Getting hacked can be scary. You wake up, visit your site, and suddenly it’s redirecting, showing malware warnings, or even offline.
But here’s the good news:
You can clean your hacked WordPress site without losing important data like posts, pages, or customer orders.
Follow this safe recovery guide — or let our team clean it up for you.
🚨 Signs Your WordPress Site Is Hacked
- Website redirecting to strange URLs
- Unknown admin users added
- Spammy popups or links
- Google blacklist warning
- Files or folders you didn’t create
- Hosting company emails about malware
🔗 Not sure? Get a Free Malware Scan from WPS247
🔧 Step-by-Step: How to Clean a Hacked WordPress Site
✅ 1. Backup Your Site Immediately
Even if it’s infected, take a full backup before making changes. Use your hosting panel or a plugin like UpdraftPlus.
🛠 Tip: Save a copy of your database and files separately in case you need to restore them manually.
✅ 2. Enable Maintenance Mode
Install a plugin like WP Maintenance Mode to hide your site from users while you clean it. This prevents damage to your SEO or brand.
✅ 3. Scan Your Site for Malware
Use one or more of these tools:
- Wordfence Security
- Sucuri Scanner (Free)
- WPS247’s Malware Removal Tool
Look for:
- Unknown PHP files
- Suspicious admin users
- Modified core files
✅ 4. Remove Suspicious Files & Code
Manually or with a plugin, delete:
- Unrecognized themes or plugins
- Modified files (e.g.
functions.phporwp-config.php) - Strange files in
/wp-content/uploads/or root folder
🛡 Warning: Don’t delete your database unless you’re 100% sure. This holds your content.
✅ 5. Replace WordPress Core Files
Download a fresh copy of WordPress from wordpress.org and upload it via FTP, replacing only the wp-admin and wp-includes folders.
This resets core files without affecting your data.
✅ 6. Reset Passwords and Check Admin Users
- Reset passwords for all users
- Delete unauthorized admin accounts
- Use strong passwords & 2FA if possible
✅ 7. Update Everything
Outdated plugins and themes are the top reason WordPress sites get hacked.
- Update WordPress core
- Update all plugins and themes
- Remove unused or nulled plugins
✅ 8. Submit Site to Google for Review (If Blacklisted)
Once cleaned, protect your site going forward:
- Install a firewall (Wordfence, Sucuri)
- Set up daily malware scans
- Enable login protection
🔗 Or use our WordPress Security & Maintenance Plans — we monitor and secure your site 24/7.
🚀 Want Us to Clean It for You?
We’ve cleaned hundreds of hacked WordPress sites — often within 2 hours.
👉 Request Expert Malware Removal Now
Or Get a Free Security Audit
📢 Final Thoughts
Getting hacked doesn’t have to mean starting over. With the right steps — and quick action — you can clean your site, keep your data, and secure it against future attacks.
Need help? The WPS247 team is here 24/7.
