My WordPress Site Has Been Hacked Fix

Isolate the Site & Change Passwords

The very first step is to prevent further damage. If your host hasn't already suspended your account, you need to isolate the site. This means temporarily blocking public access while you work. Change all critical passwords immediately: your WordPress admin, FTP/SFTP, database, hosting control panel, and even email accounts associated with your domain. This ensures the hacker loses their current access points.

# Add this to your .htaccess file at the root of your WordPress installation
# This will prompt for a password before accessing the site.
# Replace /path/to/.htpasswd with the actual path to your .htpasswd file.
# You can generate .htpasswd entries online.

AuthType Basic
AuthName "Restricted Access"
AuthUserFile /path/to/.htpasswd
Require valid-user

✓ Estimated Time: 10-15 minutes. Crucial for containment.

Identify the Entry Point & Malicious Files

Understanding how your site was compromised is key to preventing future attacks. Review your server access logs (access_log, error_log) for unusual requests, especially to xmlrpc.php, wp-login.php, or unknown files. Look for large POST requests or unusual IP addresses. Examine file modification dates using FTP or SSH: ls -latr in your wp-content directory can reveal recently changed files. Common places for backdoors include wp-config.php, wp-load.php, wp-settings.php, or within theme/plugin files like functions.php or index.php.

✓ Estimated Time: 30-60 minutes. Requires familiarity with server logs and file systems.

Scan for Malware Signatures

Malware often uses obfuscated code. Look for common patterns like eval(base64_decode(, gzinflate(base64_decode(, or large blocks of hexadecimal characters. These are frequently found in legitimate files that have been injected with malicious code. Pay close attention to the wp-content/uploads directory for PHP files, which should generally not contain executable code. A deep scan using SSH can reveal these patterns across your entire installation.

# Search for common obfuscated patterns in PHP files within wp-content
find ./wp-content -name "*.php" -print0 | xargs -0 grep -l "eval(base64_decode("
find ./wp-content -name "*.php" -print0 | xargs -0 grep -l "gzinflate(base64_decode("

# Check for suspicious PHP files in the uploads directory
find ./wp-content/uploads -name "*.php"

✓ Estimated Time: 20-40 minutes. Essential for identifying hidden backdoors.

Clean the Database

Hackers often inject malicious content directly into your WordPress database, particularly in the wp_options table (for redirects or injected scripts) or wp_posts table (for spam links or new, hidden content). Use phpMyAdmin or a similar tool to inspect these tables. Look for unusual script tags, external URLs, or large, encoded strings in option_value fields. Also, check the wp_users table for any unauthorized admin accounts that might have been created.

# Example SQL query to find suspicious entries in wp_options
SELECT * FROM wp_options WHERE option_value LIKE '%<script%' OR option_value LIKE '%http://malicious.com%';

# Example SQL query to find suspicious users
SELECT * FROM wp_users WHERE user_login NOT IN ('your_admin_username');

✓ Estimated Time: 30-60 minutes. Database cleanup is often overlooked but critical.

Restore Clean Core, Theme, and Plugin Files

The safest way to ensure your files are clean is to replace all core WordPress files, themes, and plugins with fresh, legitimate copies. Download fresh versions from WordPress.org or the official developer. Do not simply delete and reinstall without backing up your custom modifications. For core files, you can upload everything except wp-content and wp-config.php. Then, carefully compare your wp-config.php with a fresh version for any injected code. For themes and plugins, delete the old directories and upload fresh ones, then re-apply any legitimate customizations.

✓ Estimated Time: 60-120 minutes. This is a thorough, often manual process.

Harden Your Site & Monitor

After cleaning, implement robust security measures. This includes ensuring all WordPress core, themes, and plugins are updated to their latest versions. Use strong, unique passwords for all accounts. Consider a reputable security plugin for ongoing monitoring and a Web Application Firewall (WAF) for proactive protection. Regularly backup your site. This helps prevent your WordPress site being hacked again. If your WordPress site was hacked and is redirecting to another site, this step is crucial for preventing recurrence.

✓ Estimated Time: 30 minutes. Ongoing process for long-term security.