage: - **Take the site offline** or put it in maintenance mode if spam is actively serving - **Change all passwords**: hosting, FTP/SFTP, database, WordPress admins, email - **Revoke suspicious admin users** and API keys you do not recognize - **Snapshot backups** - even infected ones - for forensics. Do not restore a bad backup over a partial fix by mistake - **Rotate salts/keys** in `wp-config.php` after you regain control (forces fresh logins) If the host already suspended the account, work through their support channel but do not assume they cleaned the files. Suspension is not remediation. ## 2\. Assess scope I look at: - **Core WordPress files** compared to clean checksums - **wp-content/uploads** for PHP or disguised executables - **Recently modified theme/plugin files** - **Database** for injected scripts in posts, widgets, options tables - **Server logs** for upload or eval patterns - **Scheduled tasks** (WP-Cron and server cron) for persistence The goal is to answer: is this a **file infection**, **database injection**, **stolen credentials**, or **all of the above**? For a deeper mindset on prevention, see [what I check first when a site gets hacked](/blog/what-i-check-first-when-a-site-gets-hacked/) and [how I approach WordPress security](/blog/wp-security-ninja-wordpress-security/). ## 3\. Remove malware thoroughly Quick fixes fail. I remove: - Known malicious files and **backdoors** (often disguised as legitimate plugin files) - Rogue **cron jobs** and unexpected mu-plugins - Injected scripts in the database - Spam SEO pages, redirects, and poisoned `.htaccess` rules Scanning alone is not enough - scanners miss obfuscated PHP. Manual review of recently changed files and suspicious `eval`/`base64` patterns still matters in 2026. ## 4\. Harden before you go live again Cleanup without hardening invites a repeat visit from the same bot: - **Firewall** and login protection (I use WP Security Ninja on many sites - it is my product and I trust it on real workloads) - **Disable file editing** in wp-admin where appropriate - **2FA** for administrator accounts - **Least-privilege** admin users - not everyone needs `install_plugins` - **Update** vulnerable plugins and themes that likely caused entry - **Remove unused themes/plugins** and old staging copies on public URLs This is the same stack I describe in [Security & Cleanup](/services/security-cleanup/) engagements. ## 5\. Verify recovery Before you announce “we are back”: - Re-scan files and database - Check **Google Safe Browsing** and Search Console security issues - Spot-check indexed spam URLs (`site:yoursite.com` odd paths) - Test forms, checkout, and email delivery - Confirm `wp-config.php`, `.htaccess`, and `index.php` match expected content - Monitor logs for 48-72 hours ### Post-cleanup verification checklist - No unknown admin users or roles - No unexpected mu-plugins or drop-ins - Uploads directory does not execute PHP - Core checksums clean (or differences explained) - Search Console security issues addressed / review requested - Entry path fixed (patch, password, firewall, or removed staging) Google warnings do not clear instantly. Request review when you are confident the site is clean, not when you hope it is. ## 6\. Figure out how they got in Clients want to skip this step. Do not. Usually it is: - **Outdated plugin or theme** - **Weak or reused password** - **No firewall** on wp-login - **Old staging copy** left publicly accessible - **Compromised agency or freelancer credentials** Without fixing the entry path, you are paying for cleanup twice. ## What you should prepare before contacting me - Hosting and **WordPress admin** access (or SFTP + database) - When you first noticed the issue - Any messages from Google, your host, or customers - Whether you have a **backup from before the hack** Urgent cleanups get prioritized. I will give you a realistic timeline - same-day triage is often possible; full cleanup depends on depth. **Related services:** [Security & Cleanup](/services/security-cleanup/) · [Website maintenance](/maintenance/) to reduce repeat risk. Site compromised or showing Google warnings? [Contact me](/contact/) - tell me what you are seeing and we will take it from there. ## Frequently asked questions Is a malware scan enough after a WordPress hack?+ No. Scanners miss obfuscated backdoors. Combine automated scans with manual review of changed files, database options, users, cron, and how attackers got in. Should I restore a backup immediately?+ Only if you are sure the backup is from before the intrusion and you still rotate credentials and harden afterward. Restoring an infected or outdated backup can reinfect or reopen the same hole. How long until Google warnings clear?+ Not instantly. Clean and harden first, then request a review in Search Console / Safe Browsing when you are confident - not when you hope. Where is the process and pricing orientation?+ See https://larsik.com/wordpress-hack-cleanup/ for the full recovery sequence, what drives cost, and how WP Security Ninja relates to a hands-on cleanup engagement.