WordPress Site Hacked? How to Fix It Step by Step (2026)

One morning a customer messages you: your website just sent them to a gambling page. Or Google shows "This site may be hacked" right under your domain. That is the moment you realize your WordPress site has been hacked. Don't panic, and don't start deleting files at random. Doing things in the wrong order is the fastest way to destroy evidence, lose real data, or leave a backdoor behind so the site gets reinfected a few days later.

In this guide, TeamDevDesign walks through how to fix a hacked WordPress site in the right order, from spotting the first symptoms to recovering your search rankings and preventing the next attack. It is based on official guidance from WordPress.org and Google Search Central, plus the Vietnamese personal data rules that took effect in 2026.

In this article:

• Signs your WordPress site has been hacked
• Diagnosis table: symptom, likely cause, action
• How to fix a hacked WordPress site, step by step
• Finding backdoors: where they hide and how to spot them
• Cleaning an infected WordPress database
• Removing Google warnings and recovering SEO
• If customer data leaked: legal obligations in Vietnam
• Preventing the next hack
• Quick checklist
• FAQ

1. Signs your WordPress site has been hacked

Many modern infections are built so that the site owner never sees them. The malware only redirects visitors who arrive from Google, only fires on mobile devices, or only serves spam to search engine bots (a technique called cloaking). Opening your homepage on your own laptop is not enough. Check from several angles.

Symptoms visible on the site

• Unexpected redirects: clicking a Google result takes visitors to gambling, pharmacy or fake prize pages, or to a page asking them to "click Allow to verify". It often happens only on the first visit or only on mobile.
• Fake prompts: bogus CAPTCHA pop-ups or "browser update" downloads.
• Injected content: hidden links in the footer, strange iframes, or posts you never published.
• Locked out of wp-admin even with the right password, or the admin email address has changed.

Symptoms in Google and external tools

• Japanese, gambling or pharma SEO spam: a site:yourdomain.com search shows thousands of unfamiliar pages with Japanese titles or betting keywords. This is the well-known "Japanese keyword hack".
• Google Safe Browsing warnings: browsers show a red "Deceptive site ahead" or "The site ahead contains malware" screen. You can check status in the Google Transparency Report.
• "Security issues" in Search Console: the Security Issues report groups problems into code injection, content injection, URL injection, malware and social engineering.
• Unknown owners or sitemaps in Search Console: attackers often add themselves to your property to get their spam pages indexed faster.

Symptoms on the server

• Unknown admin users, often with system-sounding names such as "wpadmin", "support" or "wp-update".
• Strange files in wp-content/uploads: this folder should hold images, PDFs and videos. A .php file in there is a strong red flag.
• Your host suspends the account or emails you that the site is distributing malware or sending spam.
• CPU, RAM or bandwidth spikes, unknown cron jobs, or your domain's email landing on blocklists.
• .htaccess, index.php or wp-config.php with recent modification dates even though you haven't touched them.

Note: Not every warning means a hack. An expired SSL certificate or a third-party ad script can also trigger browser warnings. Cross-check several symptoms before drawing conclusions.

2. Diagnosis table: symptom, likely cause, what to do

3. How to fix a hacked WordPress site, step by step

The order below follows the official FAQ My site was hacked from WordPress.org, with practical WP-CLI steps added.

Step 1: Document and isolate the site

Write down what you are seeing, when you first noticed it, and any recent changes such as a new plugin or a theme edit. This becomes the baseline of your incident report. Then isolate the site so it stops harming visitors:

• Turn on maintenance mode, or password-protect the site so only your IP address can reach it.
• If several sites share one hosting account, assume all of them may be infected.
• Tell your hosting provider. They have access logs and backups, and can tell you whether the server itself is affected.

Step 2: Take a forensic backup of the current state

Before deleting anything, download the full codebase, the database and the access and error logs. This "dirty" copy helps you trace how the attacker got in and lets you recover real content if you remove something by mistake. Never restore this copy onto the live site.

Step 3: Change every password and scan your own computer

Change credentials for every access point: hosting panel (cPanel, aaPanel), FTP/SFTP, SSH, the database user (remember to update DB_PASSWORD in wp-config.php), every WordPress administrator, the admin mailbox and your domain registrar account. WordPress.org also recommends a full malware scan of your own computer, because trojans on a local machine can steal FTP and wp-admin passwords. Once the site is confirmed clean, change the passwords one more time.

Step 4: Scan for malware from outside and inside

No single tool catches everything, so combine them. Use an external scanner such as Sucuri SiteCheck or VirusTotal, which is quick but only sees what a browser sees. Add a server-side scanner such as the Wordfence or Sucuri Security plugin, which inspects files and the database. Then verify checksums with WP-CLI, which is the most objective way to know whether core and plugin files were modified.

wp core verify-checksums downloads the official MD5 checksums from WordPress.org and compares them with your installed files. wp plugin verify-checksums does the same for plugins:

# Verify WordPress core files, and warn about unknown files in the root
wp core verify-checksums --include-root

# Verify every plugin installed from WordPress.org
wp plugin verify-checksums --all

# List administrator accounts to spot unknown users
wp user list --role=administrator --fields=ID,user_login,user_email,user_registered

Keep in mind that wp plugin verify-checksums can only check plugins hosted on WordPress.org. Premium or custom plugins have no published checksums, so download a fresh copy from the vendor and compare it yourself.

Step 5: Replace core, plugins and themes from official sources

Instead of patching infected files one by one, replace everything you can re-download:

• Core: delete wp-admin and wp-includes entirely and upload clean copies of the same version. WordPress.org advises against the "Re-install" button in wp-admin, because the installer only overwrites existing files while malware usually adds new ones. With WP-CLI: wp core download --version=<version> --skip-content --force.
• Plugins: delete each plugin folder and reinstall from WordPress.org or the vendor's site. Remove unused plugins and every nulled or cracked copy.
• Themes: reinstall a clean copy of your theme and only bring back customizations after reviewing them line by line. Delete unused themes.
• Review by hand the files you cannot replace: wp-config.php, .htaccess (in the root and in subfolders), the mu-plugins folder and uploads.

Step 6: Rotate salt keys to kill every session

An attacker may still hold a valid login cookie. Replacing the security keys (AUTH_KEY, SECURE_AUTH_KEY, LOGGED_IN_KEY, NONCE_KEY and the matching SALTs) in wp-config.php logs everyone out. Generate a fresh set with the WordPress.org secret key generator, or run:

wp config shuffle-salts

Step 7: Restore from a clean backup (if you have one)

If you have a backup from before the infection, restoring it is usually faster and more reliable than cleaning by hand. But a backup does not patch anything. If you skip updating the vulnerable plugin and changing passwords, the site will be hacked again through the same hole. Scan the backup itself before you use it, and use your logs or file dates to pin down when the infection started.

4. Finding backdoors: where they hide and how to spot them

A backdoor is code that lets an attacker come back even after you change every password. It is the main reason sites get "cleaned" and then reinfected a few days later. This section only describes how to recognize them, for defensive purposes.

Common hiding places

• PHP files inside wp-content/uploads, wp-content/upgrade or cache folders.
• wp-content/mu-plugins: must-use plugins run automatically and do not appear in the normal plugin list.
• The theme's functions.php, header.php and footer.php; index.php and wp-config.php in the root.
• Files named to look like core files, such as wp-login1.php, wp-cache.php or class-wp-xyz.php, sitting in the wrong place.
• "Ghost" plugins with generic names that do not exist on WordPress.org and sometimes hide themselves from the admin screen.

Red flags in the code

• Nested decoding and execution functions: eval, base64_decode, gzinflate, str_rot13, assert, create_function.
• Values from $_POST, $_REQUEST or $_COOKIE passed straight into an execution function.
• Very long meaningless strings, random variable names, or thousands of characters crammed onto a single line.
• Recent modification dates that do not match any update you made.

A few search commands help narrow things down (run them on a copy or over SSH):

# PHP files inside uploads (there usually should be none)
find wp-content/uploads -type f -name "*.php"

# PHP files modified in the last 7 days
find . -type f -name "*.php" -mtime -7

# Functions commonly found in obfuscated code
grep -rnE "eval\(|base64_decode\(|gzinflate\(|str_rot13\(" wp-content --include=*.php

The grep results will include legitimate plugins too (plenty of them use base64_decode for normal reasons). Don't delete on reflex: compare against the original plugin source. If PHP is new to you, read our guide to common PHP security vulnerabilities.

5. Cleaning an infected WordPress database

Replacing files is not enough. A lot of malware lives in the database, so it survives a fresh core install. Back up the database first, then inspect it with phpMyAdmin, Adminer or WP-CLI. The queries below only read data; they delete nothing:

# Check whether the site address was changed to a foreign domain
wp option get siteurl
wp option get home

# Look for scripts injected into options and posts
wp db query "SELECT option_name FROM wp_options WHERE option_value LIKE '%<script%'"
wp db query "SELECT ID, post_title FROM wp_posts WHERE post_content LIKE '%<script%' OR post_content LIKE '%<iframe%'"

# List cron events to spot unknown hooks
wp cron event list

• wp_options: check siteurl, home, active_plugins, HTML widgets and theme options for scripts.
• wp_users and wp_usermeta: remove unknown users and review the wp_capabilities of every account.
• Spam content: delete posts, pages and comments created in bulk; filter by creation dates that match the time of the hack.

If your table prefix is not wp_, adjust the queries. Avoid plain find-and-replace on serialized data, because it easily corrupts it.

6. Removing Google warnings and recovering a hacked site's SEO

Only once the site is clean and the hole is patched should you turn to Google:

1. Audit Search Console access: remove unknown owners, users and sitemaps.
2. Use the URL Inspection tool to see exactly what Googlebot receives and catch cloaking.
3. Return 404 or 410 for the spam URLs you deleted. The Removals tool can temporarily hide the worst pages.
4. Click "Request Review" in the Security Issues report, explaining the problem, the steps you took and the result.

According to Search Console Help, a review can take anywhere from a few days to a few weeks, and spam cases often take longer than malware because they may need manual checks. Google also asks you not to resubmit while a request is still pending, and to fix every issue on every page before asking. If rankings dropped sharply after the incident, our SEO and speed optimization service may help.

Monitoring after the cleanup

• Check Search Console weekly for one to two months: indexed page count, unfamiliar queries, security reports.
• Enable file-change and login alerts in your security plugin.
• Review access logs for strange requests to PHP files in uploads or to xmlrpc.php.
• Check email blocklists if your domain was used to send spam.

7. If customer data leaked: legal obligations in Vietnam

If your site stores customer information (WooCommerce orders, contact forms, member accounts) and there are signs the data was stolen, this is no longer just a technical problem. Since 1 January 2026, Vietnam's Personal Data Protection Law No. 91/2025/QH15 has been in force. Article 23 requires the data controller, on discovering a violation that may cause harm (for example to data subjects' property or reputation), to notify the specialized personal data protection authority under the Ministry of Public Security within 72 hours of discovery.

Decree 13/2023/ND-CP contained a similar 72-hour rule, but it has been replaced by Decree 356/2025/ND-CP, effective the same day, which sets out the notification form and procedure. This is general information, not legal advice; for a specific case, consult a lawyer. In practice, keep the logs and forensic copy from Step 2 and record exactly when you discovered the breach and what data may be affected.

8. Preventing your WordPress site from being hacked again

According to Patchstack's State of WordPress Security in 2026 report, 11,334 new vulnerabilities were found in the WordPress ecosystem in 2025: 91% in plugins, 9% in themes, and only six low-priority issues in core. Patchstack also found that 46% of vulnerabilities had no fix available at the time of public disclosure. In short, most of the risk comes from what you add on top of WordPress.

• Update and trim your plugins: remove anything unused and never run nulled copies. See WordPress plugin vulnerabilities and how to check for them.
• Protect the login page: long unique passwords, 2FA and login rate limiting. See our WordPress login security guide.
• Harden WordPress: disable the dashboard file editor (DISALLOW_FILE_EDIT), block PHP execution in uploads and set correct file permissions. The overview is in our article on WordPress security vulnerabilities.
• Harden the server if you run a VPS: firewall, SSH keys, Fail2Ban, as covered in Linux VPS security.
• Automated off-server backups with multiple versions, tested regularly.
• Separate sites: don't run many websites under one hosting user, to avoid cross-contamination.

If you don't have time to monitor everything yourself, take a look at TeamDevDesign's website maintenance and management plans.

9. Quick checklist for a hacked site

1. Document the symptoms and timing; tell your host.
2. Enable maintenance mode and isolate the site.
3. Take a forensic backup (files, database, logs).
4. Change hosting, FTP/SSH, database, admin and email passwords; scan your own computer.
5. Scan with Sucuri SiteCheck and Wordfence; run wp core verify-checksums and wp plugin verify-checksums --all.
6. Replace core, plugins and themes from official sources; delete what you don't use.
7. Hunt for backdoors in uploads, mu-plugins, the theme, .htaccess and wp-config.php.
8. Clean the database: options, users, spam content, cron.
9. Rotate salt keys; change passwords a second time.
10. Fix the root cause (vulnerable plugin, weak password).
11. Request a review in Google Search Console.
12. Assess notification duties if personal data was exposed.
13. Monitor for one to two months and apply the prevention measures.

10. Frequently asked questions

How do I know if my WordPress site has been hacked?

Search site:yourdomain.com on Google, check the Security Issues report in Search Console, scan with Sucuri SiteCheck and run wp core verify-checksums. Also try visiting from a phone via a Google result, since many infections only redirect in that situation.

Will a security plugin clean the malware automatically?

It can detect and fix many cases, but not all of them. Backdoors in the database, heavily obfuscated files and premium plugins without checksums still need manual review.

Is restoring an old backup enough?

No. A backup returns the site to an earlier state, but the vulnerability is still there. You still need to update plugins, change passwords, rotate salt keys and keep monitoring.

How long does Google take to remove the warning after a review request?

Google says it usually takes from a few days to a few weeks. Spam injection cases can take longer because they may require manual review. Only submit once the site is completely clean.

Why does my site keep getting hacked after cleanup?

The usual suspects are a leftover backdoor, an unpatched plugin, an old password that was never changed, or another infected site on the same hosting account that keeps reinfecting yours.

Conclusion

Fixing a hacked WordPress site takes a calm head and the right order: isolate, take a forensic backup, change passwords, verify checksums, replace files from original sources, hunt backdoors, clean the database, rotate salt keys and only then ask Google for a review. Above all, find out how the attacker got in and close that door. If you would like a second pair of eyes to review or restore your site, feel free to contact TeamDevDesign.