WordPress Site Hacked? A Step-by-Step Recovery Checklist

If your WordPress site has been hacked, do not just delete the strange files and move on. Attackers almost always leave a way back in, usually through hidden admin accounts, code snippets or file manager plugins. The recovery steps are: back up the hacked site, change every password, remove unknown admins, clean plugins and snippets, reinstall WordPress core, change the security keys and update PHP.

This checklist comes from a real cleanup our team did this month on a news website running on shared hosting in India. We found 12 administrator accounts nobody recognised, backdoor code hidden inside a code snippets plugin, and two file manager plugins that gave full access to every file on the server. Each of those had to be found and closed, or the site would have been hacked again within days.

Signs your WordPress site is hacked

• Google shows “This site may be hacked” or lists spam pages in Japanese, Chinese or pharma keywords under your domain.
• Visitors on mobile get redirected to betting, dating or fake prize sites.
• New administrator users appear that you did not create.
• Plugins you never installed show up, especially file managers.
• Your hosting company suspends the site or emails you about malware or high resource usage.

Step 1: Take a full backup of the hacked site

This sounds odd, but keep a copy of the files and database before you change anything. If something breaks during cleanup, you can go back. It also gives you a record of what the attacker added. Most hosting panels have a one-click backup option.

Also readDiwali Scams 2026: Fake UPI Refunds, OTP and Sale Link Frauds

Step 2: Change every password

Change the passwords for your hosting account, cPanel or hPanel, FTP or SFTP, the database user and your own WordPress admin login. Turn on two-factor login for the hosting account. If the attacker still has your hosting password, nothing else on this list will help.

Step 3: Remove unknown admin users

Go to Users in the WordPress dashboard and filter by Administrator. Remove or downgrade any account you do not recognise. Attackers often use names that look official, such as “wpadmin”, “support” or “developer”.

Some backdoors hide users from the user list. If the count next to Administrator does not match the names you can see, ask your developer to check the database directly.

Step 4: Clean plugins, themes and code snippets

• Delete file manager plugins unless you truly use one. They let anyone with admin access edit any file on the server.
• Delete nulled or pirated plugins and themes. “Free” copies of premium plugins are one of the most common ways malware gets in.
• Check code snippet plugins such as WPCode or Code Snippets. Look for snippets you did not write, especially ones with long scrambled text, base64, eval or remote URLs.
• Check the mu-plugins folder inside wp-content. Files there run automatically and do not show up in the normal plugin list.
• Remove plugins you no longer use. Deactivated plugins can still be attacked if they have a known flaw.

Step 5: Reinstall WordPress core and check key files

In Dashboard, go to Updates and use “Re-install version”. This replaces the core WordPress files with clean copies from wordpress.org. Then ask your developer to check three places by hand:

• wp-config.php for extra code at the top or bottom.
• .htaccess for redirect rules you did not add.
• wp-content/uploads for any .php files. The uploads folder should only hold images and documents.

Step 6: Change the security keys

The security keys (also called salts) in wp-config.php sign everyone’s login cookies. Replacing them with fresh ones logs out every user, including the attacker. You can generate a new set from the official WordPress salt generator and paste it into wp-config.php.

Step 7: Turn off the file editor

Add this line to wp-config.php:

define( 'DISALLOW_FILE_EDIT', true );

It removes the theme and plugin editor from the dashboard, which attackers use to plant code after they log in. The official WordPress hardening guide recommends this for every site.

Step 8: Update PHP and everything else

Update WordPress, all plugins and themes, then check your PHP version. The new PHP2Shell flaw lets attackers break in through PHP itself, so old versions are a real risk this month. Our guide on PHP2Shell and which PHP versions are safe explains how to check.

Step 9: Scan and ask Google to recheck

• Run a full scan with a security plugin such as Wordfence or Sucuri. On shared hosting, choose the low-resource scan option so the site does not slow down.
• Open Google Search Console, go to Security Issues, and request a review once the site is clean.
• Use the Removals tool to clear spam URLs from Google faster, and check that your sitemap only lists real pages.

How to stop it happening again

• Give admin access only to people who need it. Writers should be Authors or Editors.
• Use strong, unique passwords and two-factor login for every admin.
• Buy premium plugins only from the developer, never from “GPL club” sites.
• Keep automatic daily backups stored outside the hosting account.
• Check the admin user list once a month. It takes 30 seconds.

A hacked site can usually be fully cleaned in a day if you work through these steps in order. Skipping any one of them, especially users and snippets, is the most common reason sites get reinfected. For your personal accounts, our guide on securing your digital footprint covers the same habits.