WordPress Hacked? A Cleanup and Incident Response Playbook

WordPress malware removal is only one part of recovering a hacked WordPress site. The order matters: contain the damage first, preserve evidence, clean from known good sources, find the root cause, and only then bring the site back and tell the people who need to know. This playbook walks through each stage, with a communication checklist for the business, so a stressful incident becomes a controlled one.

First hour: confirm and contain

Before anything is deleted, be sure what you are dealing with. A site that is slow or down may have a hosting fault rather than an infection. The WordPress.org guidance on hacked sites lists typical indicators of compromise, including browser or search engine warnings, the host suspending the site, antivirus tools flagging it, and unexpected new users.

Common signs of a hacked WordPress site

• Visitors are redirected to unrelated sites, often only on mobile or only from search results.
• Search results show pages in other languages or spam product listings you never created.
• New Administrator accounts, plugins or files appear that nobody on the team added.
• Your host reports unusual outbound email or resource use, or suspends the account.
• Google Search Console shows a security issue, or browsers display a warning page.

Containment steps

1. Name an incident owner. One person coordinates decisions, keeps the timeline and talks to suppliers.
2. Start an incident log. Record what was noticed, when, in which time zone, and every action taken from now on.
3. Put the site into maintenance mode or restrict access if visitors are being redirected, shown malware or asked for payment details.
4. Tell your hosting provider. On shared hosting, other sites on the same server may also be affected, and the host may already have logs.
5. Pause integrations that write to the site or receive data from it, such as payment callbacks or CRM syncs, until you understand the scope.

Do not restore last week's backup straight away. If the attackers got in through a weakness that still exists, they will come back, and a restore can overwrite the evidence you need to find that weakness.

Preserve evidence before you clean

Root cause analysis depends on what you keep now. Take a full copy of the infected site, files and database, and store it somewhere separate from the live server. Ask the host for web server access logs, error logs and any control panel or SFTP login records covering the weeks before the incident.

What to capture

• A complete file and database snapshot of the infected site, labelled clearly as compromised.
• Access and error logs, with dates.
• The list of WordPress users, their roles and last login times, if available.
• The versions of WordPress core, every plugin and the theme.
• Screenshots of any warnings, defacement or spam pages.

Reset access everywhere

Assume every credential connected to the site is known to the attacker. That means more than the WordPress admin password.

• Reset passwords for every WordPress user with publishing or administrative rights, and remove any account you do not recognise.
• Change hosting control panel, SFTP, SSH and database passwords, then update the database password in wp-config.php.
• Generate new authentication keys and salts in wp-config.php. This logs out every active session, including any the attacker holds.
• Revoke application passwords and API keys used by integrations, then reissue only the ones you need.
• Scan the computers of people who have admin or SFTP access. WordPress.org notes that infections can start on a local machine that captures login details.

Plan to change the passwords again once the site is confirmed clean. Our guide to WordPress admin roles, approvals and MFA covers how to rebuild access so fewer accounts carry real power.

WordPress malware removal, step by step

The safest malware cleanup replaces everything you can from trusted sources, rather than trying to spot every malicious line by eye.

1. Replace WordPress core

Download the same version of WordPress you were running from WordPress.org and replace the wp-admin and wp-includes folders entirely. Upload by SFTP rather than using the dashboard reinstall option, because the dashboard installer overwrites existing files but does not remove extra files an attacker added.

2. Reinstall plugins and the theme from source

Delete each plugin folder and install a fresh copy from WordPress.org or the vendor. Remove plugins you no longer use rather than reinstalling them. If the theme is custom, restore it from version control; if there is no version control, compare it carefully against the last known good copy.

3. Inspect what cannot simply be replaced

• wp-config.php and .htaccess: common targets for injected redirects and code.
• The uploads folder: it should hold media, not PHP files. Any executable file there needs investigation.
• The database: look for unknown users, injected script tags in posts and widgets, and altered site URL or option values.
• Scheduled tasks and must use plugins: attackers use them to reinstall malware after a cleanup.

4. Scan, then scan again

Use a server side scanner and an external scanner together, because each sees different things. A clean scan is a good sign, not proof, so pair it with the manual checks above.

Root cause analysis: how did they get in?

Cleaning without a root cause means waiting for the next infection. Use the evidence you preserved to answer one question: what was the entry point?

Write the conclusion into the incident log, including anything you could not confirm. If the logs were not kept long enough to tell, record that too, and fix log retention as part of the recovery. Plugin sprawl is a frequent cause, which is why choosing the right platform for the job and keeping it lean both matter.

Recovery and getting search engines to trust the site again

Bring the site back carefully

• Update WordPress core, plugins and the theme to current versions once the site is clean.
• Change passwords and keys a second time.
• Test key user flows: forms, checkout, logins and integrations.
• Watch logs and file changes closely for the following weeks; reinfection usually means a backdoor was missed.

Clearing security warnings

If Google has flagged the site, the Security Issues report in Search Console lists the problems and sample URLs. Fix every listed issue, then request a review explaining the problem, the steps taken and the result. Google's documentation says reviews can take from several days to several weeks, and advises against resubmitting while a request is pending. Check Bing Webmaster Tools and your email sending reputation too, since a hacked site is often used to send spam.

Communication checklist for the business

A WordPress incident response is also a business event. Decide who says what, and when.

• Leadership: a short summary of impact, current status and next update time.
• Customer facing teams: a holding statement for calls and messages, so nobody guesses.
• Suppliers: the host, developers and any agency with access, each with a clear task.
• Payment provider: if checkout or card pages may have been affected, contact them promptly and follow their process.
• Legal and data protection: if personal data may have been accessed, involve your legal adviser early. The UAE PDPL (Federal Decree-Law No. 45 of 2021), the DIFC Data Protection Law and ADGM rules contain breach notification duties, so confirm what applies and the deadlines with counsel or the relevant regulator rather than relying on general guidance.
• Customers: if notification is needed, say what happened, what data was involved, what you have done and what they should do.

Hypothetical example: a Sharjah retailer notices its product pages redirecting mobile visitors to a gambling site. The owner restricts the site, asks the host for logs, and briefs the sales team with a two line holding message. The root cause turns out to be an outdated slider plugin; it is removed, the site is rebuilt from clean sources, and a Search Console review is submitted once every flagged URL is fixed.

Need help cleaning up and preventing the next one?

Codeeo's WordPress development team can help contain an incident, rebuild a site from clean sources and put in place the update routine and access controls that reduce the chance of a repeat. If the site keeps being targeted, a website audit is a sensible next step, and for larger estates our site migration team can move you to a cleaner set up. Get in touch and the Dubai team will take it from there.