Security
WordPress hack cleanup: the recovery process I follow
Contain, remove malware, harden, and verify a compromised WordPress site - a practical post-hack checklist before you call it clean.
- WordPress
- Security
- Malware
When a WordPress site gets hacked, panic is normal. The host suspends your account, Google shows a warning, or customers report spam pages you never created.
I have cleaned up more hacked sites than I can count - and I build WP Security Ninja because the same boring failures keep repeating. Here is what I do first, in order, when you call me in.
1. Contain - stop the bleeding
Before cleanup, limit further damage:
- Take the site offline or put it in maintenance mode if spam is actively serving
- Change all passwords: hosting, FTP/SFTP, database, WordPress admins, email
- Revoke suspicious admin users and API keys you do not recognize
- Snapshot backups - even infected ones - for forensics. Do not restore a bad backup over a partial fix by mistake
- Rotate salts/keys in
wp-config.phpafter you regain control (forces fresh logins)
If the host already suspended the account, work through their support channel but do not assume they cleaned the files. Suspension is not remediation.
2. Assess scope
I look at:
- Core WordPress files compared to clean checksums
- wp-content/uploads for PHP or disguised executables
- Recently modified theme/plugin files
- Database for injected scripts in posts, widgets, options tables
- Server logs for upload or eval patterns
- Scheduled tasks (WP-Cron and server cron) for persistence
The goal is to answer: is this a file infection, database injection, stolen credentials, or all of the above?
For a deeper mindset on prevention, see what I check first when a site gets hacked and how I approach WordPress security.
3. Remove malware thoroughly
Quick fixes fail. I remove:
- Known malicious files and backdoors (often disguised as legitimate plugin files)
- Rogue cron jobs and unexpected mu-plugins
- Injected scripts in the database
- Spam SEO pages, redirects, and poisoned
.htaccessrules
Scanning alone is not enough - scanners miss obfuscated PHP. Manual review of recently changed files and suspicious eval/base64 patterns still matters in 2026.
4. Harden before you go live again
Cleanup without hardening invites a repeat visit from the same bot:
- Firewall and login protection (I use WP Security Ninja on many sites - it is my product and I trust it on real workloads)
- Disable file editing in wp-admin where appropriate
- 2FA for administrator accounts
- Least-privilege admin users - not everyone needs
install_plugins - Update vulnerable plugins and themes that likely caused entry
- Remove unused themes/plugins and old staging copies on public URLs
This is the same stack I describe in Security & Cleanup engagements.
5. Verify recovery
Before you announce “we are back”:
- Re-scan files and database
- Check Google Safe Browsing and Search Console security issues
- Spot-check indexed spam URLs (
site:yoursite.comodd paths) - Test forms, checkout, and email delivery
- Confirm
wp-config.php,.htaccess, andindex.phpmatch expected content - Monitor logs for 48-72 hours
Post-cleanup verification checklist
- No unknown admin users or roles
- No unexpected mu-plugins or drop-ins
- Uploads directory does not execute PHP
- Core checksums clean (or differences explained)
- Search Console security issues addressed / review requested
- Entry path fixed (patch, password, firewall, or removed staging)
Google warnings do not clear instantly. Request review when you are confident the site is clean, not when you hope it is.
6. Figure out how they got in
Clients want to skip this step. Do not.
Usually it is:
- Outdated plugin or theme
- Weak or reused password
- No firewall on wp-login
- Old staging copy left publicly accessible
- Compromised agency or freelancer credentials
Without fixing the entry path, you are paying for cleanup twice.
What you should prepare before contacting me
- Hosting and WordPress admin access (or SFTP + database)
- When you first noticed the issue
- Any messages from Google, your host, or customers
- Whether you have a backup from before the hack
Urgent cleanups get prioritized. I will give you a realistic timeline - same-day triage is often possible; full cleanup depends on depth.
Related services: Security & Cleanup · Website maintenance to reduce repeat risk.
Site compromised or showing Google warnings? Contact me - tell me what you are seeing and we will take it from there.
Frequently asked questions
Is a malware scan enough after a WordPress hack?
No. Scanners miss obfuscated backdoors. Combine automated scans with manual review of changed files, database options, users, cron, and how attackers got in.
Should I restore a backup immediately?
Only if you are sure the backup is from before the intrusion and you still rotate credentials and harden afterward. Restoring an infected or outdated backup can reinfect or reopen the same hole.
How long until Google warnings clear?
Not instantly. Clean and harden first, then request a review in Search Console / Safe Browsing when you are confident - not when you hope.
Where is the process and pricing orientation?
See https://larsik.com/wordpress-hack-cleanup/ for the full recovery sequence, what drives cost, and how WP Security Ninja relates to a hands-on cleanup engagement.