How to Fix a Hacked WordPress Site (Step by Step)

Most of the hacked sites we clean are WordPress and WooCommerce sites that missed updates for months or used “nulled” (pirated) themes and plugins. The steps below are the order we follow. If your site takes payments and you suspect card details are being stolen, skip ahead and get professional help now — speed matters.

Signs your WordPress site has been hacked

• Visitors (often only mobile visitors, or only visitors from Google) are redirected to spam, betting or adult sites.
• Searching site:yourdomain.com on Google shows Japanese, pharma or casino pages you never created.
• Chrome shows a red “Deceptive site ahead” or “This site may harm your computer” warning.
• Admin users you don't recognise in Users → All Users.
• Your hosting company suspends the account or warns about malware or spam emails.
• New files with random names such as wp-xyz.php, or PHP files inside wp-content/uploads.
• The site becomes very slow or the CPU usage on hosting jumps.

Not sure? Run our free website scan for a first check.

First hour: limit the damage

1. Take a full backup of the hacked site (files + database). Yes, the infected one — you may need it to find out what happened or recover content.
2. Put the site in maintenance mode or restrict access so visitors are not infected or redirected.
3. Change every password: hosting / cPanel, FTP / SFTP, database, all WordPress admins, and the email linked to the admin account.
4. If you run a store, tell your payment gateway if card data may have been exposed.

Cleaning the site step by step

1. Replace WordPress core files

Download a fresh copy of the same WordPress version from wordpress.org and replace the wp-admin and wp-includes folders completely. Compare the root files (index.php, wp-load.php etc.) with the clean copy. Keep your wp-config.php, but read it line by line — attackers often hide code at the top or bottom.

2. Reinstall every plugin and theme from the official source

Delete each plugin folder and install a fresh copy from wordpress.org or the developer's official site. Delete any plugin or theme you don't use, and remove every nulled plugin or theme — they are the most common source of backdoors we find.

3. Check the uploads folder

wp-content/uploads should contain images and documents, not PHP files. Search it for .php files and delete them (after checking they aren't part of a legitimate plugin).

4. Remove rogue admins and check the database

Delete admin users you don't recognise. In the database, look for injected <script> tags or strange URLs in the wp_options table (especially siteurl, home and widget settings) and in posts. Spam-page hacks often create thousands of posts or pages — remove them.

5. Look for backdoors outside WordPress

Check the .htaccess files for redirect rules you didn't add, look for unknown cron jobs in your hosting panel, and check other websites on the same hosting account — one infected site can re-infect the others.

6. Scan again

Run a security scanner plugin and an external scan. Search the files for typical malware patterns such as eval(base64_decode(, gzinflate( or long random strings. Repeat until the site is clean.

Removing Google warnings and spam pages

1. Open Google Search Console → Security & Manual actions → Security issues. If an issue is listed, fix it and click Request review, explaining what you cleaned.
2. Spam URLs that now return 404 or 410 drop out of Google over the next few weeks. For urgent cases use the Removals tool.
3. Resubmit your sitemap so Google re-crawls the real pages.
4. If your emails are going to spam because the server sent junk mail, check your domain is not on email blacklists.

How to stop it happening again

• Update WordPress, plugins and themes every month (or let a care plan do it with a backup first).
• Never use nulled themes or plugins. The saving is never worth it.
• Strong unique passwords + two-factor login for every admin.
• Daily off-site backups you have actually tested restoring.
• Limit admin accounts — give editors the Editor role, not Administrator.
• Good hosting with up-to-date PHP and account isolation.
• Monitoring so you find out about downtime or malware before your customers or Google do.

When to get professional help

Call in help if the site takes payments, the hack came back after you cleaned it, Google has blacklisted the site, or the host has suspended your account. We clean hacked WordPress, WooCommerce and Magento sites — usually the same or next working day. WordPress / WooCommerce cleanup starts at ₹4,999 and Magento card-skimmer removal at ₹9,999, with a report of what we found and how the attacker got in.

Questions people ask

Written by Mayank Rana

Founder of Megasoft Intellectual Solutions, Mohali. Building and fixing WordPress, WooCommerce, Shopify and Magento 2 sites since 2016 — 800+ projects for businesses in India and 15+ countries. More about Mayank