GUIDE
A compromised WordPress site is an incident, not a cosmetic bug. Your job is containment first, then clean removal of malware and backdoors, then hardening so the attacker cannot walk back in. This guide is the order that works.
Do not panic-delete the whole site. Do not restore the newest backup until you know whether that backup is already infected. Do not keep using the same weak admin password “just for now”. Most reinfections are not mysterious — they are unfinished cleanups.
Warning signs include Google Search Console messages that the site may be hacked, Chrome telling visitors the site is not safe, redirects to unknown domains, spammy links injected into posts, a suddenly slow site, an inaccessible admin, or odd server-load spikes from cryptojacking. If you see any of these, treat the site as compromised until proven clean.
Also check your outbound email reputation and hosting abuse notices. Many owners discover a hack only when the host suspends the account for sending spam. In that case the public site may still “look fine” while a hidden mailer script runs from an uploads folder. Contain first; argue with the host later, with evidence.
Capture screenshots of warnings, note the time you first noticed symptoms, and list recent plugin installs or shared logins. If the site is actively redirecting visitors or serving phishing pages, put it into maintenance mode or temporarily suspend the site at the host so fewer people are harmed while you work.
Change the passwords on your hosting panel and email from a clean device. If your own computer might be infected, do not type WordPress credentials there. Ask your host whether they see suspicious cron jobs, outbound spam, or unknown FTP users. Containment is boring; skipping it is how the attacker watches you clean up in real time.
Before you delete anything, download a full copy of the files and database as they stand. Label it clearly as a forensic snapshot. You may need it to compare timestamps, recover a clean post the attacker overwrote, or prove what happened. A “clean” restore from last week is useful later — but only after you know when the infection started.
Export a list of WordPress users and their roles if you can still reach the database (phpMyAdmin or similar). Look for unknown administrators. Attackers love creating a spare admin account named something almost legitimate.
Compare WordPress core files against a clean copy of the same version. Unexpected changes in wp-includes or wp-admin are a red flag. Scan wp-content/uploads for PHP files — uploads should not contain executable PHP in a healthy install. Review recently modified files by timestamp; malware often lands in odd directories with random names.
In the database, search wp_posts and wp_options for injected scripts, unfamiliar domains, and spam eval payloads. Check wp_users for rogue admins. Review wp_options rows such as siteurl and home in case they were pointed at a phishing domain. If you use a reputable malware scanner, run it — but treat scanners as assistants, not proof of cleanliness. Many backdoors are custom and quiet.
Inspect server cron and WordPress cron carefully. Unexpected curl commands, base64-encoded PHP run via cron, or unknown scheduled actions in a cron plugin are classic persistence tricks. Disable suspicious jobs before you declare the site clean.
Delete malicious files, replace infected core and plugin files with clean copies from wordpress.org or the vendor, and remove rogue users. Reinstall WordPress core over the top if needed. Update every plugin and theme you keep; delete anything abandoned or unknown.
Assume a backdoor exists. Industry reporting regularly finds that a large share of attacks — around 69.6% in widely cited datasets — leave a way back in. Backdoors hide in must-use plugins (mu-plugins), scheduled cron tasks, theme footer injections, and database options. If you only delete the visible spam page, the attacker returns within days. That is why incomplete DIY cleanups feel cursed.
When restoring from backup, restore only to a point before the earliest evidence of compromise, then re-apply legitimate content changes manually if needed. Restoring yesterday’s backup when the attacker arrived last month simply reinstalls the backdoor with a nicer homepage. After restore, still rotate every password and salt — credentials may have been stolen even if the files look clean.
Complete malware removal is €299 one-time: diagnosis within 24 hours, full cleanup typically within one to three days, hardening included, and WP Defender Pro free for one year (24/7 scanning, WAF, 2FA and audit logging). Content stays intact — the process is non-destructive.
€299
Get malware removal →After the obvious malware is gone, rotate every secret the attacker may have stolen:
AUTH_KEY / salt values in wp-config.php (use the official salt generator)wp-config.phpReset file permissions to directories 755 and files 644. Consider changing the database table prefix on a hardened rebuild if the old prefix is widely exposed. Disable the theme/plugin file editor in wp-admin. Force HTTPS and sensible security headers. Install and configure a real security stack — firewall, two-factor authentication, malware scanning and audit logs. Professional cleanups include WP Defender Pro for a year for exactly this reason: cleanup without monitoring invites a sequel.
Keep WordPress, plugins and themes updated. Outdated software remains one of the most common entry points; a large share of infected sites run outdated versions. Prefer plugins from trusted sources and delete what you do not use.
If Google or another blacklist flagged the site, clean first, then request a review in Google Search Console. Reviews fail when malware is still present, so do not rush this step. Clear CDN caches so visitors are not served old malicious HTML.
Watch access logs and user accounts for a week. Unexpected admin logins, new PHP files in uploads, or sudden outbound mail spikes mean the backdoor is still there. Keep automated scanning on. Re-check Search Console coverage and security reports after Google finishes processing your review request — clearance is not instant.
If you process personal data under GDPR, document the incident and assess whether you must notify — that is a legal question for your situation, not something to ignore because the homepage “looks fine”. Note what data was exposed, when you contained the issue, and what hardening you applied. That record helps both compliance and future debugging.
Hand the incident to a specialist when:
Complete malware removal at Chochi.eu is €299. Diagnosis starts within 24 hours; full cleanup typically finishes in one to three days depending on scope. The work covers core, plugins, themes, database and hidden backdoors, then hardening (passwords, salts, permissions, updates) and WP Defender Pro free for one year, plus a report and 30 days of priority support. The process is non-destructive: posts, pages and products stay intact while malware is removed.
If the hack left you with a blank admin or front end, use WordPress white screen of death: 7 fixes. After you are clean, improve performance with how to speed up WordPress — heavy malware and spam often leave sites sluggish even after removal. More guides live on the Guides hub.
Cleanups are included, and monitoring means you'd likely never need one again.
Daily backups · Security monitoring · Priority support · Monthly report
Plans from €29/mo — most clients pick Pro at €59/mo