Step-by-step guide to recover a hacked WordPress site

Introduction: When Your Digital Home Is Invaded

Imagine waking up, opening your analytics dashboard, and seeing your traffic drop to zero. Your homepage now redirects to a gambling site or your hosting account is suspended. That gut-wrenching moment when you realize your WordPress site has been hacked is terrifying — but it doesn’t have to be the end.

As a digital marketer and consultant, I’ve helped clients and mentored bloggers through hacked sites. In many cases, the difference between a clean recovery and a recurring nightmare is how methodically you respond. This post walks you through step by step (with real-world lessons) to clean up your site, reestablish trust, and harden your defenses — all under the banner of WordPress security.

Signs Your WordPress Site Has Been Hacked

Before recovery, you need confirmation. Some red flags are obvious, others subtle:

Real-world lesson: A client once had their site redirect randomly to an offline casino site, but only for visitors from certain countries. Because we caught it early (by tracking traffic spikes), we restored from a clean backup and hunted down the redirect in a seemingly innocuous plugin file. It was a reminder: even partial hacks leave breadcrumbs.

Step-by-Step Recovery Workflow

Recovering a hacked WordPress site is not a one-click task; it’s a deliberate, layered process. Below is the recommended order.

1. Stay Calm and Assess What You Can Access

Panic leads to mistakes (like overwriting something useful). First:

• Check if you can still log into /wp-admin/.
• If that fails, check via FTP / SFTP or host file manager.
• Ask your host if they have server logs or clues (e.g., suspicious access times).
  Many hosts (especially managed WordPress hosts) have insights they can share.
  WordPress.com+2Kinsta®+2

Knowing whether you retain partial access helps shape the next steps.

2. Switch Site to Maintenance / “Offline” Mode

While you clean up, you don’t want visitors exposed to malicious code or to make things worse.

• Use a maintenance mode plugin (e.g. “Maintenance,” “Coming Soon”) or a simple .htaccess redirect.
• If using a CDN (like Cloudflare), you might enable its “Under Attack” mode.

This protects your reputation and reduces risk while you dig deeper.
WordPress.com+2WPZOOM+2

3. Backup Everything — Even the Infected Version

Before deleting anything, make a full backup of all files + the database. Yes, even though it’s compromised. Why?

• Helps forensic work (understand how the hack happened).
• Serves as a fallback if cleanup breaks something irreversibly.
  WordPress.com+2WP SitePlan+2

Store the backup off the original server (e.g. on your local machine, cloud storage) so you don’t overwrite or reintroduce compromised files.

4. Reset Every Password and User Access Point

Hackers often reuse backdoors or credentials, so changing passwords must be early:

• WordPress admin & all user accounts
• Hosting / cPanel / Plesk
• Database user & password
• FTP / SFTP / SSH
• API keys, email accounts linked to the site

If you can’t log in normally, consider resetting the admin password via phpMyAdmin (edit wp_users) or WP-CLI.
WordPress.com+2help.one.com+2

Also, review all site users and remove suspicious ones (especially those with Administrator role).
Kinsta®+2WP SitePlan+2

5. Scan and Clean Malicious Code / Malware

Now comes the heavy lifting. Use a combination of tools + manual inspection.

Tools & Plugins to Help

• Wordfence – file scanning, malware detection, firewall
• Sucuri – site scanner and cleanup services
• MalCare – specializes in WordPress malware cleanup
• Code scanning / static analysis tools
• Hosting-level malware scanners / quarantine

Let these tools flag suspicious files (or file changes) as clues.
WPZOOM+3Kinsta®+3WP SitePlan+3

Manual Inspection & Cleanup

• Replace WordPress core files (wp-admin, wp-includes) with fresh copies from WordPress.org
• Reinstall all themes and plugins from trusted sources
• Search for “weird-looking” PHP files in uploads, theme or plugin directories
• Check .htaccess, wp-config.php, root files for injected code
• Inspect scheduled tasks / cron jobs — some hacks hide in cron scripts (as shared by users on Reddit) “Also, one place people don’t look for hacking code is cron tasks.” Reddit
• Clean the database for injected entries (e.g. suspicious content in wp_options, wp_posts)

Repeat scans until your site is clean — then test.

6. Reinstall / Update Everything

Once cleaned:

• Update WordPress core, themes, and plugins to the latest versions
• Remove (delete) plugins/themes you don’t use
• If a plugin/theme looks abandoned (no updates in >1 year), replace it
• Reconfigure settings (reapply customizations cautiously)
  WP SitePlan+3Kinsta®+3WordPress.com+3

7. Regenerate Security Keys & Salt in wp-config.php

To invalidate all existing sessions (forcing login again):

• Generate new WordPress salt keys (use WordPress.org’s secret-key service)
• Replace the old salts in wp-config.php
• Save and upload changes
  WPBeginner+2WP SitePlan+2

8. Clean Sitemap, Resubmit to Google & Remove Blacklist

If Google or security services flagged your site:

• Regenerate sitemap.xml via your SEO plugin
• Submit a “Clean & Review” request inside Google Search Console
• Monitor “Security Issues” in GSC to ensure the site is removed from warnings
  Kinsta®+1

Check for malicious redirects or SEO spam content — remove anything suspicious.
Unlock crawling again after cleanup.

9. Monitor, Harden, and Audit Permissions

Recovery isn’t enough — you must fortify and watch closely:

• Install a firewall (e.g. via Wordfence, Sucuri, or Cloudflare WAF)
• Limit login attempts, enforce strong passwords + two-factor authentication
• Disable file editing from the WordPress dashboard
• Enforce least privilege (only give “Editor” or “Author” access where needed)
• Enable file integrity monitoring
• Audit server and file permissions
• Use SSL / HTTPS across the site

Pro tip from experience: After cleanup, I keep a “honeypot” plugin (dormant) that tracks file changes. If I ever see unexpected modifications weeks later, I treat it as a red alert and dig in.

10. Validate Everything Works, Then Remove Maintenance Mode

Test:

• Core site pages
• Forms, logins, plugins with dynamic interactions
• Search, comments, e-commerce (if relevant)
• Check error logs

When confident, bring the site back online (disable maintenance mode).
Announce to users, and monitor for anomalies in the hours afterward.

Pitfalls, Case Studies & Unique Insights

Pitfall: Restoring from a backup without scanning. One blogger I consulted for restored a “clean” backup — only to reintroduce the same vulnerability later because the backup had latent malicious code.

Case (real): A site got blacklisted by Google for SEO spam. After recovery, a new sitemap included injections of foreign domains. The cleanup required aggressive pruning of suspicious wp_options rows and re-submitting to Google Search Console. The lesson: always check database tables, not just files.
Kinsta®+1

Unique Insight: Many hacks hide in plain sight via cron jobs. When scanning file systems, don’t forget to inspect scheduled server tasks or WordPress-level cron entries. A user on Reddit observed:

“One place people don’t look for hacking code is cron tasks.” Reddit

Also, sometimes host-level vulnerabilities or shared server issues cause reinfection — meaning even a perfect cleanup can be undermined if the server itself is compromised. Always coordinate with your host and, where possible, move to more secure hosting if needed.
WordPress.com+1

Post-Recovery Checklist & Timeline

To help you execute this methodically, here’s a sample timeline:

Expect this process to take anywhere from a few hours (for simple hacks) to a couple of days for deeply embedded backdoors.

Conclusion: From Panic to Reinforcement

Recovering a hacked WordPress site can feel overwhelming, but with a systematic approach you can turn chaos into control. From the moment you detect a breach, every action — backup, password reset, scanning, cleaning, hardening — builds toward stronger WordPress security.

Here’s what really makes the difference:

1. Methodical order — don’t skip steps.
2. Thoroughness — hidden malware or cron jobs will come back if overlooked.
3. Prevention mindset — recovery is just the starting point; continuing vigilance is essential.
4. Use of expert tools + hosts — a strong host and reputable security service can reduce your burden.

Once you’ve walked through this recovery path, commit to regular scans, updates, backups, and audits. At that point, a hack becomes far less likely — and far easier to handle if it ever happens again.