My WordPress Site Is Hacked: A Triage Plan

The most common mistake is restoring from backup immediately. It reverts the visible damage and reinstalls the vulnerability that let them in, so the site is compromised again within days — often before anyone notices the first fix did not hold.

Restoring is part of the answer. It is never the first step and never the whole one.

Work in this order.

---

Step 1 — Contain it

Before diagnosing anything, stop the damage continuing.

Take the site offline if it is serving malware, redirecting visitors, or sending spam. Maintenance mode at server level, or a holding page. Losing a day of traffic costs less than a week on a blocklist.

Change every password, from a device you trust: WordPress administrators, hosting control panel, FTP and SFTP, database, and any connected service with API access.

Do not do this from a machine you suspect. If the compromise came through a stolen credential, the credential may have been stolen from your computer.

Tell your host. Many will scan, and some will tell you what they already logged. They also need to know if their infrastructure is affected.

---

Step 2 — Check your email deliverability immediately

This is the step every other guide omits, and it is time-sensitive.

Compromised WordPress sites are commonly used to send spam. A working web server with mail capability is exactly what a spammer wants, and it is often the whole reason for the compromise.

The consequence lands on infrastructure most people do not check during a hack: your domain gets listed on a blocklist, and your order confirmations, password resets and customer email stop being delivered.

Do this now:

• Check your blocklist status. A listing found today is an inconvenience; found in three weeks when customers complain, it is a recovery project
• Check your host's mail logs or control panel for outbound volume you did not send
• Check Google Postmaster Tools if you use the domain for marketing email

Do not request delisting yet. Operators check, and a delisting granted while the site is still compromised is followed by a faster relisting that takes much longer to clear. Clean first. The removal process.

Cleaning the site does not clear a blocklist listing. They are separate problems and the reputation damage outlasts the compromise.

---

Step 3 — Find the entry point

Everything else depends on this. Clean without finding it and you clean the same site again next week.

Where to look, in order:

1. Plugin and theme versions. Compare what you have installed against known vulnerabilities. Your security plugin may report this directly; the WPScan vulnerability database is the reference. An outdated plugin with a published vulnerability is the answer far more often than anything else.

2. User accounts. Users → All Users, sorted by registration date. An administrator you do not recognise is both a symptom and possibly the route.

3. File modification times. List files by modification date over FTP or SSH. Files changed at times you were not working are the attacker's. Pay attention to wp-content/uploads — PHP files should never exist there, and their presence is close to conclusive.

4. Server access logs. Your host's raw logs show requests preceding the first modified file. This is the definitive record and the least pleasant to read.

5. Scheduled tasks. WP Crontrol lists what is scheduled. Attackers add tasks to re-establish access after a clean.

If you cannot find the entry point, assume it is an outdated plugin, and treat the clean as incomplete until proven otherwise by the site staying clean.

---

Step 4 — Decide: clean or rebuild

Two viable approaches, and the choice depends on what you can verify.

Clean in place

Appropriate when you found the entry point, the compromise looks contained, and you have a known-good backup to compare against.

1. Replace core — download a fresh copy from wordpress.org and replace everything except wp-content and wp-config.php
2. Replace every plugin and theme with fresh downloads. Do not clean plugin files by hand; replace them
3. Inspect wp-content/uploads for PHP files and remove them. There is no legitimate reason for one to be there
4. Check wp-config.php line by line against a default, looking for injected code
5. Check .htaccess files throughout the site, including in subdirectories
6. Scan the database for injected scripts, particularly in wp_options, wp_posts and wp_users
7. Remove unknown administrator accounts
8. Delete scheduled tasks you did not create

Rebuild clean

Appropriate when you cannot find the entry point, the compromise is extensive, or the site has been compromised before.

1. New hosting environment, or a fully wiped one
2. Fresh WordPress install
3. Fresh plugins from source, installing only what you actually use
4. Import content from the database, after inspecting it
5. Copy uploads selectively, checking for PHP files
6. Never copy the old wp-config.php or .htaccess

Rebuilding is slower and more certain. On a site that matters, or a second compromise, it is the right call.

---

Step 5 — Verify the clean

Do not skip this and do not trust a single scan.

• Scan with a security plugin, then scan again after 48 hours
• Check file modification times again — anything changing without your action means it is still live
• Test from a clean device and network, since some compromises target only certain visitors
• Check what Google sees. Use site:yourdomain.com and look for pages you never published
• Search your own database for common injection patterns — base64_decode, eval(, script tags in option values

Watch for a week before declaring it clean. Re-infection usually shows within days.

---

Step 6 — Get delisted

Two separate delisting processes, and both require the clean to be real.

Google Search Console. Under Security & Manual Actions, if your site was flagged, request a review once cleaned. Reviews typically take a few days. A failed review costs time, so verify thoroughly first.

Email blocklists. Separate from Google entirely. Check each list your domain appears on and follow its removal process. Fix the cause first — operators check, and a relisting after a granted delisting takes substantially longer to clear. The removal process.

---

Step 7 — Close it properly

A cleaned site with the original weakness is a site waiting to be compromised again.

• Update everything, and remove anything abandoned
• Two-factor authentication on every administrator
• New passwords everywhere, unique, from a password manager
• Reduce administrator accounts to the minimum
• Add DISALLOW_FILE_EDIT to wp-config.php
• Set up file integrity monitoring, so the next change is noticed in hours
• Fix your backup strategy, including testing a restore

---

Why restoring from backup is not enough

Restoring reverts files and database to a point before the visible damage. It does not remove the vulnerability that allowed the compromise.

Three specific failures:

The vulnerability is restored too. The outdated plugin comes back at the same version.

The backup may already be compromised. If the intrusion predates your discovery — and it usually does — a backup from last week may contain the backdoor.

It reverts your content. Everything published since the backup is gone, and on a busy site that is the visible cost people notice while the invisible one persists.

Where restoring genuinely helps: as a comparison point for identifying modified files, and as a source of clean content to import into a rebuilt site.

---

Frequently asked questions

Should I restore from backup or clean it?
Neither alone. Restoring reverts visible damage and reinstalls the vulnerability, and the backup may already contain the backdoor. Find the entry point first, then either clean in place with fresh core and plugin files, or rebuild in a clean environment and import content selectively.

How do I get delisted by Google?
In Search Console under Security & Manual Actions, request a review once the site is genuinely clean. Reviews take a few days and a failed one costs more time, so verify thoroughly first. Email blocklists are a separate process entirely.

How did they get in?
Most often an outdated plugin or theme with a published vulnerability, which automated scanners work through systematically. Check installed versions against the WPScan database, look for administrator accounts you do not recognise, and check file modification times and server logs.

Can a hack affect my email?
Frequently, and it is the consequence most people discover late. Compromised sites are used to send spam, which lands the domain on blocklists — after which your transactional email stops arriving. Check your blocklist status during triage rather than weeks later.

How long does it take to clean a hacked WordPress site?
A few hours for a contained compromise where the entry point is clear. A day or more for a rebuild. Verification adds a week of watching, because re-infection usually shows within days.

Why do PHP files in the uploads folder matter?
There is no legitimate reason for one to be there — uploads holds media. A PHP file in that directory is close to conclusive evidence of a compromise, and it is usually a backdoor placed to survive a clean.