My WordPress Site Was Hacked: The Exact Cleanup Process We Use

9 August 2026 · 4 min read · by Osama Jamal

You searched your own business name and found Japanese characters in the results. Or visitors say the site redirects them to something you have never heard of. Or your host suspended the account. The site has been compromised.

The instinct is to delete everything and start again. Do not. A clean recovery follows a specific order, and skipping steps is why so many sites get reinfected within a fortnight. This is the process we use on cleanup jobs.

First, contain it

Before investigating anything, stop the damage spreading.

• Take a full backup of files and database now, infected as it is. You need this as forensic evidence and as a fallback if the cleanup goes wrong. Label it clearly as infected so nobody restores it by accident later.
• Put the site into maintenance mode if you can, or ask your host to take it offline temporarily. A compromised site actively harms your visitors and your search reputation for as long as it is live.
• Change the hosting account password, the database password, all FTP and SFTP credentials, and every WordPress admin password. Do this before cleaning, not after, or the attacker simply walks back in through the same door.

Work out how they got in

Cleaning without finding the entry point means you will be doing this again next month. In practice it is nearly always one of four things:

• An outdated plugin or theme with a known vulnerability. By far the most common. Check your plugin list against a public vulnerability database and look hard at anything that has not been updated by its developer in over a year.
• A nulled or pirated premium plugin or theme. Many of these ship with a backdoor deliberately included. If the site has any, that is your answer.
• A weak or reused admin password, or an admin account with a guessable username and no rate limiting on login attempts.
• A compromise elsewhere on the same server. On cheap shared hosting, another infected site in a neighbouring account can sometimes reach yours.

Your host’s access logs will usually show the request that did it. Look for POST requests to unusual file paths around the date the problems started.

Find the malicious code

Malware in WordPress tends to hide in predictable places:

• New PHP files in /wp-content/uploads/. Nothing executable should ever live there. This alone catches a large share of infections.
• Modified core files. Compare wp-admin and wp-includes against a fresh download of the same WordPress version. Anything that differs is suspect.
• Injected code at the very top or very bottom of functions.php, index.php and wp-config.php, often on one enormously long line so it scrolls out of view.
• Obfuscated payloads using base64_decode, eval, gzinflate or str_rot13. Legitimate plugins occasionally use these, so investigate rather than delete blindly.
• Unexpected administrator accounts. Check the users table directly, because some malware hides accounts from the wp-admin user list.
• Scheduled tasks that reinstall the payload. Check the cron entries; a cleanup that leaves these behind reinfects itself within hours.
• .htaccess rules redirecting mobile visitors or search engine traffic only, which is why the site often looks fine to you and broken to everyone else.

Clean it properly

The safest sequence, in this order:

1. Replace WordPress core entirely. Delete wp-admin and wp-includes and upload fresh copies of the same version. Never touch wp-content or wp-config.php during this step.
2. Reinstall every plugin and theme from the official source rather than trying to clean them. Delete anything you do not actively use. Anything nulled goes permanently.
3. Clean wp-content/uploads by removing every PHP file. Media files themselves are almost always fine.
4. Clean the database. Check the options table for injected scripts, and the posts table for injected links, which are often hidden with inline CSS.
5. Delete unrecognised admin users and force a password reset for every remaining account.
6. Rotate the security keys and salts in wp-config.php using the official generator. This invalidates every existing login session, including the attacker’s.

Get back into Google’s good books

If the site was flagged, cleaning it is only half the job. In Google Search Console, open the Security Issues report and request a review once you are confident it is clean. Do the same in Bing Webmaster Tools. Then check whether your domain has been added to any browser blocklist and request removal.

A review can take several days. Requesting one before the site is genuinely clean resets that clock, so verify first.

Harden it so it does not happen again

• Keep core, plugins and themes updated, and remove anything unused.
• Enable two-factor authentication on all admin accounts.
• Limit login attempts and move or protect the login URL.
• Disable file editing in wp-admin with define( 'DISALLOW_FILE_EDIT', true ); in wp-config.php.
• Set file permissions correctly, typically 644 for files and 755 for directories.
• Run a security plugin with file integrity monitoring so you are told about changes rather than finding out from a customer.
• Keep automated off-site backups with a retention window long enough to predate an infection you might not notice for weeks.

One caveat worth stating plainly: if the site handles payments or stores customer data, a compromise may carry legal notification obligations depending on your jurisdiction. That is worth checking rather than assuming.

If any part of this is beyond where you are comfortable, that is a completely reasonable place to stop. Hack recovery and malware cleanup is one of the things we do, including finding the entry point rather than just wiping the symptoms.

Frequently asked questions

How do I know if my WordPress site is hacked?

Common signs include unfamiliar text or Japanese characters in your Google search listings, visitors being redirected to unrelated sites, admin accounts you did not create, new PHP files in the uploads folder, a sudden traffic drop, or a warning from your host or browser. A file integrity scan will confirm it.

Can I just restore a backup instead of cleaning the site?

Only if you are certain the backup predates the infection, which is often weeks earlier than people assume. Restoring also loses everything published since. Even after a clean restore you still need to find and close the entry point, or the same vulnerability will be exploited again.

What is the Japanese keyword hack?

It is a spam infection that injects Japanese-language pages into a site and shows them to search engines while ordinary visitors see the normal site. It usually gets in through an outdated plugin, creates its own admin account, and adds a sitemap so the spam pages get indexed quickly.

How long does WordPress malware removal take?

A straightforward infection is typically a few hours of work. Sites with heavily obfuscated malware, database-level injections, or several months of undetected activity take considerably longer. Getting a Google security flag lifted afterwards can add several days on top, and that part is out of anyone's control.

Will a security plugin remove malware on its own?

A good security plugin will detect changed files and block further attacks, and some will clean known infections. It will not reliably find the entry point or clean database-level injections, and it cannot undo a compromise that predates its installation. Treat it as monitoring and prevention rather than a cure.

Keep reading

4 min readHow to Choose a Web Developer in Multan: 7 Questions That Matter4 min readWebsite Development Cost in Multan: Real 2026 Prices in PKR3 min readElementor vs Gutenberg in 2026: Which Should You Actually Build With?