A site that gets hacked once is unlucky. A site that gets hacked again a week after the cleanup has a specific, findable problem. In our experience, repeat infections come down to four causes, and each one leaves evidence.
1. A backdoor was left behind
The visible malware gets deleted, but the attacker's way back in stays. Backdoors are small PHP files or a few lines added to a legitimate file, and they are designed not to look like malware.
Where they hide: wp-content/uploads (any .php file there is suspect), wp-content/mu-plugins, fake plugin folders, wp-config.php, and theme files such as functions.php. Also check the database for scheduled tasks (cron events) that re-create files.
The fix: don't clean infected files line by line. Reinstall WordPress core, plugins, and themes from official sources, and remove every PHP file from uploads.
2. The original vulnerability is still there
If the attacker came in through an outdated or abandoned plugin, they will come in through it again. Many automated attacks scan for one specific plugin version across millions of sites, so the same site gets hit repeatedly.
The fix: find the entry point in your access logs (look for POST requests to plugin files around the time of the first malicious file), then update or remove that plugin. Delete every plugin you don't actively use; deactivated plugins can still be exploited if their files are reachable.
3. Credentials were never changed
If a password was stolen, from a reused password, a phishing email, or malware on someone's computer, cleaning the site changes nothing. The attacker logs in like a normal user.
The fix: rotate everything: WordPress users, the database password, hosting and SFTP access, the security keys and salts in wp-config.php, and API keys stored in plugins. Then turn on two-factor authentication for anyone who can publish or install plugins.
4. A neighbouring site is infected
On shared hosting accounts with several sites, one infected site can write to the others. You clean site A, and site B reinfects it overnight.
The fix: check and clean every site on the same hosting account at the same time, and remove old test or staging installs nobody maintains.
How to stop the cycle
- Clean completely and in order: forensic copy, replace files, clean the database, rotate credentials.
- Find the entry point, and write down which of the four causes it was.
- Harden the configuration: remove unused plugins, disable the built-in file editor, rate-limit logins, disable XML-RPC if nothing uses it, and set correct file permissions.
- Monitor: file-integrity monitoring and login alerts tell you about the next attempt before Google does.
Our free WordPress hardening checklist covers step 3 in detail, with a read-only audit script you can run on your own server. If your site has been reinfected and you want the cycle broken properly, our WordPress malware removal service finds the entry point and closes it, and WordPress hardening keeps it closed.