How to Clean a Hacked WordPress Website & Remove Malware (Complete Step-by-Step Guide)

Discovering that your WordPress website has been hacked is every webmaster’s worst nightmare. You might notice Google displaying a red security warning (“This site may be hacked” or “Deceptive site ahead”), your homepage redirecting visitors to scam websites, unauthorized admin users appearing in your database, or obscure Japanese characters dominating your Google search results (the Japanese Keyword Hack).

Hackers exploit vulnerable themes, outdated plugins, and weak passwords to inject backdoors, PHP web shells, and cryptocurrency miners. Left untreated, your domain will be blacklisted by Google, your hosting account suspended, and your organic SEO destroyed. In this emergency guide, we explain exactly how to clean a hacked WordPress site, eliminate malicious code, and secure your server in 2026.

Step 1: Immediate Triage & Containment

Do not panic, and do not immediately delete your entire server without taking a forensic snapshot. Follow this containment protocol:

1. Put the Site in Maintenance Mode: Prevent regular visitors and Google search bots from seeing malware redirects while you work.
2. Take an Emergency Backup: Export your database and zip your wp-content/uploads/ folder. Even if contaminated, having a copy prevents total data loss.
3. Reset All Credentials: Change your hosting cPanel password, FTP/SSH passwords, MySQL database user password, and all WordPress administrator passwords immediately.

Step 2: Replace Core WordPress Files with Clean Copies

Malware often modifies core WordPress files like index.php, wp-settings.php, and files within wp-includes. The fastest and safest way to clean core files is to completely replace them with a fresh download from WordPress.org:

1. Download a fresh zip of the latest WordPress version from wordpress.org.
2. Connect to your server via SFTP or cPanel File Manager.
3. Delete the wp-admin and wp-includes directories entirely. (Never delete wp-content or wp-config.php!).
4. Upload the fresh wp-admin and wp-includes directories from the official zip.
5. Replace root core files (such as index.php, wp-blog-header.php, wp-load.php) with the official fresh files.

Step 3: Hunt and Destroy Backdoors in wp-content/uploads/

The wp-content/uploads/ folder should contain only media assets (images, videos, PDFs). Hackers frequently hide PHP backdoors disguise as innocent filenames like logo.jpg.php, thumb_cache.php, or radio.php.

Run this command in your server terminal or SSH to instantly find any executable PHP scripts lurking inside your uploads directory:

find wp-content/uploads/ -type f -name "*.php"

If this command returns any files, examine and delete them immediately. Next, prevent PHP files from ever executing inside your uploads directory by adding this code into a new .htaccess file placed inside wp-content/uploads/:

<Files *.php>
deny from all
</Files>

Step 4: Scan and Clean Database Infections

Malware scripts often inject malicious JavaScript redirects into your database tables. Open phpMyAdmin and check the following:

• Check the wp_users table: Inspect all user rows. If you see unknown accounts with administrator privileges (especially with random strings or foreign email domains), delete them immediately.
• Search the wp_options table: Search for strings like <script, eval(, or base64_decode inside the siteurl, home, and active widget option values.
• Inspect Scheduled Cron Jobs: Hackers use WordPress Cron (wp_cron) to re-download deleted malware files every 12 hours. Install the WP Crontrol plugin to inspect and remove suspicious background cron events.

Step 5: Reset WordPress Security Keys & Salts

If hackers stole administrative browser cookies, they can stay logged in even after you change passwords. To force-logout every single user across all devices globally, generate fresh security salts.

Visit the official salt generator: https://api.wordpress.org/secret-key/1.1/salt/. Copy the generated keys, open your wp-config.php file, and replace the existing 8 lines of AUTH_KEY and SECURE_AUTH_KEY definitions.

Step 6: Request Google Search Console Security Review

Once your site is 100% clean and verified with a security plugin like Wordfence or MalCare:

1. Log in to Google Search Console.
2. Navigate to Security & Manual Actions > Security Issues.
3. Click “Request Review”.
4. Provide a concise technical summary explaining that core files were replaced, malicious scripts deleted, vulnerabilities patched, and credentials changed. Google typically removes red warning flags within 24 to 72 hours.

For more proactive protection strategies, read our guide on Automated Backups & Disaster Recovery and learn how to configure an edge web application firewall in our Cloudflare WordPress Security Guide.