If your WordPress site has been hacked or infected with malware, act quickly—but carefully. This guide shows you how to contain, clean, and harden a compromised WordPress site without making the situation worse. We’ll cover immediate containment, safe cleanup, restoring integrity, and preventing reinfection.

Quick Checklist: Immediate Containment

  • Put the site into maintenance mode or temporarily disable public access (via hosting controls or .htaccess password protection).
  • Change all critical passwords: hosting panel, FTP/SFTP, SSH, database, and all WordPress admin accounts.
  • Generate new WordPress security salts and keys (wp-config.php).
  • Disable suspicious plugins and themes; if unsure, disable all and re-enable one by one later.
  • Take a full backup (files + database) now for forensics before altering anything.

1) Verify the Compromise

Not all errors mean you’re hacked. Look for telltale signs:

  • Injected redirects (mobile-only, geo-based, or first-visit behavior).
  • Unrecognized admin users or password reset emails you didn’t request.
  • New or modified files with random names or in unusual locations (e.g., in uploads).
  • Search engine warnings (Google Safe Browsing), hosting abuse notices, or WAF alerts.

2) Put the Site in Safe Mode

Use a maintenance plugin or server-level basic auth to restrict access while you work. Avoid completely deleting the site yet—you’ll need evidence for cleanup.

3) Gather Forensics

  • Download current files and database for analysis.
  • Collect access logs and error logs from your host (last 7–30 days).
  • Note timestamps of suspicious changes to correlate with logs.

4) Scan and Identify Malware

Use multiple methods. No single scanner catches everything.

  • Security plugins (run from a known-clean admin session): Wordfence, iThemes Security, or Sucuri Scanner.
  • Server-side scanners: hosting malware scanners or ClamAV (if available).
  • Manual greps for common patterns (base64, eval, gzuncompress, assert, system), especially in uploads, mu-plugins, and wp-includes overrides.

WP-CLI Useful Commands


# List core file integrity status
wp core verify-checksums

# List plugins/themes and statuses
wp plugin list --status=active --fields=name,status,update
wp theme list --fields=name,status,update

# Update core, plugins, themes (after containment)
wp core update
wp plugin update --all
wp theme update --all

# Export database before cleaning
wp db export pre-cleanup.sql

5) Clean Up Files

Prefer replacing over editing. Backdoors often re-infect if any remains.

  • Replace core files with known-good originals: 
    wp core download --force
  • Reinstall all plugins and themes from official sources: 
    wp plugin install PLUGIN --force
wp theme install THEME --force
  • Delete anything not part of a clean WordPress install:
    • Unknown PHP files in wp-content/uploads
    • Funny-named .php in wp-includes or wp-admin
    • mu-plugins folder contents you don’t recognize
  • Check .htaccess for malicious rewrite rules or base64 blobs. Restore a minimal safe version if uncertain.

Safe .htaccess Baseline (Apache)


# BEGIN WordPress
<IfModule mod_rewrite.c>
RewriteEngine On
RewriteBase /
RewriteRule ^index\.php$ - [L]
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule . /index.php [L]
</IfModule>
# END WordPress

6) Clean the Database

  • Search wp_options, wp_posts, and wp_postmeta for injected JS/iframes, strange cron entries, or unknown options (often autoload = yes).
  • Clear malicious cron hooks in wp_options (option_name = cron) or via WP-CLI: 
    wp cron event list
wp cron event delete malicious_hook_name
  • Remove unknown admin users and reset passwords for all real users.

7) Reset All Secrets and Sessions

  • Rotate database credentials and update wp-config.php.
  • Generate new salts/keys to log out all sessions: WordPress salt generator.
  • Invalidate hosting panel, SSH, and SFTP passwords/keys.

Recommended wp-config.php Hardening


// Disallow file editing and modifications from the dashboard
define('DISALLOW_FILE_EDIT', true);
define('DISALLOW_FILE_MODS', true);

// Force SSL for admin
define('FORCE_SSL_ADMIN', true);

// Disable XML-RPC if not needed
add_filter('xmlrpc_enabled', '__return_false');

8) Re-enable Carefully and Monitor

  • Turn on plugins one by one and monitor logs, network requests, and WAF alerts.
  • Enable a Web Application Firewall (e.g., Cloudflare, Sucuri) and set security level to medium/high during observation.
  • Check Search Console for security issues and request review if flagged.

9) Prevent Reinfection

  • Keep core, plugins, and themes updated automatically where possible.
  • Remove abandoned plugins/themes; fewer components = smaller attack surface.
  • Set up daily offsite backups with 14–30 days retention; test restores quarterly.
  • Use least-privilege access; avoid sharing admin accounts; use 2FA.
  • Harden file permissions (typical: files 644, directories 755) and disable PHP execution in uploads.

Block PHP in Uploads (Apache)


# wp-content/uploads/.htaccess
<FilesMatch "\.(php|php\d?)$">
  Deny from all
</FilesMatch>

10) When to Restore from Backup

If the infection is widespread or you can’t trust the current filesystem, restoring from a clean, pre-infection backup is faster and safer. Always rotate passwords and salts after restore, and update everything immediately.

FAQ

How long does cleanup take?

Anywhere from 1–6 hours for typical infections, longer for large sites or if the server itself is compromised.

Will cleaning affect SEO?

Removing malicious redirects and spam pages usually improves SEO. If flagged by Google, you’ll need to submit a security review in Search Console.

Can I avoid downtime?

Yes—use maintenance mode or stage the cleanup on a clone, then swap when clean. A WAF can also filter malicious traffic during cleanup.

If you’re in Cape Town and need urgent WordPress malware cleanup, I offer same-day support. Contact me or call +27 82 889 0476.