Your WordPress Site Was Just Hacked. Here's Exactly What to Do in the Next 60 Minutes.

How Do You Know You've Actually Been Hacked?

Before you do anything else, confirm the hack is real. Symptoms vary:

• •Visitors are getting redirected to pharmacy, casino, or adult sites — but you see nothing when logged in
• •Google Search Console shows "Hacked content detected" or your URLs suddenly point to spam
• •Your hosting company suspended the account for "malicious activity" or sending spam email
• •A Google search for site:yourdomain.com shows pages with titles in other languages
• •Browser antivirus warnings appear when visiting your own site
• •Sudden unexplained traffic drop of 30%+ (Google de-indexed infected pages)
• •Unknown admin accounts appeared in your Users list

The dangerous part: modern malware is engineered to stay invisible to site owners. It checks whether the visitor is a logged-in admin and shows them a clean site — while serving spam to Google's crawler and redirecting mobile visitors. You might see nothing wrong for months.

The only reliable way to confirm is an external scan from outside your server.

---

Step 1 — External Scan First (Before You Touch Anything)

Run a free external scan at wp-scan.org/malware-check

This scans your site the way an attacker or Google would — from the outside, with no admin cookies, no special access. It specifically detects:

• •Malware signatures and PHP backdoor files
• •Spam injection hidden from logged-in visitors
• •Suspicious redirects (mobile, crawler, referral-based)
• •Dangerous exposed files (.env, wp-config.php, webshells)
• •Security header gaps that attackers exploit
• •Outdated plugins with known CVEs

Save the full report. You'll need it to prioritise the cleanup — and if you end up filing a claim with insurance or your host, it's documentation.

---

Step 2 — Stop the Bleeding (First 5 Minutes)

# Option A: Block wp-admin by IP while you work (Apache .htaccess)
<Files wp-login.php>
    Order Deny,Allow
    Deny from all
    Allow from YOUR.IP.ADDRESS.HERE
</Files>
# Option B: Enable maintenance mode in wp-config.php (add this line)

define('WP_MAINTENANCE', true);

While access is restricted, change all passwords immediately:

• •WordPress admin accounts (all of them)


• •Database password — then update wp-config.php to match


• •Hosting cPanel / Plesk password


• •FTP credentials


• •The email address your WordPress notifications go to

Do not skip the database password. A significant number of hacked sites are re-compromised within 30 days because the attacker had saved the original database credentials.

---

Step 3 — Identify and Remove the Infection

Use your scan report as your cleanup guide. Common infection locations:

Backdoor files in unexpected places:

# These should NOT contain PHP files — if they do, they're backdoors:

/wp-content/uploads/*.php

/wp-content/uploads/2025/*/.php

/wp-content/uploads/2026/*/.php

# Common backdoor names:

wp-feed.php, wp-xmlrpc-helper.php, class-wp-updates.php,

class-wp-widget-advanced.php, .a1.php, .class.php

Injected code in core files:

# Via SSH — search for common obfuscation patterns:

grep -r "eval(base64_decode" /wp-content/ --include="*.php" -l

grep -r "gzinflate(str_rot13" /wp-content/ --include="*.php" -l

grep -r "preg_replace.\/e" /wp-content/ --include=".php" -l

Hidden admin users:
Check WordPress Admin → Users → All Users. Delete any account you don't recognise. Common backdoor usernames: wp_support_helper, wpadmin2, admin2, system_user.

Modified core files:
Download a fresh copy of your WordPress version from wordpress.org/download/releases and compare /wp-includes/ and /wp-admin/ files. The functions.php files in your theme are also commonly injected.

---

Step 4 — Regenerate Security Keys

Even after cleaning, an attacker with a saved session cookie still has admin access. Regenerating salts invalidates all active sessions instantly.

// Step 1: Generate new keys at https://api.wordpress.org/secret-key/1.1/salt/
// Step 2: Replace the existing define('AUTH_KEY'...) block in wp-config.php
// Your wp-config.php should have these 8 defines:
define('AUTH_KEY',         'REPLACE_WITH_STRING_FROM_GENERATOR');

define('SECURE_AUTH_KEY',  'REPLACE_WITH_STRING_FROM_GENERATOR');

define('LOGGED_IN_KEY',    'REPLACE_WITH_STRING_FROM_GENERATOR');

define('NONCE_KEY',        'REPLACE_WITH_STRING_FROM_GENERATOR');

define('AUTH_SALT',        'REPLACE_WITH_STRING_FROM_GENERATOR');

define('SECURE_AUTH_SALT', 'REPLACE_WITH_STRING_FROM_GENERATOR');

define('LOGGED_IN_SALT',   'REPLACE_WITH_STRING_FROM_GENERATOR');

define('NONCE_SALT',       'REPLACE_WITH_STRING_FROM_GENERATOR');

After saving, everyone — including any attacker — is immediately logged out.

---

Step 5 — Update Everything

WordPress Core    → Latest stable release (critical security releases are free)
All Plugins       → Zero exceptions — even plugins you barely use
Active Theme      → Update immediately
Inactive Themes   → Delete them — they're attack surface even when unused
PHP Version       → 8.1 or 8.2 minimum (check with your host)

The average exploitation window after a vulnerability disclosure is 5 hours. If you're running outdated software, you're already inside that window.

---

Step 6 — Verify It's Clean

Run the external scan again: wp-scan.org/malware-check

Compare your before/after grades. A successful cleanup typically takes you from F or D to A or B.

If flagged issues remain — especially webshell files or spam injection — there may be secondary infection points your cleanup missed. The scan report gives the exact file paths and vulnerability details needed to track them down.

---

Step 7 — Harden to Prevent Re-Infection

The most common reason hacked sites get hacked again: the original entry point was never closed.

# Block XML-RPC (brute-force amplification vector)
<Files xmlrpc.php>
    Order Deny,Allow
    Deny from all
</Files>
# Block PHP execution in uploads directory

<Directory /wp-content/uploads>

    <Files *.php>

        Deny from all

    </Files>

</Directory>
# Security headers

<IfModule mod_headers.c>

    Header always set X-Frame-Options "SAMEORIGIN"

    Header always set X-Content-Type-Options "nosniff"

    Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains"

</IfModule>

// wp-config.php hardening:
define('DISALLOW_FILE_EDIT', true);  // Block admin → Theme/Plugin editor
define('FORCE_SSL_ADMIN', true);     // Force HTTPS for admin sessions

Also enable 2FA on all admin accounts. A brute-forced password is useless against 2FA.

---

The Reinfection Trap

40% of cleaned WordPress sites are re-hacked within 30 days. Almost always because:

1. 1The original vulnerability (outdated plugin) was cleaned around but never patched
2. 2A backup containing a backdoor was restored
3. 3The cleanup missed a secondary backdoor in an unexpected location

Running the external scan monthly — not just after incidents — catches issues before they compound into full infections.

---

60-Minute Recovery Summary

→ Start your free scan at wp-scan.org/malware-check

Free external scan — 22 checks, instant report. No plugin, no account.

Run Free Scan → wp-scan.org/malware-check

Tags: wordpress hacked wordpress malware removal hacked wordpress site wordpress emergency wordpress recovery malware scan wordpress security

📬 Enjoyed this article?

Get the next one in your inbox — free WordPress security guides, weekly.

Subscribe