How to Fix WordPress Hacked for Beginners – Step‑by‑Step Guide

Imagine you wake up to a frantic email from a client: the homepage shows a blank screen, Google flags the site for malware, and the admin login redirects to an unknown URL. You’ve just discovered your WordPress site has been hacked, and the clock starts ticking. In the next few minutes you’ll learn exactly what to do, why each step matters, and how to lock the door behind the attacker.

• Understanding Why Your WordPress Site Got Hacked
• Immediate Steps to Contain the Breach
• Cleaning Malware and Restoring Clean Files
• Strengthening WordPress Security After Recovery
• Tools and Plugins for Ongoing Protection

Understanding Why Your WordPress Site Got Hacked

Most breaches aren’t the work of a lone genius; they exploit outdated software, weak passwords, or insecure plugins. A typical attack chain starts with a vulnerable plugin that lets the hacker inject malware into the wp-content folder. From there, they create hidden admin accounts, modify the .htaccess file, and sometimes even plant back‑doors that survive a simple reinstall.

Common entry points

• Old themes that no longer receive updates.
• Plugins with known CVEs (e.g., the 2023 "WP‑FileManager" exploit).
• Shared hosting environments where one compromised site can affect another.
• Weak credentials – think "admin123" or reused passwords across services.

Knowing the entry point helps you prioritize what to patch first.

Immediate Steps to Contain the Breach

Time is your most valuable resource. Follow this checklist before you start digging through code.

1. Put the site in maintenance mode

Activate a .maintenance file via FTP or use your hosting control panel to serve a static “Under Maintenance” page. This stops visitors (and bots) from interacting with the compromised site while you work.

2. Reset every password

Change passwords for WordPress admin accounts, database users, FTP/SFTP, and your hosting dashboard. Use a password manager to generate 16‑character strings with mixed case, numbers, and symbols.

3. Create a clean backup

Before you delete anything, download a full copy of the site (files + database). Store it offline – you’ll need a reference point for what was there before the hack.

4. Scan for malicious code

Run a quick online scanner like Sucuri SiteCheck to identify obvious malicious URLs. This gives you a map of where the attacker left footprints.

Cleaning Malware and Restoring Clean Files

Now the heavy lifting begins. You have two paths: manual cleaning or a reputable security plugin. For beginners, a hybrid approach works best – let the plugin flag suspicious files, then verify manually.

Manual file inspection

• Connect via SFTP and look for recently modified files in wp-content/uploads, wp-includes, and the theme folder.
• Search for eval(base64_decode(...)) patterns – a classic sign of obfuscated malware.
• Delete any PHP files that don’t belong to a plugin or theme.

Reinstall core WordPress files

Download the exact version you were running from WordPress.org, unzip, and overwrite the wp-admin and wp-includes directories. This restores clean core files without affecting your content.

Database cleanup

Open phpMyAdmin, browse the wp_options table, and look for suspicious rows like active_plugins that contain unfamiliar plugin names. Also scan wp_users for rogue admin accounts and remove them.

Replace compromised themes and plugins

Delete the entire theme folder and reinstall a fresh copy from the official repository. Do the same for every plugin – even if it appears clean, a hidden back‑door could be lurking.

Strengthening WordPress Security After Recovery

Cleaning is only half the battle. Harden the site so the same vulnerability can’t be abused again.

Update everything

Enable automatic updates for minor releases and schedule a weekly check for major releases. Set your theme and plugins to update automatically where possible.

Enforce strong authentication

Install a two‑factor authentication (2FA) plugin like Google Authenticator or Authy. Pair it with a password policy that requires at least 12 characters, a mix of symbols, and no dictionary words.

Limit login attempts

Use a plugin such as Limit Login Attempts Reloaded to block IPs after five failed attempts. Combine this with a firewall rule that only allows SSH access from your IP.

Configure file permissions

Set directories to 755 and files to 644. The wp-config.php file should be 600 to keep database credentials safe.

Implement a Web Application Firewall (WAF)

Services like Cloudflare or Sucuri act as a shield, filtering malicious traffic before it reaches your server. A free Cloudflare plan already blocks many common attacks.

Tools and Plugins for Ongoing Protection

Even the most diligent site owner benefits from automated security layers.

• Wordfence – real‑time firewall, malware scanner, and login security.
• Sucuri Security – site integrity monitoring and post‑hack cleanup tools.
• iThemes Security – brute‑force protection, file change detection, and database backups.
• UpdraftPlus – scheduled backups to remote storage (Google Drive, Dropbox).
• WPScan – command‑line vulnerability scanner for deeper audits.

Pick one firewall and one backup solution, then let them run in the background. You’ll spend less time firefighting and more time creating content.

Conclusion

Finding a hacked WordPress site feels like a nightmare, but the process is methodical: contain, backup, clean, and harden. By following the steps above you’ll not only restore a functional site but also build a resilient security posture that deters future attacks. Remember, security is a habit, not a one‑time checklist.

Frequently Asked Questions

How can I tell if my WordPress site has been hacked?

Look for unknown admin users, strange files in wp-content, sudden drops in traffic, or Google warnings about malware.

What should I do first after discovering a hack?

Put the site in maintenance mode, change all passwords, and create a clean backup before you start cleaning.

Can I remove malware manually without a plugin?

Yes, by scanning files via FTP, deleting suspicious code, and restoring core WordPress files from a fresh download.

Which security plugins are best for beginners?

Wordfence, Sucuri Security, and iThemes Security offer easy setup and real‑time protection.

How do I prevent future hacks after cleaning my site?

Keep WordPress, themes, and plugins updated, use strong passwords, enable two‑factor authentication, and limit login attempts.