View Plans
Help

WordPress site hacked? How to clean and secure it

If your WordPress site is hacked, act in this order: download a copy of the files and database, change every password, then restore a clean backup or reinstall WordPress, plugins and themes from official sources. Scan for leftover malware, update everything, and ask Google for a review if it flagged the site.

Updated · HostUpIndia team

Signs your WordPress site was hacked

Most hacks are built to stay hidden from the site owner. Logged-in admins often see a normal site while visitors do not. Look for any of these.

  • Visitors are sent to spam, gambling or fake shop sites, often only when they arrive from Google or on a phone.
  • Admin users you did not create appear under Users.
  • Google shows “This site may be hacked” under your result, or Chrome shows a red warning page before your site.
  • Google lists pages you never made, often in another language.
  • Your host warns you about malware, spam sent from your account, or unusual load.

Save a copy of the hacked site first

Change nothing yet. A copy of the site as it is now can show how the attacker got in, and gives you a way back if a cleanup step breaks something.

  • In cPanel, open Backup and download a home directory backup.
  • On the same page, download a backup of each MySQL database.
  • Label the copies as infected and keep them apart from clean backups. Never restore them.
  • Note the date the problems began. You need it to choose a clean backup.

Change every password and the salts

Assume the attacker knows every password tied to the site. Use a computer you trust, and make each password long and unique. A password manager helps.

  • Change the password for your hosting client area. Its address is in your welcome email.
  • Change your cPanel password, in cPanel › Password & Security or in your client area.
  • In WordPress, open Users and set a new password for every administrator.
  • Delete every administrator you did not create. When WordPress asks, give their content to your own account.
  • In cPanel › Manage My Databases (MySQL Databases in older cPanel), set a new password for the database user. Leave out ' and \, which can break wp-config.php.
  • Put the new database password in DB_PASSWORD in wp-config.php straight away, or the site cannot connect to its database.
  • In cPanel › FTP Accounts, change the password of every account you use and delete the rest. Delete the account only, not its files.
  • If your cPanel has SSH Access, open Manage SSH Keys and delete any key you do not recognize.
  • Open Cron Jobs and delete any job you did not set up.
  • Open Manage API Tokens and revoke any token you do not recognize.
  • Get new keys from https://api.wordpress.org/secret-key/1.1/salt/ and replace the eight lines from AUTH_KEY to NONCE_SALT in wp-config.php. Everyone is logged out, the attacker too. See wp-config.php explained.
  • Change the password of the site’s admin email address too. Password reset links go there.

Restore a backup from before the hack

The surest fix is a backup made before the hack began. No clean backup? Clean the files by hand, as in the next section.

  • Pick a backup from before the first sign of the hack. Attacks often start days before anyone notices.
  • Restore the files and the database from that same date, with your host’s backup tool in cPanel or the client area. Changes made since are lost.
  • The restore brings back the old wp-config.php. Put in the new database password and fresh salts again.
  • The restored database holds the old WordPress passwords. Set new ones for every administrator again.
  • Update WordPress, every plugin and every theme at once. The hole the attacker used is still in the old versions.

Remove WordPress malware by hand

Replace every file you can get from an official source, then remove what is left. Work in cPanel File Manager or over SFTP or FTP.

  • Download the latest WordPress from wordpress.org and unzip it on your computer.
  • Delete the wp-admin and wp-includes folders on your site and upload the fresh ones.
  • Replace the files in the WordPress folder, such as index.php and wp-login.php, with the fresh ones. Keep wp-config.php and wp-content.
  • Check the WordPress folder for other .php files that are not in the fresh download. Keep wp-config.php and files a security plugin added, such as wordfence-waf.php, and delete any others you did not add.
  • Note the plugins you use, from the folders in wp-content/plugins.
  • Delete each plugin folder, then install a fresh copy from wordpress.org or the plugin’s developer.
  • Do the same for each theme in wp-content/themes. A child theme or custom theme has no official copy, so check its files by hand.
  • If wp-content/mu-plugins exists, check each file in it. Attackers often hide code there.
  • Delete pirated or “nulled” plugins and themes for good. They often carry malware.
  • Delete every .php file in wp-content/uploads. That folder holds media, and PHP files there are almost always malware.
  • Open .htaccess and remove rules you did not add, such as redirects to other sites. Keep blocks marked as added by cPanel or by a cache or security plugin. The standard WordPress rules sit between # BEGIN WordPress and # END WordPress.
  • Open wp-config.php and remove code you did not add, such as eval(, base64_decode( or long strings of random text outside the eight key lines from AUTH_KEY to NONCE_SALT.

Scan, update and request a Google review

Scan for anything the cleanup missed, then close the hole the attacker used. A security plugin such as Wordfence or Sucuri Security can compare your files with the official copies and flag known malware.

  • Install a security plugin and run a full scan.
  • Fix or delete every file it flags, then scan again until it finds nothing.
  • Update WordPress, every plugin and every theme.
  • Delete plugins and themes you do not use. Keep one default theme as a fallback.
  • Turn on two-factor login for every administrator. Many security plugins include it.
  • Change the administrator and database passwords once more, and update DB_PASSWORD to match. A backdoor could have read them before the cleanup.
  • If Google flagged the site, open Search Console › Security & Manual Actions › Security issues. Add and verify the site first if it is not there.
  • Tick “I have fixed these issues” and select Request Review.
  • Describe what you fixed, then submit the request. A review can take from a few days to a few weeks.

HostUpIndia WordPress hosting

HostUpIndia WordPress plans come with WordPress pre-installed on LiteSpeed, NVMe storage, cPanel and free SSL. Daily backups are kept 30 days, so you can restore a copy from up to 30 days back.

  • From ₹149 a month on 3-year billing. Prices exclude 18% GST. See WordPress plans.
  • Support tickets and email are received 24 hours a day, 7 days a week; WhatsApp is open for questions from 10 am to 7 pm IST, Monday to Saturday.
  • Free website migration by the HostUpIndia in-house team.
  • Seeing “There has been a critical error” after the cleanup? Fix the critical error.
  • More help guides.