A hacked WordPress website can damage your traffic, search rankings, customer trust, and even sensitive business data.
You may notice suspicious redirects, unknown admin accounts, spam pages, strange pop ups, or security warnings from Google. When this happens, acting quickly is important.
This guide explains how to fix hacked WordPress site, remove the infection, restore your website, and strengthen its security against future attacks.
How Do You Know If Your WordPress Site Is Hacked?
A compromised WordPress website may show several warning signs, including:
- Visitors being redirected to suspicious websites
- Unknown pages appearing in Google
- New administrator accounts you did not create
- Unexpected changes to website content
- Security warnings in Google Search Console
- Sudden drops in organic traffic
- Strange files inside WordPress folders
- Customers reporting unusual pop-ups
- Being locked out of WordPress admin
Google Search Console’s Security Issues report can identify some forms of hacked content, malware, and deceptive pages.
How to Fix Hacked WordPress Site
1. Temporarily Restrict Website Access
If the website is actively redirecting users, serving malware, or displaying harmful content, temporarily place it in maintenance mode or restrict public access.
This can help protect visitors while you investigate the infection.
Contact your hosting provider as well, especially if the website is hosted on a shared server.
2. Create a Complete Backup
Before deleting or changing anything, create a full backup of the current website.
Include:
- Website files
- WordPress database
wp-config.php- Themes
- Plugins
- Uploads
Even though the backup may contain infected files, it provides a recovery point if something important is accidentally removed.
Store the backup separately from the live hosting account.
3. Scan the Website for Malware
Use a reputable WordPress security or malware scanning solution to identify suspicious files, modified WordPress core files, unauthorized users, and malicious code.
You should also check:
- Google Search Console
- Hosting security scans
- Recently modified files
- Server logs where available
Do not immediately delete every file a scanner flags. False positives can occur, so suspicious files should be reviewed carefully.
4. Restore or Replace Infected Files
If you have a recent clean backup, restoring it can often be the safest recovery option.
Otherwise, reinstall clean copies of:
- WordPress core
- Plugins
- Themes
Download replacements only from WordPress.org or verified developers.
Do not reuse unknown, pirated, or “nulled” themes and plugins.
WordPress recommends keeping WordPress core, themes, and plugins updated and using actively maintained software.
5. Check Your WordPress Database
Hackers may inject spam links, scripts, redirects, or unauthorized users directly into the database.
Review important areas such as:
- Posts and pages
- WordPress options
- Administrator accounts
- Suspicious URLs
- Unknown scripts
Always create a database backup before editing anything.
If you are not comfortable working with databases, use an experienced WordPress developer instead of making uncertain changes.
6. Remove Unknown Users and Change Passwords
Check Users > All Users and remove administrator accounts that your team does not recognize.
Then change credentials for:
- WordPress administrators
- Hosting account
- SFTP/SSH accounts
- Database users
- Connected services
- Important API keys
Use unique passwords rather than reusing credentials from other accounts.
WordPress also recommends enabling two-factor authentication for administrator accounts and using rate limiting or firewall protection against brute-force login attempts.
7. Update WordPress, Plugins and Themes
Outdated software can leave known security vulnerabilities exposed.
After cleaning the website:
- Update WordPress core
- Update all plugins
- Update your active theme
- Delete unused plugins
- Delete unused themes
- Remove abandoned software
Never keep unnecessary plugins installed simply because they are inactive.
8. Test the Website Before Going Live
Before removing maintenance mode, test important website functionality.
Check:
- Homepage
- Service pages
- Blog posts
- Contact forms
- Login
- Mobile layout
- Navigation
- WooCommerce cart and checkout, if applicable
Run another security scan after cleanup.
Once everything is working correctly, create a new clean backup.
9. Check Google Search Console
If Google detected malware or hacked content, fixing the website alone may not immediately remove security warnings.
Open the Security Issues section in Google Search Console and confirm that all malicious content has been removed.
You can then request a security review. Google recommends requesting a review only after the site has been cleaned and the underlying security problem has been resolved.
How to Prevent Your WordPress Site From Being Hacked Again
Recovery is only half the job. You also need to remove the vulnerability that allowed the attack.
Follow these WordPress security practices:
- Keep WordPress updated
- Update plugins and themes regularly
- Remove unused software
- Use strong unique passwords
- Enable 2FA for administrators
- Take regular off-site backups
- Use HTTPS
- Use trusted plugins and themes
- Monitor suspicious login activity
- Consider a web application firewall
- Regularly scan for malware
WordPress’s official hardening guidance emphasizes updates, secure credentials, backups, appropriate file access, trusted software, and limiting unnecessary attack surfaces.
Final Thoughts
Learning how to fix a hacked WordPress site starts with containing the problem, backing up the website, identifying the infection, restoring clean files, changing compromised credentials, and securing the original entry point.
A rushed cleanup may remove visible malware while leaving a hidden backdoor behind.
If your website handles customer information, payments, leads, or important business data, professional cleanup can reduce the risk of accidentally deleting important files or leaving the infection unresolved.
At TechFlick LLC, we provide WordPress development, website maintenance, technical troubleshooting, and security-focused website support to help businesses keep their websites stable, updated, and protected.
Frequently Asked Questions
Can a hacked WordPress site be recovered?
Yes. Many compromised WordPress websites can be recovered by removing malicious files, restoring clean backups, reinstalling trusted software, resetting credentials, and fixing the vulnerability responsible for the attack.
Should I restore a backup after my WordPress site is hacked?
A clean backup from before the infection can be one of the safest recovery options. However, you should still identify and fix the original security vulnerability before putting the restored website back online.
Why does a WordPress website get hacked?
Common risks include outdated plugins or themes, weak credentials, compromised administrator accounts, unsafe third party software, poor server security, and unpatched vulnerabilities.
Will changing my WordPress password remove malware?
No. Changing passwords helps prevent continued unauthorized access, but malicious files, database injections, or hidden backdoors must also be identified and removed.
How can I secure WordPress after removing malware?
Update all software, remove unnecessary plugins, reset credentials, enable two-factor authentication, maintain off-site backups, monitor security activity, and use trusted security protections.
