How to Clean a Hacked WordPress Site

If your site is redirecting visitors, showing content you did not write, or flagged by Google, work through this in order. The sequence matters: cleaning files before closing the entry point means the infection returns within days.

Step 1 — Contain it

Take the site offline. A hacked site serving malware to visitors damages your reputation and your search rankings every hour it stays up. Create .maintenance in public_html:

<?php $upgrading = time(); ?>

Change every password now: cPanel, WordPress admin, FTP, database. If the attacker still has credentials, everything below is wasted effort.

Do not delete anything yet. A compromised site is evidence, and you will need it to find the entry point.

Step 2 — Establish what happened

Run the Imunify360 scan — cPanel → Security → Imunify360 → Malware Scanner. It lists infected files with paths. Our guide to Imunify alerts covers reading the results.

Check file modification dates in File Manager, sorted by date. Files changed on a date you did not touch the site cluster around the intrusion, and that timestamp lets you narrow the access logs.

Look for the usual placements:

• .php files anywhere under wp-content/uploads/ — uploads should never contain PHP
• Modified index.php, wp-config.php, or .htaccess
• Unfamiliar files in wp-content/plugins/ or themes/
• Recently modified core files in wp-admin/ or wp-includes/

Check for rogue admin users — WordPress → Users. Delete any you did not create, and note the registration date.

Step 3 — The fastest clean route

If you have a backup from before the compromise, restore it. JetBackup restore points make this the quickest and most reliable path — cPanel → Files → JetBackup, choose a date before the modification timestamps you found.

Restoring alone is not enough. You must still do step 4, or the same hole gets used again.

If you have no clean backup, continue with a manual clean.

Step 4 — Manual clean

Replace core. Download a fresh copy of WordPress matching your version, and replace wp-admin/ and wp-includes/ entirely. Do not touch wp-content/ or wp-config.php yet.

Replace plugins and themes. Delete each one and reinstall from the official repository or the vendor. Do not try to clean plugin files by hand — reinstalling is faster and more certain.

Any nulled plugin or theme must go permanently. They are the single most common infection route. The "free premium" version was free because of what was added to it.

Clean wp-content/uploads. Delete every .php file in it. There is no legitimate reason for one to be there.

Check `.htaccess` for redirect rules you did not add, and wp-config.php for injected code at the top or bottom.

Check the database in phpMyAdmin — look at wp_options for unexpected entries in siteurl and home, and scan wp_posts for injected script tags.

Regenerate your salts. Get fresh values from the WordPress secret-key generator and replace them in wp-config.php. This invalidates every existing session, logging out anyone using a stolen cookie.

Step 5 — Close the entry point

This is the step that decides whether you are done or doing this again next week.

• Update everything — core, every plugin, every theme
• Delete what you do not use. Inactive plugins still contain exploitable code
• Identify the vulnerable component. An outdated plugin with a known exploit is the usual answer. Search the plugin name plus "vulnerability" and check the version you were running
• Enable two-factor authentication on cPanel
• Disable the file editor — define('DISALLOW_FILE_EDIT', true); in wp-config.php
• Review FTP accounts in cPanel and delete any you do not recognise

Step 6 — Rescan and go live

Run Imunify again and confirm clean. Delete .maintenance. Watch the site for several days — reinfection usually shows within a week if the hole is still open.

Step 7 — Clear the warnings

If Google flagged the site, request a review in Search Console → Security Issues once it is genuinely clean. Submitting before it is clean gets it re-flagged and slows the process.

Check Search Console for spam pages the attacker created and request their removal.

When to get us involved

Message us on WhatsApp with your domain if reinfection happens after cleaning, if you cannot find the entry point, or if you would simply rather we handled it.

We can read the raw access logs, which usually show the exact request that placed the first file — and that is the difference between fixing the cause and fixing the symptoms.