How to Clean a Hacked WordPress Site: Step-by-Step

Introduction: The Nightmare of a Hacked Site

Discovering that your WordPress site has been hacked is a heart-sinking experience. Perhaps Google has flagged your site with a "Deceptive site ahead" warning, your host has suspended your account, or visitors are complaining about being redirected to spam sites. Panic is the natural reaction, but it is the enemy of a successful recovery.

If you scour forums like Reddit seeking advice on how to clean a hacked site, you will find a fierce debate. Many novices recommend simply installing a security plugin and running a scan. However, seasoned security professionals and sysadmins will tell you that manual cleaning or relying solely on automated scanners is highly risky. Attackers are incredibly adept at hiding persistent backdoors in obscure directories. If you miss even one malicious PHP file, the attacker will regain access within days.

The gold standard for recovering a compromised site is the "Fresh Install" method. In this comprehensive, step-by-step guide, we will walk you through the exact process used by professionals to guarantee that a site is entirely free of malware.

Step 1: Triage and Containment

Before you start deleting files, you must stop the bleeding and assess the damage.

Take it Offline

If your site is actively serving malware or redirecting users to phishing pages, you must take it offline immediately to protect your visitors and prevent further damage to your SEO reputation. You can do this via your hosting control panel (cPanel, Plesk) by pausing the site or routing traffic to a static HTML "Maintenance" page.

The Crucial Backup

It sounds counterintuitive to backup a hacked site, but it is absolutely mandatory. You need a complete snapshot of the files and the database in their current state. If you accidentally delete a critical configuration file during the cleaning process and break the site entirely, you need a restore point to start over. Download this backup to your local machine and isolate it.

Step 2: The "Fresh Install" Strategy

The core philosophy of the Fresh Install method is that you do not trust any executable file on your server. Instead of trying to find the needle in the haystack (the malware), you burn the haystack down and buy a new one. You will completely replace the WordPress core, all plugins, and all themes with freshly downloaded, clean copies.

Isolate the Infected Directory

Using your FTP client or hosting file manager, navigate to your root directory (often `public_html` or `www`). Rename this directory to something like `public_html_HACKED`. Your site will go offline immediately.

Create a New Home

Create a brand new, empty directory named `public_html`. This is where we will build the clean version of your site.

Reinstall WordPress Core

Download the latest version of WordPress directly from WordPress.org. Extract the files and upload them into your new, empty `public_html` directory.

Step 3: Carefully Migrating Data

Now you have a clean WordPress installation, but it has no content. You need to migrate your specific data from the `public_html_HACKED` directory, but you must do so with extreme caution.

The wp-config.php File

Do not copy your old `wp-config.php` file. Attackers often inject malicious code into it. Instead, copy the database connection details (DB_NAME, DB_USER, DB_PASSWORD, DB_HOST) from the old file and paste them into the `wp-config-sample.php` file in your new directory. Rename it to `wp-config.php`. **Crucially, generate new authentication salts** from the official WordPress API and paste them into the new config file. This forces all users to log out, terminating any active sessions the hacker might have.

The Uploads Directory

Your images and media files live in `wp-content/uploads`. This is the only folder you should copy from the hacked directory to the new directory. However, attackers frequently hide PHP backdoors inside the uploads folder, disguising them among the images.

Before copying the folder, you must thoroughly audit it. Look for any files ending in `.php`, `.js`, or `.ico` within the uploads directory. If you find any, delete them immediately. The uploads folder should only contain media files (jpg, png, pdf, mp4, etc.). Once audited, copy the uploads folder to your new `wp-content` directory.

Step 4: Reinstalling Plugins and Themes

This is where many people make a critical mistake. Do not copy your `plugins` or `themes` folders from the hacked directory.

Fresh Downloads Only

Log into your new, clean WordPress dashboard. Because you connected to the original database, WordPress will know which plugins and themes were previously active. Navigate to the Plugins page and delete everything. Then, manually search for, download, and reinstall fresh copies of every plugin from the official repository or the premium developer's website. Do the exact same thing for your active theme.

By downloading fresh copies, you guarantee that the plugin and theme files are 100% clean and free of backdoors.

Step 5: Auditing the Database

While replacing the files removes the PHP backdoors, attackers often inject malicious JavaScript or spam links directly into your database (specifically the `wp_posts` and `wp_options` tables).

Checking for Hidden Admins

Using phpMyAdmin, open the `wp_users` table. Look for any administrator accounts that you do not recognize. Attackers often create "ghost" admin accounts to ensure they can get back in. Delete any suspicious users immediately.

Scanning for Injected Scripts

Install a reputable security plugin (like Wordfence or Nexura Security) on your now-clean site and run a deep scan. Since we know the files are clean, the scanner will focus on finding malicious payloads injected into your database content. Follow the plugin's instructions to clean any infected posts or options.

Step 6: Closing the Entry Point

If you don't find out how the hacker got in, they will simply walk back through the same open door tomorrow.

Update Everything

The vast majority of hacks occur through outdated plugins. Ensure everything on your newly built site is updated to the absolute latest version.

Change All Passwords

Assume the attacker has all your passwords. Change the passwords for your WordPress Admin account, your database user, your FTP accounts, and your hosting control panel. Use a password manager to generate long, complex, unique passwords.

Implement 2FA and Hardening

Enforce Two-Factor Authentication for all admin accounts. Add `define('DISALLOW_FILE_EDIT', true);` to your `wp-config.php` to prevent attackers from editing theme files from the dashboard if they ever manage to guess a password again.

Conclusion

Cleaning a hacked WordPress site is a tedious and stressful process. While the "Fresh Install" method takes more time than clicking "clean" on an automated scanner, it is the only way to be completely certain that your server is free of hidden backdoors. Once your site is clean and secured, invest in a robust backup solution and an endpoint firewall to ensure you never have to go through this process again.