Can I fix a hacked WordPress site myself?

Often, yes, if you have hosting or SFTP access, a recent understanding of WordPress files, and time to check the database as well as the files. The hard part is not deleting the obvious malware but finding every backdoor and the hole the attacker used. If the site keeps getting reinfected, something was missed.

Will a security plugin remove the hack?

A scanner plugin helps you find known malware, but it runs inside the WordPress install that was compromised, it can't see everything in the database, and it won't tell you how the attacker got in. Use it as one input, not as the cleanup.

Should I restore a backup instead?

Only a backup from before the compromise, and even then the vulnerable plugin, theme, or stolen password that let the attacker in is still there. Restore, then do steps 4 to 7 of this guide anyway.

How long does Google take to remove the 'This site may be hacked' warning?

After you request a review in Google Search Console, Google decides. Reviews for malware usually take days; reviews for hacked spam can take a few weeks.

How to Fix a Hacked WordPress Site (Step by Step)

If your WordPress site is redirecting visitors to scam pages, showing spam in Google results, or has been suspended by your host, it has almost certainly been hacked. The good news: a hacked WordPress site can nearly always be cleaned without losing your posts, pages, or orders. The work is methodical, and the order matters.

This guide walks through the same sequence we use on real incidents: contain, preserve, find the entry point, clean, rotate credentials, close the hole, and recover your reputation with Google.

Step 1: Contain the damage

Before you investigate, stop the site from hurting visitors and your reputation further.

Put the site in maintenance mode or password-protect it at the server level if it is redirecting visitors or serving malware. A static "back soon" page is fine.
Lock out the attacker's accounts. In Users, look for administrators you don't recognize. Don't delete them yet, because they are evidence; change their role to Subscriber and reset their passwords.
Tell your host. If they have already suspended the account, ask what they detected and request access to the files and logs so you can clean it.

Step 2: Take a copy before you change anything

Download a full copy of the files and export the database exactly as they are now. This is your forensic copy. If a cleanup step goes wrong, you can go back, and you will want to compare files later. Store it offline, not on the same server.

Step 3: Find out what the attacker changed

Most WordPress infections fall into a few patterns. Knowing which one you have tells you where to look.

Redirect hacks: injected JavaScript in theme files, the wp_options table (often siteurl, home, or widget content), or the .htaccess file. Redirects often trigger only for mobile visitors or people arriving from Google, so test in a private window from a search result.
SEO spam (the "Japanese keyword hack" and pharma spam): thousands of generated pages under your domain. Check Google with site:yourdomain.com and look for pages you never wrote.
Backdoors and web shells: PHP files that let the attacker run commands. Common hiding places are wp-content/uploads/ (which should never contain PHP), wp-content/mu-plugins/, fake plugin folders, and files named to look like core files.
Rogue users and scheduled tasks: extra administrator accounts and cron events that re-create the malware after you delete it.

Useful checks if you have WP-CLI on the server:

wp core verify-checksums compares WordPress core files against the official release and lists anything modified or added.
wp plugin verify-checksums --all does the same for plugins from the official directory.
wp user list --role=administrator shows every admin account.
wp cron event list shows scheduled tasks; look for hooks you don't recognize.

Without WP-CLI, compare file modification dates and look for recently changed PHP files, especially in uploads.

Step 4: Replace, don't repair

Don't try to clean infected core, plugin, or theme files line by line. Replace them.

Reinstall WordPress core from wordpress.org (keep wp-config.php and wp-content).
Reinstall every plugin and theme from its official source. Delete any plugin you don't actively use; deleted code can't be exploited.
Clean what can't be replaced: wp-config.php, .htaccess, the uploads folder (remove any .php file there), and your custom theme if you have one. Compare against your forensic copy and a known-good version.
Clean the database: search posts, options, and widgets for <script, eval(, base64_decode, and unfamiliar URLs. Remove spam posts the attacker created.

Step 5: Rotate every credential

Assume every password the site knows about is stolen.

All WordPress user passwords, starting with administrators
The database password (then update wp-config.php)
Hosting control panel, SFTP, and SSH passwords or keys
The WordPress security keys and salts in wp-config.php (generate new ones at api.wordpress.org/secret-key/1.1/salt/), which logs everyone out
API keys stored in plugins (payment, email, backups)

Step 6: Close the hole they came in through

A cleanup without this step is temporary. The three most common entry points are:

A vulnerable plugin or theme, usually one that was out of date or abandoned by its developer
Stolen or guessed admin credentials, often from password reuse or a compromised computer
Another site on the same hosting account, where one infected site spreads to its neighbours

Your hosting access logs usually show the first malicious request. Look for POST requests to plugin files or to xmlrpc.php and wp-login.php around the time the first malicious file was created. Then update or remove that component, turn on two-factor login for every account that can publish, and check the other sites on the account.

Step 7: Clear Google and blocklist warnings

Once the site is clean:

In Google Search Console, open Security Issues, confirm you've fixed them, and request a review.
Check the site on blocklists your visitors' browsers and antivirus use, and request removal where it's listed.
Remove the spam URLs from Google's index: let them return 404 or 410, and use the Removals tool for urgent cases.
If your host suspended the account, send them a short summary of what you removed and how you closed the entry point.

Step 8: Watch it for 30 days

Reinfection usually happens within days if something was missed. For the next month, check for new admin users, new PHP files in uploads, and changes to core files, and keep an eye on Search Console. Then harden the site so the next attempt fails.

When to get help

If the site was reinfected after a cleanup, if you can't find the entry point, or if it's a store handling payments or customer data, it's worth bringing in someone who does this every week. We handle WordPress malware removal end to end, including the incident report and the Google review, and follow it with WordPress hardening so it stays clean. If you'd rather do it yourself, our free WordPress hardening checklist covers what to lock down after the cleanup.

How to Fix a Hacked WordPress Site: A Step-by-Step Cleanup Guide