Cleaning a hacked WordPress site can be done yourself, but the order is critical. Do the steps in the wrong sequence and you risk losing data or leaving a backdoor that re-infects everything. Here’s what a safe, complete cleanup looks like.
1. Isolate and back up
Take the site offline or to an isolated environment so the damage doesn’t spread and the attacker can’t act while you clean. Take a full backup of both files and database before touching anything — even an infected backup is better than no way back. Work in a copy if you can, not directly on the live site your visitors see.
2. Map the whole infection
Compare all files against original core, themes and plugins from wordpress.org. Scan the database for injected code and hidden accounts, and read the access and error logs to find the entry point and the timing. The goal in this step is to understand the whole infection before you start removing — not to chase symptoms one at a time.
3. Remove and replace
The safest way to get rid of infected core files is to replace them with clean originals rather than trying to clean them by hand. Remove malicious code, backdoors and unauthorized admin accounts, and delete scheduled WP-Cron jobs that don’t belong.
- Replace WordPress core, themes and plugins with clean versions.
- Remove unknown accounts and every backdoor you found.
- Clean injected code out of the database (posts, options, widgets).
4. Patch and rotate keys
Update core, themes and plugins to the latest version — and remove what you don’t use. Then rotate all passwords (WordPress, database, FTP, hosting) and change the salts and secret keys in wp-config.php, which logs out all existing sessions. Doing this before the site is clean is pointless; do it after.
5. Verify and get off blocklists
Re-scan to confirm the site is clean, test in incognito on mobile to catch redirects, and request removal from Google Safe Browsing if it was flagged. Miss a backdoor and everything gets flagged again — so be sure before you request a review.
Common mistakes to avoid
The two most common errors: removing only the visible part and missing the backdoor, and restoring from a backup taken after the infection (and therefore infected too). A third is forgetting the hardening afterwards, so the same entry point stays open and the site is hacked again within weeks.
Better safe than fast
Don’t want to guess your way through it? Our WordPress cleanup does exactly this — migrates the site to an isolated Kepler environment, runs a full scan with a backup before every change, and leaves an incident report. Afterwards you can stay on Managed WordPress hosting, where monitored updates and daily backups keep the site clean going forward, or take the clean site home.