How to Fix a Hacked WordPress Site (Before It Comes Back)

Most hacked WordPress sites get “cleaned” twice. The first cleanup removes what the scanner can see; the malware returns within days through a backdoor the scanner missed. It isn’t rare, and it isn’t bad luck. In its 2023 analysis of compromised sites, Sucuri found that 49.21% carried at least one backdoor at the point of remediation (Sucuri, 2023 Hacked Website Report). Miss that door and you clean the same site next week.

The pressure is real, too. Across 2024, Wordfence blocked more than 54 billion malicious requests and 55 billion password attacks against WordPress sites (Wordfence, 2024 Annual WordPress Security Report). This is the recovery sequence I run every week, and it’s built around one idea: find the way in, not just the mess it left behind.

Why do most hacked WordPress cleanups fail?

Because the cleanup deletes the visible malware but leaves the backdoor that invited it in. In its 2023 report, Sucuri found a backdoor on 49.21% of the compromised sites it remediated (Sucuri, 2023 Hacked Website Report). A backdoor is a small, innocuous-looking file or database entry that quietly re-downloads the payload after you think you’re finished.

That’s the reinfection engine. A single scheduled task, a stray line in a legitimate file, one rogue admin account, any of them rebuilds the infection overnight. So the goal of a real cleanup isn’t a clean scan. It’s proving there’s no way back in.

Step 0: Should you delete the infected files first?

No. The infected files are also your only forensic evidence. Before you touch anything, snapshot the whole site, files and database together, so you can trace the entry point later. Cleanups that skip this step are the ones that repeat, because you’ve thrown away the map to the door.

Step 1: How do you contain a hacked WordPress site?

Contain first, investigate second: rotate every credential and lock out whoever is already inside. Attackers routinely add their own administrator so they keep access straight through your cleanup. Move fast, but keep the evidence intact.

• Change every credential: WordPress admins, database, SFTP, and the hosting panel.
• Check wp_users for admin accounts you didn’t create, and remove them.
• If Google is already flagging the site, put up a maintenance page that keeps your phone number visible. Don’t go fully dark; customers still need to reach you.

Step 2: Where does WordPress malware actually hide?

Everywhere the scanner isn’t looking. Signature scanners catch known payloads; the persistent stuff lives in the gaps between them. In my recovery work, the same four hiding places account for nearly every reinfection.

• Fake plugin folders with plausible names (wp-cache-tools, seo-optimizer-pro) holding a single loader file.
• The database: base64 payloads in wp_options, injected scripts inside post content.
• Cron jobs: wp_get_schedules() and server crontabs re-downloading the payload nightly, the classic reinfection engine.
• Legitimate files: one appended line in wp-config.php or the theme’s functions.php.

A fast first pass: grep the codebase for the usual obfuscation tells, base64_decode, eval(, gzinflate, str_rot13, then list every file changed in the last 30 days. That recently-modified list almost always surfaces something the scanner rated as clean.

Step 3: How do you find the entry point?

Cross-reference file modification times with your access logs, and the door usually reveals itself. The odds favor a plugin: in 2025, 91% of the 11,334 new WordPress vulnerabilities disclosed were in plugins, against 9% in themes and just 6 in core (Patchstack, State of WordPress Security in 2026).

Outdated software is the other half of the story: in 2023, Sucuri found 39.1% of hacked sites were running an out-of-date CMS at the point of infection (Sucuri, 2023 Hacked Website Report). In practice the entry point is almost always one of four things, an abandoned plugin with a public CVE, a nulled theme, credentials reused from a breached service, or hosting stuck on an old PHP version. Skip this step and you’ve done a cosmetic cleanup, not a recovery.

Step 4: How do you rebuild trust and stop reinfection?

Rebuild from known-clean sources, then close the door for good. Never trust existing files after an infection, even the ones that look untouched. This is also where you win Google back.

• Reinstall WordPress core, themes, and plugins from official sources; don’t patch the infected copies.
• Request a review in Google Search Console; Safe Browsing warnings usually clear within a few days of approval (Google Search Central, malware and hacked sites).
• Harden what let them in: a WAF, 2FA on every admin, file-integrity monitoring, staged updates, and off-site backups you’ve actually test-restored.

One more reason to harden aggressively: plugin flaws made up 96% of the threats Wordfence tracked in 2024 (Wordfence, 2024 Annual WordPress Security Report). If a plugin got you hacked once, an unmaintained plugin will do it again.

When should you hire someone?

Call in help the moment the infection has returned even once, or if the site takes payments or handles client or patient data. Repeat infections mean a live backdoor you haven’t found, and each recurrence costs more trust with Google. My malware removal service is fixed-price with same-day triage, and it includes the post-mortem that explains exactly how it happened, so it doesn’t happen twice. If you’d rather never get to this point, ongoing WordPress maintenance is the cheaper insurance.

Sources

• Sucuri, 2023 Hacked Website & Malware Threat Report, retrieved 2026-07-18.
• Patchstack, State of WordPress Security in 2026, retrieved 2026-07-18.
• Wordfence, 2024 Annual WordPress Security Report, retrieved 2026-07-18.
• Google Search Central, Malware and hacked sites, retrieved 2026-07-18.

Frequently asked questions