How to Clean a Hacked WordPress Site (2026 Step-by-Step Guide)

First: Don't Panic, But Move Fast

A hacked WordPress site rarely stays "just a little hacked." Attackers use compromised sites to send spam, mine backlinks, host phishing pages, or pivot to other sites on the same server. Every hour it stays live makes cleanup harder and increases the chance your host suspends the account outright.

Here's the order of operations.

Step 1: Confirm It's Actually a Hack

Before doing anything drastic, verify with a scanner rather than guessing:

• Run your URL through Sucuri SiteCheck (free, no login required) — it flags known malware signatures, blacklist status, and defacements
• Check Google Search Console for a "Security Issues" warning
• Look for unfamiliar admin or editor users under Users → All Users

Step 2: Take the Site Offline (or Into Maintenance Mode)

If malware is confirmed, stop it from spreading or serving malicious content to visitors:

• Enable maintenance mode, or password-protect the site at the server level if your host allows it
• Change all passwords immediately — WordPress admin, hosting account, FTP/SFTP, and database — from a different, clean device
• Revoke and reissue any API keys or application passwords

Step 3: Back Up the Infected Site (Yes, Really)

Take a full backup even though it's compromised — you may need it for forensics, and some cleanup attempts make things worse before they make them better. Store this backup separately; don't restore it until it's been cleaned.

Step 4: Remove the Malware

This is where most DIY cleanups go wrong: removing the visible symptom (a defaced page, a spam redirect) without finding the backdoor that let the attacker back in. A proper cleanup means:

1. Replacing WordPress core, theme, and plugin files with known-clean copies from the official source
2. Diffing your uploads folder and custom code against backups for injected PHP
3. Checking your config file, redirect rules, and any must-use plugins for injected backdoors
4. Scanning the database for injected script tags or spam links in posts and options tables
5. Removing any admin users, scheduled tasks, or files you didn't create

If that list feels like more than a weekend project — it usually is. This is exactly the scenario managed cleanup services exist for: they've seen the same backdoor patterns thousands of times and know where attackers hide persistence.

Get Your Site Cleaned by Sucuri →

Step 5: Close the Entry Point

Cleaning the malware without fixing how it got in guarantees reinfection. Common entry points:

• Outdated plugins or themes with known vulnerabilities (check every installed plugin's version against the latest)
• Weak or reused admin passwords
• Vulnerable or abandoned plugins with no recent updates
• Compromised FTP credentials stored insecurely

Step 6: Prevent It From Happening Again

• Put a firewall in front of the site so malicious requests never reach WordPress — a cloud WAF like Sucuri blocks common attack patterns before they hit your server
• Turn on two-factor authentication for all admin accounts
• Keep WordPress core, themes, and plugins updated — set a weekly reminder if you don't use auto-updates
• Remove any plugins or themes you're not actively using

Verdict: DIY vs Managed Cleanup

If you're technical, have clean recent backups, and can dedicate a few focused hours, manual cleanup is doable. If the site generates revenue, handles customer data, or you simply can't afford the downtime and risk of missing a backdoor, a managed service that includes a cleanup guarantee is the faster and safer call.

Related Reviews

• Sucuri Review 2026 →
• Sucuri vs Wordfence 2026 →
• Best WordPress Security Plugins 2026 →

Guide reviewed July 2026.