How to Clean a Hacked WordPress Site
Discovering that your WordPress site has been hacked is a stressful experience. However, panic will only make things worse. Follow this systematic guide to identify and remove malware from your site safely.
Step 1: Put Your Site in Maintenance Mode
To protect your visitors and prevent further damage, immediately put your site into maintenance mode. You can do this by creating a simple `.maintenance` file in your root directory or using a maintenance plugin if you still have dashboard access.
Need immediate help?
If your site is currently hacked or showing warnings, our incident response team can help right now.
Step 2: Backup Your Hacked Site
It might sound counterintuitive, but you must backup the hacked site. If your cleaning process goes wrong and breaks the site further, you need a restore point to try again. Use your host's control panel to compress and download the entire directory and database.
Step 3: Identify the Infection
Run a deep malware scan using a tool like Nexura Security or a server-side scanner like ClamAV. Look for suspicious files, modified core files, and unexpected code injected into your database (especially the `wp_options` and `wp_posts` tables).
Upgrade to Nexura Pro
Get enterprise-grade protection. Block zero-day exploits, advanced malware, and brute-force attacks instantly.
LIMITED TIME LAUNCH OFFER
Step 4: Clean the Core and Plugins
The safest way to clean core files is to completely replace them. Download a fresh copy of WordPress and replace the `wp-admin` and `wp-includes` folders. Do the same for all your plugins and themes by downloading fresh copies from their original sources.
Step 5: Change All Passwords and Keys
Once the site is clean, you must assume all credentials were compromised. Change the passwords for your database, FTP/SFTP, hosting panel, and all WordPress administrative users. Additionally, generate new salts in your `wp-config.php` file to force all users to log in again.
Malware removal can be complex. If you are unsure about any step, it is highly recommended to seek professional assistance from a dedicated security service.
