Last Update July 22, 2026

To remove malware from a hacked WordPress site: put the site in maintenance mode, change every password, and back up the infected files first. Then scan the site, replace WordPress core files, remove infected plugins and themes, clean the database and .htaccess, delete unknown admin users, and find the entry point so it cannot happen again. With a clean recent backup, recovery often takes under an hour.

We handle malware cleanups for website owners, and the first thing worth saying is the thing people most need to hear when it happens, stay calm, and do not start deleting things at random.

A hacked site feels like an emergency, and panic leads to the two mistakes that make it worse, deleting evidence before you understand the infection, and cleaning the malware without closing the door the attacker came through, which just invites them back. This guide walks through it the right way, in order, whether you clean it yourself or hand it off.

How common are WordPress hacks, really?

WordPress hacks are extremely common and getting faster, which is the uncomfortable context every site owner should know. According to Patchstack’s State of WordPress Security in 2026 whitepaper, 11,334 new WordPress vulnerabilities were recorded in 2025, a 42% increase year over year, and roughly 13,000 WordPress sites are hacked per day. The median time from a vulnerability being disclosed to mass exploitation is about 5 hours.

Two facts from that data matter most for prevention.

First, the risk is almost entirely in plugins: 91% of vulnerabilities were in plugins, while WordPress core had only 6 all year. WordPress core itself is secure; the extension layer is where sites get breached.

Second, 43% of these vulnerabilities can be exploited with no login required, which means automated bots compromise legitimate-looking sites at scale without ever needing a password.

This is not meant to scare you off WordPress, which powers about 42% of the web as of 2026. It is to make one point: getting hacked is common, it is usually not your fault personally, and the vast majority of sites are fully recoverable.

How do I know if my WordPress site is hacked?

Most modern hacks hide on purpose, so a site can be infected while its homepage looks completely normal to you. Attackers make money quietly, through spam, redirects, and hidden scripts, so an obvious defaced homepage is now the exception, not the rule.

Watch for these common signs of a hacked WordPress site:

  • Visitors get redirected to spam, gambling, or adult sites (often while you see nothing wrong)
  • Google Search Console shows a “This site may be hacked” warning, or browsers show a red danger screen
  • New admin users you did not create appear in your dashboard
  • Strange .php files show up in wp-content/uploads or other folders
  • Injected spam content or links appear on pages, sometimes only to search engines
  • Your site suddenly slows down, or your host suspends it

A nasty detail from 2025 threat data: many infections use cloaking, showing clean content to you and the search engine while redirecting real visitors to scams. This is why the first sign is often a customer complaint or a drop in search rankings, not something you notice yourself. If you suspect anything, run a free external scanner like Sucuri SiteCheck or VirusTotal for a quick second opinion.

Step 1: Contain the damage before you clean

Before removing anything, contain the site and preserve evidence. Skipping this is how people lose data or miss the real infection.

Do these first, in order. Put the site into maintenance mode or ask your host to temporarily suspend it, so visitors are not exposed to the malware and your SEO takes less damage. Change every password: WordPress admin, hosting control panel, FTP/SFTP, database, and any email tied to password resets. Then, and this surprises people, back up the infected site anyway.

You need a copy of the compromised files to investigate the infection and identify the entry point. Do not delete anything yet; assess first. A hacked site should still be backed up before you start cleaning.

Step 2: The fastest fix, restore a clean backup

If you have a clean, recent backup from before the infection, restoring it is by far the fastest recovery. This is the single biggest factor in how quickly you get back online. Sites with a good backup are usually clean again within an hour. Sites without one can face 24 to 72 hours of manual, file-by-file cleaning.

The catch is knowing the backup is from before the hack. If malware sat quietly for weeks, a recent backup may already be infected. Check your backup dates against when the signs first appeared, and pick the last known-clean snapshot. After restoring, you still must find and fix the entry point (Step 5), or the same hole gets exploited again. If you have no clean backup, continue with manual cleanup below.

Step 3: Scan and locate the malware

With the site contained, identify what and where the infection is. Start with a scan, then verify manually, because scanners catch most but not all modern malware.

Run a security plugin such as Wordfence, Sucuri, or MalCare to scan files and compare your core files against the originals. Then check the places malware most commonly hides: the .htaccess file, wp-config.php, and index.php for injected code; the wp-content/uploads folder for rogue .php files that should never live there; and your theme’s functions.php.

In the source code, injected malware often appears as suspicious script or iframe tags pointing to unknown domains, or as PHP that uses eval() with base64-encoded strings to hide a payload. Note what you find before removing it, so you understand the full scope.

Step 4: Clean the infected files and database

Now remove the malware, working methodically rather than guessing. The reliable approach for a corrupted install is to replace, not just edit.

Replace WordPress core files with a fresh download from WordPress.org, keeping only your original wp-config.php and wp-content folder, which removes any core-file injections cleanly. Reinstall clean copies of your themes and plugins from official sources, and delete any you do not recognize or use.

In the database, search for and remove injected code and any suspicious admin users, and always back up the database three times before editing it. Finally, clean the .htaccess file of injected redirects by replacing it with a default version and re-saving your permalinks. Work through this in order; skipping ahead is exactly how reinfections happen.

Step 5: Find the entry point (the step everyone skips)

Cleaning the malware without closing the entry point is the number one cause of reinfection, and it is the step most DIY guides rush past. If you remove the symptoms but leave the hole open, the attacker simply returns, often within days, using a backdoor they planted for exactly that purpose.

Attackers in 2025 increasingly invest in persistent access, planting hidden backdoors and uploader scripts that survive a basic cleanup and let them re-enter later. So finding the cause is not optional. Look at what let them in: an outdated or vulnerable plugin or theme (by far the most common cause), a nulled or pirated “premium” plugin downloaded from an unofficial source, weak passwords, or an outdated PHP version.

Check your logs for the timing of the first infected file and cross-reference it with plugin update dates. Until you identify and close the entry point, the site is not truly clean.

Step 6: Recover and restore trust

Once the site is clean and the hole is closed, restore your standing with Google and your visitors. Update everything, WordPress core, all themes, and all plugins, to their latest versions. Reset all passwords again now that the site is clean, and review user accounts one more time. If Google flagged your site, request a review in Google Search Console to remove the “this site may be hacked” warning, which otherwise keeps scaring visitors away. Then monitor closely for two to four weeks, because reinfection, if the entry point was missed, usually shows up fast.

How to stop it from happening again

Prevention is dramatically cheaper than recovery, in both money and time. A 2025 survey found that 59% of WordPress professionals say the biggest impact of a hack is lost time, not money: the late nights, the emergency calls, the stress of rebuilding something that worked fine yesterday.

The prevention checklist is short and effective. Keep WordPress core, themes, and plugins updated, since outdated plugins cause the overwhelming majority of hacks, and enable auto-updates given the 5-hour exploitation window. Never use nulled or pirated plugins and themes, which are a leading malware source.

Remove any plugin you do not actively use, because every plugin is an attack surface. Use strong, unique passwords with two-factor authentication on admin accounts. Install a reputable security plugin with a firewall. Choose quality hosting, since cheap shared hosting raises risk. And keep automated daily backups, because a clean backup turns the next incident from a crisis into a one-hour restore.

Should you clean it yourself or hire a professional?

For a simple infection with a clean backup, many owners can recover on their own using the steps above. For anything more, professional help is the safer call, and it is worth being honest about when.

Consider hiring a professional if there is no clean backup. If the malware returns after you clean it (a sign of a missed backdoor), if the infection is deep in the database or core files, or if the site is a business that is losing revenue and trust every hour it is compromised.

Modern malware that embeds in legitimate files and reinfects through hidden backdoors is genuinely hard to fully remove by hand, and a botched cleanup can cost more than doing it right the first time. There is no shame in handing off an emergency; the goal is a site that is clean and stays clean.

Conclusion

WordPress malware removal is stressful but usually recoverable, and doing it in order is what separates a one-hour fix from a three-day ordeal. Contain first (maintenance mode, change passwords, back up the infected files), then restore a clean backup if you have one, or scan, replace core files, clean the database and .htaccess, and remove rogue users if you do not.

The step nobody should skip is finding the entry point, because cleaning malware without closing the hole just invites reinfection. With hacks hitting 13,000 sites a day and exploits landing within hours, prevention (updates, no nulled plugins, strong passwords, security plugin, quality hosting, and daily backups) is far cheaper than recovery. And when it is beyond a quick fix, hiring a professional is the smart move, not a failure.

Frequently Asked Questions

How do I know if my WordPress site has malware?

Common signs include visitors being redirected to spam sites, a “this site may be hacked” warning in Google, new admin users you did not create, strange .php files in your uploads folder, and injected spam content. Many hacks hide from the owner, so run a free external scanner like Sucuri SiteCheck to confirm.

Can I remove WordPress malware myself?

Often yes, especially with a clean recent backup, which lets you restore in under an hour. Manual cleanup is also possible by replacing core files, cleaning the database, and removing rogue code. But advanced infections with hidden backdoors are hard to fully remove by hand and are worth handing to a professional.

How long does it take to clean a hacked WordPress site?

With a clean backup, usually under an hour. Without one, manual cleanup typically takes 24 to 72 hours depending on how deep the infection goes. Finding and closing the entry point adds time but is essential, because skipping it leads to reinfection.

Will I lose my content if my WordPress site is hacked?

Not necessarily. Your content lives in the database and is often recoverable, especially with a backup. However, some infections corrupt files or content, which is why you back up the infected site before cleaning and restore from a known-clean snapshot when possible.

Why does my WordPress site keep getting reinfected?

Reinfection almost always means the original entry point was never closed. Attackers plant hidden backdoors that survive a basic cleanup and let them return. If malware comes back after you clean it, a backdoor or a vulnerable plugin is still present, and the site needs a deeper, professional-level cleanup.

How do I prevent my WordPress site from being hacked again?

Keep core, themes, and plugins updated with auto-updates on, never use nulled plugins, remove unused plugins, use strong passwords with two-factor authentication, install a security plugin with a firewall, choose quality hosting, and keep automated daily backups. Since 91% of vulnerabilities are in plugins, disciplined plugin management matters most.

Site hacked right now? We can clean it and keep it clean.

A hacked site is stressful, and every hour it stays infected costs you visitors, trust, and rankings. You do not have to handle it alone. Survyc removes WordPress malware, closes the entry point so it does not come back, and keeps sites protected with ongoing maintenance and monitoring. Reach out to Survyc and tell us your site is hacked, and we will get it clean and locked down.