A young Arab woman in a teal hijab at her desk in a small Cairo office at dusk, hand on the mouse, reviewing malware scan findings on her laptop while fixing a hacked WordPress site.

هذا المقال متوفر باللغة العربية — اقرأ بالعربية

When your customers say their antivirus flagged your store, or Google Search Console shows a malware warning, or you open the site and see spam pages you never wrote, you need a clear plan to fix your hacked WordPress site before it costs you more sales and trust. This guide is for business owners in Egypt, Saudi Arabia and the Gulf who run WordPress sites and need a calm, practical cleanup path, not a pile of scare tactics. Every technical step below comes from the official WordPress documentation, Google Search Central security docs, or other primary sources listed at the end.

I clean and harden WordPress sites for companies across the region, and many cleanup projects start the same way: a sudden redirect, a flood of new admin users, or a host ticket that the site is distributing malware. If you want a team to take over the cleanup and ongoing care, our WordPress site care and support service covers malware response, backups and updates. Whether you do the first steps yourself or hand them to a developer, use the checklist in this post so nothing important is skipped.

Signs your WordPress site was hacked

Not every odd behavior is a hack, but several patterns show up again and again in the official WordPress FAQ for compromised sites. Treat any of these as a reason to investigate the same day:

  • Google, Bing or your host flags the site for malware, or visitors report antivirus warnings.
  • The homepage or random URLs redirect to gambling, pharmacy or phishing pages.
  • New Administrator users appear that nobody on your team created.
  • Strange files, PHP scripts or folders show up in the root, wp-content or uploads.
  • Your site sends spam email, or customers receive messages that look like they came from you.
  • Search results show fake pages or keyword spam you never published.
  • Login stops working for real admins, or the dashboard looks altered.

WordPress notes that not all hacks look the same. Some steal data quietly. Others deface the homepage. Others turn your server into a spam relay. The cleanup order below still applies in most cases: contain the damage, take a copy, remove the malware, restore trust with Google and visitors, then harden so it does not happen again.

First hour: calm triage before you change files

Panic edits on the live site often destroy evidence and break the restore path. In the first hour, do these containment steps from the official WordPress guidance:

  1. Change every password that touches the site. That includes WordPress users, hosting panel, FTP or SFTP, database, email used for admin notices, and any CDN or DNS account. Use unique, long passwords. WordPress documents how to reset a WordPress password from the dashboard, from the database, or with WP-CLI when you are locked out.
  2. Rotate the WordPress secret keys. In wp-config.php, replace the AUTH_KEY, SECURE_AUTH_KEY, LOGGED_IN_KEY, NONCE_KEY and related salts with new values from the official WordPress key generator. This forces existing login cookies off the site so a stolen session cannot stay open.
  3. Take a full backup of the infected state. Even a dirty backup matters for forensics and for rolling back a bad cleanup attempt. A full backup means both the files and the database. Store it somewhere the live server cannot overwrite.
  4. Put the site in maintenance mode or take it offline if it is actively harming visitors (malware downloads, phishing forms). Agree this with your host if they already suspended the account.
  5. List who has access. Write down every person and service account with hosting, SFTP, database or WordPress admin access. Revoke anything you do not recognize.

If you already keep tested backups, pause before you wipe anything. A known-good backup from before the compromise is often faster and safer than hunting every malicious file by hand. Our guide to backing up and restoring a WordPress site the right way explains what a usable backup must include and how to run a restore drill.

How attackers usually get in

Understanding the entry point helps you close it. Hardening docs from WordPress stress that security is risk reduction, not perfection, and that responsibility is shared between you and the host. Common ways business sites get compromised:

  • Outdated core, themes or plugins with known vulnerabilities. WordPress ships minor and security updates automatically on most sites, but themes and plugins still need timely updates.
  • Weak or reused admin passwords and sites with many Administrator accounts.
  • Nulled or pirated themes and plugins that bundle malware or phone home.
  • Insecure file permissions that let a low-privilege process write into PHP directories.
  • Compromised computer or stolen FTP credentials used by someone who edits the site.
  • Vulnerable custom code in a child theme, mu-plugin or old bridge script.

WordPress.org publishes that WordPress powers more than 43% of the web, which is why attackers automate scans for outdated plugins. That does not mean WordPress is weak. It means unmaintained sites are easy targets. Closing the door after cleanup is as important as removing the malware itself. For login-specific hardening, see our checklist on locking down the WordPress login page with passwords, 2FA and limits.

Clean the infected site or restore from a clean backup?

You have two honest options. Pick based on what you actually have, not on hope.

Situation Better path Why
Verified clean backup from before the hack Restore, then patch Faster, fewer missed backdoors
No clean backup, or backup is also infected Manual cleanup plus reinstall Only path left without rebuilding content
Core business data only in the live database Export content, rebuild files Keeps posts and orders, discards tainted files
Site is small and content is easy to recreate Fresh install, migrate content Lowest chance of leftover malware

WordPress recommends reinstalling core, theme and plugin files with the same versions you were running, then updating carefully, because blindly overwriting with newer packages can hide what was changed. Always keep the infected copy archived offline while you work.

How to fix a hacked WordPress site, step by step

Use this sequence when you need WordPress malware removal on a site you still control. Adapt the order if your host already isolated the account.

1. Scan from outside and from inside

Run an external malware scan (your host tools, Sucuri SiteCheck-style remote checks, or Google's malware signals in Search Console) and an application-level scan from a trusted security plugin installed from wordpress.org after you have rotated passwords. Compare results. External scanners catch public spam and redirects. File scanners catch planted PHP in uploads and theme folders.

2. Inspect the usual targets

The official WordPress hacked-site FAQ calls out .htaccess as one of the files most often altered for redirects and spam. Also compare:

  • wp-config.php for strange includes, eval code or remote file loads
  • The site root for extra PHP files that do not belong to WordPress
  • wp-content/uploads for PHP or double-extension files (images should not execute code)
  • Theme and plugin directories for files with recent timestamps you did not deploy
  • Must-use plugins (wp-content/mu-plugins) and drop-ins like object-cache.php
  • Cron jobs and hosting scheduled tasks you did not create

3. Reinstall WordPress core, themes and plugins

Replace core files with a clean copy of the same version, then replace themes and plugins from wordpress.org or the original vendor (never from a "nulled" mirror). Delete unused themes and plugins entirely. If a premium plugin cannot be re-downloaded from your own account, treat that license problem as part of the incident: you need ownership of the license to stay safe later.

4. Clean or rebuild the database

Search the database for injected spam, rogue admin users, unknown options that load remote scripts, and content that redirects visitors. Remove users you do not recognize. Confirm every remaining Administrator belongs to your team. WordPress documents roles clearly: the Administrator role has access to all administration features, so keep that role rare.

5. Check scheduled tasks and server-level persistence

Malware often survives a file cleanup through a cron entry, a hosting "auto installer" leftover, a second site on the same account, or an email forwarder. Ask your host to list cron jobs, unexpected SSH keys and recent panel logins.

6. Bring the site back carefully

Restore public access only after scans are clean, passwords are rotated, keys are new, and you have a fresh backup of the cleaned site. Then update core, themes and plugins on a schedule you control. If updates make you nervous, test them on a staging copy first.

If the site is also throwing white screens or 500 errors during cleanup, separate those symptoms from the malware itself. Our walkthrough of white screens, 500 errors and database connection failures covers the recovery steps without mixing them into the security work.

Google warnings, Search Console and visitor trust

Google checks sites for malware and unwanted software that harm visitors. In Search Console, the Security Issues report lists problems Google found. After you clean the site:

  1. Confirm the site no longer serves malware or deceptive redirects.
  2. Request a review from the Security Issues report once the root cause is fixed.
  3. Watch the report until Google clears the warning.
  4. Check that sitemaps and key URLs are indexable again, without spam URLs left behind.

Do not request a review before the cleanup is real. A failed review wastes days. Tell your team and, when needed, your customers that the site was compromised and is now cleaned. Silence after a public warning damages trust more than a short, honest note.

When to hire help for WordPress malware removal

You can handle a simple defacement if you have a clean backup and basic hosting skills. Call a professional when any of these are true:

  • You do not have a clean backup and the malware returns after every cleanup.
  • Customer data, orders or payment settings may have been exposed.
  • The site is a WooCommerce store that cannot stay offline for long.
  • Multiple sites share the same hosting account and you fear lateral movement.
  • You are unsure which files are legitimate custom code.
  • Google or the host still flags the site after your first attempt.

A good cleanup engagement should include a written summary of the entry point (if found), a list of removed items, a fresh backup, password rotation confirmation, and a short hardening list. Ongoing care matters as much as the one-time clean. Pair cleanup with a maintenance rhythm so plugins do not quietly fall behind again.

Hardening checklist after the cleanup

WordPress hardening documentation is clear: the goal is fewer easy wins for attackers. After a cleanup, work through this table with your developer or host.

Area Action Done when
Updates Core, themes and plugins current Site Health shows no critical update gaps
Users Remove unknown admins, least privilege Only needed Administrators remain
Logins Strong passwords, 2FA where possible Every admin account protected
Editing Disable in-dashboard file editors if unused DISALLOW_FILE_EDIT set when appropriate
Backups Automatic offsite backups, restore tested You restored a copy successfully once
Host PHP supported, HTTPS on, panel access reviewed Host confirms current stack and access list

Also review XML-RPC exposure, application passwords, and who can install plugins. Keep a short incident log: date discovered, actions taken, who changed passwords, and when Google cleared the warning. That log helps the next person on your team.

Frequently asked questions

Can I just delete the strange files and go live again?

Usually not. Attackers leave more than one backdoor. If you only delete what you can see, the site often gets reinfected within hours. Reinstall clean packages, rotate credentials, and scan again before you reopen the site.

Will a security plugin alone fix a hacked site?

A scanner helps you find problems. It does not replace backups, credential rotation, clean file replacement or server-level checks. Use plugins from wordpress.org or vendors you trust, and treat their report as a map, not a finished cleanup.

Do I need to change my domain or hosting?

Most of the time, no. Change hosting if the provider ignores the incident, cannot isolate malware, or keeps shared accounts in a clearly unsafe state. Keep the domain in an account you own either way.

How do I reduce the chance this happens again?

Keep software updated, limit Administrator accounts, use strong unique passwords and 2FA, avoid nulled plugins, keep offsite backups, and review users after every staff change. A monthly maintenance pass catches most of the boring problems before they become emergencies.

Your next step

If the site is actively redirecting or flagged right now, start with passwords, secret keys and a full backup, then decide whether you restore from a clean copy or run the cleanup sequence above. If you would rather not do that alone, hand the cleanup to our site care team and we will work through malware removal, hardening and monitored updates with you. For a second opinion on a quote you already received, book a free consultation and bring the Search Console screenshots and host tickets with you.

References