WordPress repair · Security

WordPress Site Hacked? How Malware Removal Actually Works

A hacked WordPress site is rarely one bad file. It is a break-in with a key left under the mat, and a cleanup that deletes what you can see while leaving the way in open is why so many sites get hacked twice in the same month.

Check my site for malware Why it happens

wp-admin · security scan

File and account integrity

Three ways back in, still open

Infected

FailUnknown admin userwp_sysadmin
FailModified core files14 files
FailPHP in uploads folder3 files
WarnGoogle Safe BrowsingFlagged
WarnPlugins with known flaws2 of 27
PassSSL certificateValid

Illustrative — the first cleanup removed the spam, not the backdoorreinfection likely

How a hacked WordPress site gives itself away

Visitors from Google land on a pharmacy, casino or prize page
Browsers show a full-page red warning before your site loads
Google lists pages under your domain that you never wrote
An administrator account you cannot put a name to
Your host suspended the account or sent a malware notice
The site looks fine to you, but customers say it sent them elsewhere

How the attacker got in, most likely first

Most common first, each with a way to check it yourself.

1
An outdated plugin with a published flaw
Most WordPress infections arrive through a plugin or theme with a known vulnerability. Once a flaw is disclosed, bots sweep the web for sites that have not updated, usually within days. Nobody picked your site. It simply answered the knock.
Check it: Open Dashboard, Updates and count the plugins waiting. Any plugin its author has not touched in over a year belongs on the suspect list too.
2
A stolen or reused password
An admin, SFTP or hosting login that was also used on a service that got breached. Bots feed leaked email and password pairs into wp-login.php around the clock, and a reused password eventually works.
Check it: Go through Users and ask who each administrator is. Then ask each of them whether that password lives anywhere else.
3
A nulled theme or plugin
A premium plugin downloaded free from a sharing site often ships with a backdoor already inside. The saving was the price of admission, and the attacker collects it later.
Check it: If a premium plugin or theme was never paid for, or its license screen says unregistered, treat it as infected until proven otherwise.
4
A neighbor on the same hosting account
Five old sites in one hosting account share one set of file permissions. A forgotten test install in a subfolder gets infected and spreads to the live site next door, and cleaning only the live site leaves the source untouched.
Check it: Open the file manager in your hosting panel and list every folder at the top level. Old staging copies and abandoned sites count.
5
Loose permissions and exposed files
Writable core files, a copy of wp-config.php left in public view, directory listing switched on, an old installer or database tool sitting in the root. Each one hands an attacker a map or a door.
Check it: Visit yourdomain.com/wp-content/uploads/ in a browser. If you see a plain list of folders and files, directory listing is on.
6
A previous cleanup that missed the backdoor
Reinfection within days usually means the malware was removed and the backdoor was not. Attackers leave several ways back: PHP files hidden among images, a quiet admin account, a line in the database, a must-use plugin that never appears on the Plugins screen.
Check it: If this is the second infection, the first cleanup is the leading suspect, not a new attacker.

Do this today

Log in, open Users, filter by Administrator and write down every name. Any account you cannot match to a real person is a red flag. Note it rather than deleting it, change your own password from a computer you trust, and keep the list for whoever cleans the site.

How a proper cleanup runs, in order

1
Contain and preserve
We take a full copy of files and database before touching anything, then block the redirects so visitors stop being sent to spam. The copy is evidence. It shows how they got in and what they changed.
2
Find the way in
Server access logs, file modification dates and the installed plugins checked against published vulnerability records. The entry point decides whether the cleanup holds.
3
Clean from known-good sources
Core files replaced from a fresh WordPress download, plugins reinstalled from their official source, the database searched for injected scripts and spam posts, and every file in uploads that should not be code removed.
4
Close, rotate and request review
The vulnerable component updated or removed, every password and the security keys in wp-config.php reset, then a review requested in Google Search Console and the warning watched until it lifts.

What removal covers beyond deleting files

A full backdoor hunt

Rogue admins, must-use plugins, scheduled tasks, PHP hiding in image folders and code tucked into the options table. The site is clean only when every one of them is gone.

Reputation cleanup

Spam pages removed and returned as gone, the Search Console security issue cleared, blocklists checked, and the host's suspension lifted with a written account of what was removed.

Hardening that fits the site

File editing turned off inside the dashboard, two-factor login for every administrator, a web application firewall, correct file permissions and PHP execution blocked in the uploads folder.

Monitoring that notices

File-change alerts, uptime and blocklist checks, and off-site backups kept long enough to reach past an infection that sat unnoticed for weeks.

Repair it, or start over?

The honest answer depends on the site, not on what we would rather sell.

Repair it when

The infection is recent and clean backups from before it exist
The entry point can be found and closed
The theme and plugins are maintained and still receive updates
The content and design are worth keeping as they are

Rebuild it when

The site has been reinfected after more than one cleanup
It depends on nulled or abandoned plugins with no safe replacement
Nobody knows who built it or what the custom code does
A redesign was overdue and the cleanup would cost nearly as much

When to bring someone in

Call the same day if Google is showing a warning, your host has suspended the account or customers are being redirected. Every day the warning stays up, search visitors turn back at the red screen and ads pointing at the site can be disapproved. Handle it yourself only if you can restore a backup that predates the infection and you know exactly how they got in. Without the second part, a restore just resets the clock.

Check my site for malware Call (210) 346-0848

Free · No obligation

Think your WordPress site has been hacked?

Tell us what you are seeing and when it started. We will check the site from the outside and tell you whether it is infected and how deep it likely goes. Free, and nobody logs in without your say-so.

Which of these sounds like you? (pick any)

Frequently asked

Check three places. Search Google for site:yourdomain.com and look for pages you never wrote. Open Search Console and look under Security issues. Then click through to your site from a Google result on a phone, logged out, on cellular data. Many infections redirect only visitors who arrive that way, which is why the owner is often the last to see it.

Because a backdoor survived, or the hole it came through is still open. Most attackers leave more than one way back in, and a scanner that deletes known malware patterns will not notice a hidden administrator or a line in the database. Reinfection within weeks almost always points to an incomplete cleanup rather than a fresh attack.

Once the site is clean and you request a review in Search Console, Google usually responds within a few days. The review fails if anything infected remains, so finish the cleanup and check it twice before you ask.

It helps find things. It rarely finishes the job. Scanners match known patterns, and much of what attackers leave behind is custom or disguised as ordinary code. Treat the plugin as a smoke detector, not the fire department.

Only if the backup is older than the infection and you close the entry point first. Infections often sit quietly for weeks before anyone notices, so recent backups are frequently infected too. Restoring without fixing the plugin or password that let them in brings the site back and the attacker with it.

Some, and usually temporarily if the cleanup is fast. Spam pages indexed under your domain and a warning that scares visitors off both cost traffic. Removing the spam pages properly, clearing the warning and fixing any redirects gives Google a clean site to crawl again, and rankings typically recover as it does.

WordPress Site Hacked? How Malware Removal Actually Works

How a hacked WordPress site gives itself away

How the attacker got in, most likely first

An outdated plugin with a published flaw

A stolen or reused password

A nulled theme or plugin

A neighbor on the same hosting account

Loose permissions and exposed files

A previous cleanup that missed the backdoor

How a proper cleanup runs, in order

Contain and preserve

Find the way in

Clean from known-good sources

Close, rotate and request review