4.8/5 - (20 votes)

How to Clean a WordPress Hack – A Step‑by‑Step Guide from Sucuri’s Playbook

WordPress powers roughly 40 % of the web, which makes it a favorite target for attackers. When a site is compromised, the fallout can be painful: loss of traffic, a tarnished brand, and even penalties from search engines. The good news is that most infections can be eradicated without a full rebuild—provided you follow a systematic, evidence‑based process.

Below is an expanded, 1,000‑word walkthrough that combines Sucuri’s years‑long experience with practical, hands‑on tactics. If you follow it from start to finish, you’ll be able to:

Identify where the malicious code lives.
Verify the integrity of WordPress core, plugins, and themes.
Clean the infected files and database entries.
Harden the site to prevent future break‑ins.

Pro tip: Always keep at least one clean backup (ideally two) that predates the compromise. Comparing a clean snapshot with the current state is the fastest way to spot malicious changes.

Methods to Effectively Clean a Hacked WordPress Site

1️⃣ Scan Your Site – Find the Hidden Payloads

Before you start deleting files, gather as much intel as possible. Remote scanners can locate suspicious URLs, hidden iframes, and malicious scripts that are invisible from the WordPress admin dashboard.

Tool	How to Use	What It Shows
Sucuri SiteCheck (free)	1. Visit https://sitecheck.sucuri.net 2. Enter your domain and click Scan Website.	• List of infected URLs • Detected blacklists (Google, Norton, etc.) • Embedded iFrames, scripts, and links
Sucuri WordPress Plugin (free)	Install from the official repository → Activate → Dashboard → Site Scanner.	Live scanning of core files, themes, plugins, and the database.
Google Safe Browsing	https://transparencyreport.google.com/safe-browsing/search → Enter URL.	Whether Google has flagged your site for phishing, malware, or unwanted software.
Bing/Yandex Webmaster	Add the site → Security → Malware.	Additional perspective on blacklisting and detection dates.

What to do with the results

Copy every malicious URL, file path, or suspicious snippet to a temporary text file.
Note any blacklist entries – they will be required when you request removal later.
If the scanner comes up empty, don’t assume you’re clean. Some attackers use stealth techniques that evade remote scanners. Continue with the next steps.

2️⃣ Verify Core File Integrity

WordPress core files are never supposed to change after the initial install (except for intentional patches). If they have been edited, the attacker most likely inserted a backdoor.

2.1 Quick command‑line diff (recommended)

# Navigate to your WordPress root
cd /var/www/example.com

# Download a fresh copy of your exact WP version
wget https://wordpress.org/wordpress-5.9.8.tar.gz
tar -xzf wordpress-5.9.8.tar.gz
cd wordpress-5.9.8

# Compare core directories
diff -qr . ../ | grep -v "wp-config.php\|wp-content"

Any output indicates a mismatch.

If there are differences, replace the altered files with the fresh copies from the extracted folder.
Never overwrite wp-config.php or the entire wp-content directory—these contain your custom settings and uploads.

2.2 Manual SFTP check (for non‑CLI users)

Download the official WordPress zip for your version.
Extract it locally.
Open both the local and remote wp-admin and wp-includes folders side‑by‑side in a file‑manager (e.g., WinSCP).
Spot any files that don’t match in size or timestamp and replace them.

3️⃣ Hunt for Recently Modified Files

Even if the core is clean, plugins, themes, or uploaded files are common infection vectors.

3.1 Identify “new” or “changed” files via the command line

# Find files modified in the last 30 days
find . -type f -mtime -30 -ls

Adjust the -30 to a larger window if you’re unsure when the hack occurred.

3.2 Cross‑reference with your backup

Open a clean backup (if you have one) and compare file lists.
Any file that exists only in the current version or has a newer timestamp is a prime suspect.

3.3 Look for classic malicious PHP patterns

When you open a suspect file in a text editor, search for functions often abused by hackers:

eval(
base64_decode(
gzinflate(
preg_replace(
str_replace(
shell_exec(
system(
exec(

If you see these wrapped in obfuscated code, remove the entire block or replace the file with a clean version.

4️⃣ Examine External Reputation – Google Transparency & Webmaster Tools

A compromised site often gets flagged by search engines. Knowing the exact “date first seen” helps you prove remediation when requesting de‑listing.

Google Safe Browsing – as described in step 1.
Google Search Console (formerly Webmasters Central) – add the site, then go to Security Issues.
Bing/Yandex Webmaster – check the Security or Malware section.

Take screenshots of the warnings; you’ll need them when you submit a removal request.

5️⃣ Clean the Infected Files

Now that you have a list of malicious payloads, it’s time to purge them.

5.1 General workflow

Action	Reason
Backup the entire site (files + DB)	Gives you a rollback point if something goes wrong.
Put the site in maintenance mode (e.g., a simple `maintenance.php`)	Prevents visitors from seeing the infection and stops bots from further exploiting the site while you work.
Delete or replace compromised core files	Restores WordPress to a known good state.
Replace infected plugins/themes with fresh copies from the official repository or the vendor.	Eliminates hidden backdoors that often live inside outdated plugins.
Manually clean custom files (e.g., bespoke theme files)	Removes malicious snippets without losing custom functionality.
Scan again (SiteCheck + Sucuri plugin)	Confirms that all known payloads are gone.

5.2 Detailed steps for files

Log in via SFTP/SSH with a user that has write permissions.
Navigate to the compromised path (e.g., wp-content/uploads/evil.php).
Delete the file (rm evil.php) or replace it with a clean version.
For plugins: wp plugin delete <slug> # removes the compromised plugin wp plugin install <slug> --activate # reinstalls a fresh copy (The wp CLI is optional but speeds up the process.)
For themes: repeat the same pattern (wp theme delete …).
Custom code – open each file in a code editor, strip out any suspicious block, and save.

Safety tip: If a file belongs to a premium theme or plugin and you have a clean copy in your backup, replace the entire folder instead of trying to edit line‑by‑line.

6️⃣ Sanitize the Database

Attackers often inject malicious redirects or spam links directly into the database (e.g., wp_posts, wp_options).

6.1 Backup first

Export the DB via phpMyAdmin, MySQL Workbench, or the command line:

mysqldump -u user -p dbname > db-backup-$(date +%F).sql

6.2 Automated search & replace

Tools like Search‑Replace‑DB or Adminer let you scan for a string and replace it safely.

Look for common payloads you noted in step 1 (e.g., iframe src="http://badsite.com").
Also search for the PHP functions listed earlier (eval, base64_decode, etc.) inside wp_posts.post_content, wp_options.option_value, and wp_usermeta.meta_value.

6.3 Manual inspection (intermediate/advanced)

-- Find rows containing eval()
SELECT * FROM wp_posts WHERE post_content LIKE '%eval(%';

-- Find suspicious URLs
SELECT * FROM wp_options WHERE option_value LIKE '%badsite.com%';

Delete or clean the rows once you confirm they are malicious. Be cautious not to remove legitimate code.

6.4 Remove leftover admin tools

Some attackers upload their own phpMyAdmin, Adminer, or custom “backdoor” scripts to the root directory. Delete any unknown PHP files that were not part of the original WordPress install.

7️⃣ Verify, Request De‑listing, and Harden

7.1 Final verification

Run SiteCheck again – it should return a clean report.
Browse the site as a guest: look for unexpected redirects, broken pages, or odd admin‑only content.
Check the error log (/var/log/apache2/error.log or similar) for lingering PHP warnings that could hint at hidden code.

7.2 Request removal from blacklists

Google: In Search Console → Security Issues → “Request Review”. Provide a concise statement of what you fixed and attach the final scan report.
Other services (Norton SafeWeb, Bing, Yandex): Follow their respective “unblock” procedures, usually a form and a link to the cleaned scan.

7.3 Harden the site (post‑cleanup)

Hardening measure	Why it matters
Update everything (core, plugins, themes)	Reduces exploitable vulnerabilities.
Change all passwords (WP admin, FTP/SSH, DB, hosting panel)	Cuts off credentials the attacker may have stolen.
Enable two‑factor authentication (2FA) for all admin accounts	Stops credential stuffing attacks.
Install a security plugin (Sucuri, Wordfence, iThemes Security) and enable Web Application Firewall (WAF)	Blocks known malicious traffic before it reaches WordPress.
Disable file editing in `wp-config.php` (`define('DISALLOW_FILE_EDIT', true);`)	Prevents attackers from injecting code via the dashboard.
Set proper file permissions (`755` for directories, `644` for files)	Limits what a compromised script can overwrite.
Limit login attempts and use reCAPTCHA	Thwarts brute‑force attacks.
Move the `wp-config.php` file one level up (`../wp-config.php`)	Makes it harder for a malicious script to locate it.
Regularly schedule scans (weekly) and automated backups (daily)	Early detection + quick recovery.

8️⃣ Checklist – “Did I Forget Anything?”

Scan with SiteCheck and Sucuri plugin → saved payload list.
Verified WordPress core integrity (diff or manual compare).
Identified all files modified in the last 30 days.
Checked Google Safe Browsing & Webmaster Tools for blacklist status.
Backed up both files and database before making changes.
Replaced or cleaned all infected core, plugin, theme, and custom files.
Sanitized the database (search‑replace for malicious strings).
Deleted any rogue admin tools (phpMyAdmin, backdoors).
Ran a final scan – clean result.
Submitted removal requests to all blacklists that flagged the site.
Hardened the site (updates, passwords, 2FA, WAF, file permissions).

If you tick every box, congratulations—you’ve successfully cleaned a WordPress hack and significantly lowered the odds of a future compromise.

Final Thoughts

Cleaning a hacked WordPress site can feel overwhelming, but a methodical, evidence‑driven approach turns chaos into a manageable checklist. The most important takeaways:

Know exactly what you’re removing – rely on scanners and backups for accurate payload locations.
Never delete wp-config.php or the entire wp-content folder unless you have a clean copy to restore from.
Backups are your safety net—always create a fresh copy before you touch anything.
Hardening is not optional; it’s the final piece that turns a rescued site into a fortified one.

Follow this guide the next time you spot a warning, and you’ll be back in control faster than you thought possible. Happy (and secure) WordPressing!

Essential Techniques for Cleaning a Hacked WordPress Website and Preventing Future Attacks

AccuRanker: The Rank Tracker for Agencies and SEO Professionals.A Keyword Rank Tracker. AccuRanker is the world’s fastest rank tracker – A must-have tool if you want to grow your organic traffic, and leave your competitors in the dust.

Run Your Entire Online Business from Powerful and Practical All-in-One Software.The only tool you need to launch your online business

$60k in 4 weeks: email marketing made easy