WordPress Hacked Site Recovery

Nine steps to recover a hacked WordPress site. Do not skip steps — hackers plant backdoors that survive partial cleanups.

Step 1 — Back Up First

Back up files and database before touching anything. Even a hacked backup is useful for forensics.

Step 2 — Replace WordPress Core

Download latest WordPress from https://wordpress.org/latest.zip
Extract. Do NOT overwrite wp-config.php or wp-content/.
Replace: all root PHP files, wp-admin/, wp-includes/ with clean copies.

Step 3 — Manual Malware Scan

Search for common injection patterns:

grep -rl "base64_decode" /path/to/wordpress/
grep -rl "eval(" /path/to/wordpress/
grep -rl "gzinflate" /path/to/wordpress/

Suspicious folders in wp-content/plugins/ should be moved out of web root and reviewed, not deleted immediately.

Step 4 — Rotate All Credentials

Change FTP/SFTP passwords
Change all WordPress user passwords
Remove users who should not have access
Regenerate wp-config.php salts at https://api.wordpress.org/secret-key/1.1/salt/

Step 5 — Update All Plugins

Update every plugin. Delete abandoned or unused plugins. Outdated plugins are the most common entry point.

Step 6 — Install All In One Security (AIOS)

Configure firewall rules, login lockdown, and file change detection. Replaces default login URL protection.

Step 7 — Hide the Login URL

Install WPS Hide Login. Change /wp-admin and /wp-login.php to a custom path. Bookmark the new URL.

Step 8 — Deep Scan with WP Cerber

WP Cerber compares installed plugin/theme files against original author zips. Any modified file is flagged. For premium plugins, upload the original vendor zip to Cerber manually so it can compare.

Step 9 — Consider Sucuri WAF

Sucuri's Web Application Firewall blocks attacks before they reach the site. Includes automated malware scanning and remediation. Recommended for clients who want hands-off ongoing security.

Why Restoring a Backup Isn't Enough

Hackers often inject code days or weeks before exploiting it. A backup restore may restore the infection. Always run the full scan pipeline even after restoring.