WordPress Hacked? Complete Recovery Guide 2026

Discovering your WordPress site has been hacked is terrifying. Your business, your content, your visitors' trust - all at risk. But here's the good news: with the right approach, you can recover your site, remove the malware, and prevent this from happening again.

This comprehensive guide covers everything you need to know about recovering a hacked WordPress site, from identifying what happened to implementing bulletproof security.

Signs Your WordPress Site Has Been Hacked

Before diving into recovery, let's confirm your site is actually hacked. Here are the most common warning signs:

Immediate Steps When You Discover a Hack

Time is critical. Follow these steps immediately:

<?php
// Create a file called .maintenance in your WordPress root
$upgrading = time();
?>

How to Identify the Type of Attack

Understanding what type of attack hit your site helps you clean it properly and prevent recurrence.

Scanning for Malware

Use multiple tools for thorough scanning. No single scanner catches everything.

Security Plugin Scanning

If you can access wp-admin, install and run these scanners:

Manual File Scanning

If you can't access wp-admin, scan manually via FTP/SSH:

# Find recently modified PHP files (last 7 days)
find /path/to/wordpress -name "*.php" -mtime -7

# Search for common malware signatures
grep -r "eval(base64_decode" /path/to/wordpress
grep -r "eval(gzinflate" /path/to/wordpress
grep -r "preg_replace.*\/e" /path/to/wordpress
grep -r "assert(" /path/to/wordpress
grep -r "str_rot13" /path/to/wordpress
grep -r "gzuncompress" /path/to/wordpress

# Find files with suspicious permissions
find /path/to/wordpress -perm -o+w -type f

# Look for PHP files in uploads (shouldn't exist)
find /path/to/wordpress/wp-content/uploads -name "*.php"

Database Scanning

Search your database for injected content:

-- Search posts for suspicious scripts
SELECT ID, post_title FROM wp_posts 
WHERE post_content LIKE '%<script%' 
   OR post_content LIKE '%eval(%' 
   OR post_content LIKE '%base64_decode%';

-- Check options table for injected code
SELECT option_name, option_value FROM wp_options 
WHERE option_value LIKE '%<script%' 
   OR option_value LIKE '%eval(%';

-- Look for suspicious admin users
SELECT * FROM wp_users 
WHERE user_registered > DATE_SUB(NOW(), INTERVAL 30 DAY);

-- Check for suspicious user meta
SELECT * FROM wp_usermeta 
WHERE meta_key = 'wp_capabilities' 
AND meta_value LIKE '%administrator%';

Cleaning Infected Files

Option A: Restore from Clean Backup

The fastest and most thorough cleanup method:

1. Verify the backup date is before the infection
2. Scan the backup files for malware before restoring
3. Restore all WordPress core files, themes, and plugins
4. Restore the database
5. Keep the uploads folder from current site (after scanning)
6. Update all software immediately after restore
7. Change all passwords again

Option B: Manual Cleanup

If you don't have a clean backup, clean manually:

Step 1: Replace WordPress Core Files

# Download fresh WordPress
wget https://wordpress.org/latest.zip
unzip latest.zip

# Replace core directories (NOT wp-content)
rm -rf wp-admin wp-includes
cp -r wordpress/wp-admin wordpress/wp-includes .

# Replace core files in root (keep wp-config.php and .htaccess for now)
cp wordpress/*.php .

Step 2: Clean wp-config.php

Compare your wp-config.php against a fresh copy. Remove any code that doesn't belong:

# Suspicious additions to look for:
eval(
base64_decode(
gzinflate(
str_rot13(
@include(
error_reporting(0);
ini_set('display_errors', 0);

Also regenerate your security keys using the WordPress salt generator.

Step 3: Clean .htaccess

Replace with default WordPress .htaccess:

# BEGIN WordPress
<IfModule mod_rewrite.c>
RewriteEngine On
RewriteBase /
RewriteRule ^index\.php$ - [L]
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule . /index.php [L]
</IfModule>
# END WordPress

Step 4: Clean Plugins

The safest approach is to delete and reinstall all plugins:

1. Note which plugins are active (check wp_options table if needed)
2. Delete the entire plugins folder
3. Download fresh copies from WordPress.org or vendors
4. Re-install and activate

Step 5: Clean Themes

Similar approach for themes:

1. Delete all themes except what you need
2. Download fresh copies of required themes
3. If using a child theme, inspect child theme files carefully
4. Check functions.php, header.php, and footer.php especially

Step 6: Clean Uploads Folder

The uploads folder is the most common hiding spot for malware:

# Find PHP files in uploads (these should NOT exist)
find wp-content/uploads -name "*.php" -delete

# Find suspicious file types
find wp-content/uploads -name "*.phtml" -o -name "*.php5" -o -name "*.ico" | xargs file | grep PHP

# Check for files with double extensions
find wp-content/uploads -name "*.*.*"

Database Cleanup

Malware often hides in the database. Clean it thoroughly.

Check for Unauthorized Users

-- List all admin users
SELECT u.ID, u.user_login, u.user_email, u.user_registered 
FROM wp_users u 
JOIN wp_usermeta m ON u.ID = m.user_id 
WHERE m.meta_key = 'wp_capabilities' 
AND m.meta_value LIKE '%administrator%';

-- Delete suspicious users (replace ID)
DELETE FROM wp_users WHERE ID = [suspicious_id];
DELETE FROM wp_usermeta WHERE user_id = [suspicious_id];

Clean Injected Content in Posts

-- Find posts with suspicious content
SELECT ID, post_title, post_content 
FROM wp_posts 
WHERE post_content LIKE '%<iframe%'
   OR post_content LIKE '%<script%'
   OR post_content LIKE '%style="display:none"%';

-- Clean specific injection pattern (CAREFUL - backup first!)
UPDATE wp_posts 
SET post_content = REPLACE(post_content, '[malicious_code]', '')
WHERE post_content LIKE '%[malicious_code]%';

Check Options Table

The wp_options table is frequently targeted:

-- Look for suspicious options
SELECT option_name, LEFT(option_value, 200) 
FROM wp_options 
WHERE option_name LIKE '%base64%'
   OR option_name LIKE '%eval%'
   OR option_name LIKE 'wp_check_%'
   OR option_name NOT LIKE 'widget%' AND option_value LIKE '%<script%';

-- Check siteurl and home (common target for redirects)
SELECT option_name, option_value 
FROM wp_options 
WHERE option_name IN ('siteurl', 'home', 'blogname', 'admin_email');

-- Check active plugins for anything suspicious
SELECT option_value FROM wp_options WHERE option_name = 'active_plugins';

Check User Meta

-- Look for capability escalation
SELECT u.user_login, m.meta_value 
FROM wp_users u 
JOIN wp_usermeta m ON u.ID = m.user_id 
WHERE m.meta_key LIKE '%capabilities%';

-- Find suspicious user meta entries
SELECT * FROM wp_usermeta 
WHERE meta_value LIKE '%eval%' 
   OR meta_value LIKE '%base64%';

Securing Your Site After Recovery

Once clean, harden your security to prevent reinfection.

# Directories should be 755
find /path/to/wordpress -type d -exec chmod 755 {} \;

# Files should be 644
find /path/to/wordpress -type f -exec chmod 644 {} \;

# wp-config.php should be 400 or 440
chmod 400 wp-config.php

Header always set X-Frame-Options "SAMEORIGIN"
Header always set X-Content-Type-Options "nosniff"
Header always set X-XSS-Protection "1; mode=block"
Header always set Referrer-Policy "strict-origin-when-cross-origin"

define('DISALLOW_FILE_EDIT', true);
define('DISALLOW_FILE_MODS', true); // Prevents plugin/theme installs too

How to Prevent Future Hacks

An ounce of prevention is worth a pound of cure. Implement these measures to avoid future hacks:

Managed Hosting vs DIY Security

Compare your options:

When to Seek Professional Help

Some situations require expert assistance:

• Ransomware: Files are encrypted and you don't have backups
• Persistent reinfection: The hack keeps coming back after cleanup
• No technical skills: You're not comfortable with the technical steps
• Legal requirements: You need documented chain of custody for compliance
• Complex infection: Multiple backdoors, database corruption, or server-level compromise
• Business critical: Site generates significant revenue and needs immediate recovery

Professional Services

Frequently Asked Questions

How do I know if my WordPress site has been hacked?

Common signs include: unexpected redirects to spam sites, strange content or links appearing on pages, Google "This site may be hacked" warnings, new admin users you didn't create, dramatically slower site speed, suspicious files in your WordPress directory, spam emails being sent from your server, and being blacklisted by security services.

Can I recover a hacked WordPress site myself?

Yes, many hacks can be cleaned yourself if you have technical skills. The process involves scanning for malware, cleaning infected files and database, updating all software, and hardening security. However, if you're not confident or the infection is severe, professional malware removal services can help. Using managed hosting with automatic malware scanning can prevent this situation entirely.

How long does it take to clean a hacked WordPress site?

A basic hack cleanup takes 2-4 hours for someone experienced. Complex infections with multiple backdoors, database injection, and file modifications can take 8-24 hours. If you restore from a clean backup, recovery can take under an hour. Professional services typically clean sites within 4-12 hours.

Will I lose my content if my WordPress site was hacked?

Usually not. Most hacks add malicious code without deleting your content. However, some destructive attacks do delete databases or files. This is why regular backups are critical. If you have a clean backup from before the hack, you can restore it and lose minimal data.

How do I prevent my WordPress site from being hacked again?

Key prevention measures include: keeping WordPress, plugins, and themes updated; using strong unique passwords with two-factor authentication; choosing secure hosting with container isolation and automatic updates; using a Web Application Firewall; implementing regular automated backups; removing unused plugins and themes; and using security monitoring to detect threats early.

How much does it cost to fix a hacked WordPress site?

DIY cleanup is free but time-consuming (2-24 hours). Professional malware removal services range from $150-500 for basic cleanup to $500-1500 for complex infections. Services like Sucuri ($199-499/year) include unlimited cleanups. Prevention through quality managed hosting ($12-50/month) is far more cost-effective than repeated cleanups.

What should I do first when I discover my site is hacked?

Immediately: 1) Change all passwords (WordPress admin, database, FTP, hosting account), 2) Enable maintenance mode to protect visitors, 3) Document what you see (take screenshots), 4) Check if you have a clean backup to restore from, 5) Scan for malware using security plugins, 6) Contact your hosting provider for help. Don't panic - most hacks are recoverable.