If a WordPress site has been compromised, the goal isn’t just to “get it back online”. You need to understand how the attacker got in, remove what was changed and close the vulnerability that made the attack possible.
An incomplete cleanup can leave behind backdoors, hidden users or malicious code that reactivates the infection a few days later.
1. Isolate the site and keep a copy of the compromised state
If the site is distributing malware, spam or redirects, consider maintenance mode or temporarily restricting access. Before deleting files at random, save a copy of files and database: it can help you understand what happened and compare the changes.
2. Change the most exposed credentials
Secure access to hosting, SFTP/SSH, the WordPress dashboard and connected services right away. If you suspect the computer used to manage the site is compromised, change the passwords from a secure device.
3. Find the entry point
Removing malware without understanding how it got in means risking another compromise. Check in particular:
- vulnerable or outdated plugins and themes;
- old, forgotten WordPress installs on the same hosting;
- administrator accounts you don’t recognize;
- reused or stolen credentials;
- recently modified files;
- server and security plugin logs;
- known vulnerabilities in the installed components.
4. Restore core, plugins and themes from trusted sources
When possible, it’s safer to replace WordPress, plugin and theme files with clean copies from the original sources rather than trying to fix infected files by hand.
Don’t blindly overwrite custom code, though: first check what is legitimate code and what the attacker added.
5. Check the places where malware most often hides
wp-config.phpand.htaccess;- the
wp-content/uploadsfolder, where there normally shouldn’t be any PHP files; mu-pluginsand unknown plugins;- the active theme and child theme;
- cron jobs and scheduled tasks;
- users and administrative roles;
- database, options and spam content;
- JavaScript injected into content or widgets.
6. Update or remove the vulnerable component
Once you’ve found the cause, update WordPress and the affected components, or remove them if they’re no longer maintained. Leaving active the plugin that caused the compromise undoes the whole cleanup.
7. Rotate passwords and keys after the cleanup
After removing the compromise, change sensitive credentials again and regenerate WordPress security keys. Also make sure no unauthorized admin accounts or API access remain.
8. Check the frontend, indexing and connected services
Check the site on desktop and mobile, forms, email delivery, Search Console, any redirects, indexed spam pages and security warnings. If Google has detected harmful content, the technical cleanup must be followed by handling those warnings and checking indexing.
9. Monitor the site in the following days
A compromise isn’t resolved just because the site “looks clean”. Monitor logs, file changes, users, cron jobs, unusual traffic and any new warnings.
Good WordPress maintenance reduces the risk of ending up in the same situation again.
When you need technical support
If you can’t identify the entry point with certainty, or the site keeps getting reinfected, it’s better to avoid trial and error. A technical review has to tell compromised files apart from legitimate code and close the vulnerability that caused the incident.