How to Recover Hacked WordPress Site: 7 Proven Steps (Ultimate 2026 Guide)

Discovering that your website has been compromised is every webmaster’s worst nightmare. If your site is redirecting visitors to spam pages, showing Japanese keywords in Google search results, or throwing security warnings, learning how to recover hacked WordPress site immediately is critical to protect your brand reputation, search engine rankings, and customer trust.

In this comprehensive, battle-tested tutorial, the cybersecurity team at AMSIT breaks down the exact seven-step protocol we use to neutralize malware, clean infected files, flush rogue database users, and restore normal operations without losing crucial data.

Common Symptoms of a Compromised WordPress Site

Hackers rarely announce their presence. Modern website attacks are designed to stay stealthy, monetizing your traffic behind the scenes. Recognizing the early red flags is the first step when determining how to recover hacked WordPress site effectively.

• Google Search Console Alerts: Receiving notifications regarding “Deceptive pages ahead”, “Harmful downloads”, or “Japanese Keyword Hack” indexing spikes. For complete details on warning flags, review the Google Search Central Security Guidelines.
• Unexplained URL Redirects: Visitors coming from mobile devices or search engines get redirected to scam landing pages, gambling portals, or fake tech support sites.
• Rogue Administrator Accounts: Mysterious usernames appearing under Users > All Users with administrator privileges that nobody on your team created.
• High Server CPU & Memory Spikes: Background mining scripts, automated mail relay spammers, or brute-force bots overwhelming your hosting server resources.
• Blacklisted by Email Providers: Outgoing notifications landing in junk folders due to your server IP being flagged by Spamhaus or MXToolbox.

Why Fast WordPress Malware Removal Matters

Every hour your site remains infected costs you organic impressions and client confidence. Google aggressively de-indexes URLs that distribute malware or spam links. If an infection lingers, your domain authority can plunge by over 80% within days.

Beyond search rankings, compromised e-commerce sites violate compliance regulations. If you manage an online store, client credit card data or personal customer records could be exposed. Knowing how to recover hacked WordPress site cleanly prevents devastating financial penalties and permanent blacklisting.

Step 1: Quarantine the Site and Enable Maintenance Mode

Before modifying any code, stop active attacks and prevent visitors from landing on malicious scripts. Place your site in offline maintenance mode immediately.

You can achieve this by adding a temporary 503 Service Unavailable header in your root .htaccess file or activating a maintenance splash page. This tells search engine crawlers that your site is undergoing temporary maintenance so your SEO rankings are preserved while you investigate.

Change your cPanel, hosting control panel, SFTP, and MySQL database passwords immediately. If an attacker stole your FTP credentials, updating these passwords cuts off their real-time pipeline.

Step 2: Create a Forensic Backup (Files and Database)

It might seem counterintuitive to back up infected files, but having a full snapshot is crucial before executing how to recover hacked WordPress site procedures. If a cleanup script accidentally deletes a customized theme file or breaks an active WooCommerce table, you must have a restore point.

Connect to your server via SFTP or cPanel File Manager and compress your entire public_html directory into an archive. Next, export your complete database using phpMyAdmin. Store this archive locally in an isolated folder for forensic review.

Step 3: Replace Core WordPress Files with Fresh Copies

Malware injection scripts frequently alter core files such as index.php, wp-blog-header.php, and files within wp-includes/ and wp-admin/. Rather than trying to manually locate obfuscated PHP strings, replacing the core files entirely is the safest approach.

1. Download a pristine, authentic copy of WordPress directly from the official repository at WordPress.org Documentation.
2. Extract the zip archive on your local computer.
3. Delete the wp-content folder from your newly downloaded local copy (to prevent overwriting your real content).
4. Using SFTP, delete the remote wp-admin and wp-includes directories on your server.
5. Upload the fresh wp-admin, wp-includes, and root PHP files (excluding wp-config.php) to your server.

This single maneuver wipes out hundreds of backdoors that hide inside standard core WordPress directories.

Step 4: Audit wp-config.php and Regenerate Security Salt Keys

The wp-config.php file is the crown jewel of your WordPress installation. Inspect it line by line to verify there are no unauthorized PHP declarations or suspicious base64 strings prepended before <?php.

Next, invalidate all current user sessions, cookies, and active login tokens by regenerating your WordPress Security Keys (Salts). Visit the official WordPress salt generator API (https://api.wordpress.org/secret-key/1.1/salt/), copy the newly generated 8 unique keys, and overwrite the existing definitions in wp-config.php:

define('AUTH_KEY',         'put-your-unique-phrase-here');
define('SECURE_AUTH_KEY',  'put-your-unique-phrase-here');
define('LOGGED_IN_KEY',    'put-your-unique-phrase-here');
define('NONCE_KEY',        'put-your-unique-phrase-here');
define('AUTH_SALT',        'put-your-unique-phrase-here');
define('SECURE_AUTH_SALT', 'put-your-unique-phrase-here');
define('LOGGED_IN_SALT',   'put-your-unique-phrase-here');
define('NONCE_SALT',       'put-your-unique-phrase-here');

Replacing these keys immediately kicks out any logged-in malicious sessions, forcing everyone to re-authenticate with fresh credentials.

Step 5: Clean Themes, Plugins, and uploads Directory

Because the wp-content directory houses your unique media and styling, hackers frequently inject persistent PHP backdoors here. Follow this strict checklist to clean hacked WordPress site assets:

• Plugins Directory: Delete all existing plugin folders in wp-content/plugins/ and reinstall verified copies directly from the official WordPress directory. Never use nulled or pirated themes or plugins, as they almost always contain hardcoded backdoors.
• Themes Directory: Inspect your active theme files. Check functions.php and header.php for functions like eval(), base64_decode(), or gzinflate(). If possible, re-download the original theme from the developer.
• Uploads Directory: The wp-content/uploads/ folder should contain only images, PDFs, and media files. There should never be a .php, .ico file containing PHP code, or .htaccess file inside uploads. Run a search for all *.php files inside uploads and purge them instantly.

Step 6: Audit MySQL Database and Remove Rogue Admins

Attackers often inject backdoor administrator accounts directly into the database. To audit your database:

1. Open phpMyAdmin and select your WordPress database.
2. Open the wp_users table. Review every registered user. If you see unfamiliar emails or randomly generated strings, delete them.
3. Check the wp_usermeta table for wp_user_level 10 or administrator capabilities tied to illegitimate user IDs.
4. Search the wp_posts and wp_options tables for spam scripts using SQL queries like SELECT * FROM wp_posts WHERE post_content LIKE '%<script%'.

If managing manual SQL queries feels overwhelming, our technical engineers at AMSIT WordPress Services provide rapid emergency malware cleanup and database sanitation.

Step 7: Inspect DNS Records and Wildcard Subdomains

A recent, highly pervasive attack vector is the Wildcard Subdomain Hijack. In this scenario, hackers gain access to your DNS records (via Cloudflare, cPanel, or your domain registrar) and create a wildcard record (*) pointing to an offshore rogue server.

This allows attackers to generate thousands of fake Japanese spam subdomains (such as notifier.yourdomain.com or m.yourdomain.com) without touching a single file on your hosting server! When understanding how to recover hacked WordPress site threats completely, you must check your DNS zone files:

• Log into Cloudflare or your DNS dashboard.
• Look for any wildcard A, AAAA, or CNAME records pointing to unrecognized IP addresses.
• Delete all rogue DNS records immediately and flush your DNS cache.
• Submit URL removal requests in Google Search Console to de-index the phantom spam pages.

Post-Recovery Hardening Checklist for 2026

Once you have neutralized the immediate threat, take proactive measures to guarantee that the vulnerability cannot be exploited again:

1. Enforce Two-Factor Authentication (2FA): Require 2FA on all administrator and editor accounts.
2. Implement an Enterprise Web Application Firewall (WAF): Use Cloudflare or Wordfence to filter malicious bots before they touch your server.
3. Disable PHP Execution in Uploads: Add a security rule inside wp-content/uploads/.htaccess to prevent any uploaded PHP scripts from executing.
4. Keep Core, Plugins, and Themes Updated: Enable automatic updates for security patches. Over 90% of WordPress vulnerabilities originate from outdated plugins.
5. Schedule Automated Off-Site Backups: Maintain daily off-site snapshots stored on Amazon S3 or Google Cloud.

For custom web applications or specialized business websites, consider partnering with an experienced professional web development agency to construct secure architectures from the ground up.

Frequently Asked Questions (FAQ)