A hacked website rarely announces itself politely. One day your homepage redirects to a spam page, Google starts flagging your domain, or your customers tell you the site looks broken. If you are searching for how to recover hacked WordPress, speed matters – but so does getting the fix right the first time.
For most businesses, a WordPress hack is not just a technical problem. It affects trust, leads, rankings, enquiries and revenue. A rushed clean-up can leave backdoors in place, which means the site gets compromised again weeks later. The right response is controlled, methodical and focused on restoring the site without carrying the infection forward.
How to recover hacked WordPress without making it worse
The first priority is containment. If the site is still live and actively serving malicious content, put it into maintenance mode or ask your hosting provider to temporarily suspend public access. That may feel drastic, but it is often the better commercial decision. A short interruption is usually less damaging than exposing visitors to malware, spam redirects or phishing pages.
At the same time, avoid changing too many things at once. Business owners often start deleting plugins, editing files and restoring random backups before they know what caused the issue. That can destroy evidence, miss the real entry point and make the recovery longer. Before you touch the site, take a full backup of files and database in its hacked state. It sounds counterintuitive, but it gives you a reference point if you need to investigate the breach or recover important content.
Next, reset access. Change passwords for WordPress admin accounts, hosting, SFTP, database users and any linked email addresses. If one set of credentials was exposed, assume the others may be at risk too. Force password resets for all admin-level users and remove any accounts you do not recognise.
Identify what has been compromised
Not every WordPress hack looks the same. Some attacks inject spam into the database. Others add malicious PHP files, create rogue administrator accounts or alter core files to maintain access. The recovery plan depends on the type of compromise.
Start by checking whether you can still log in to WordPress. Review the user list for unfamiliar admin accounts. Look at recently modified files in your hosting panel or over SFTP. Check the wp-content folder closely, especially uploads, themes and plugins, because attackers often hide code there. If your site is redirecting, inspect the .htaccess file and header or footer files in the active theme.
If the site is blacklisted by search engines or security tools, note the warning details. They can point to phishing pages, malware payloads or injected scripts. Also review server logs if available. They may show suspicious login attempts, vulnerable plugin requests or unusual file uploads.
There is a trade-off here. If the site is a simple brochure site, a clean rebuild from known-good files may be faster than forensic analysis. If it is a complex e-commerce or lead-generation platform with frequent content changes, you may need a more careful investigation so you do not lose data or break key functionality.
Clean the infection properly
This is the stage where many recoveries fail. Deleting the visible malware is not enough if the attacker still has a way back in.
The safest approach is to replace WordPress core files with fresh copies, replace themes and plugins with clean versions from trusted sources, and inspect the database for malicious content. If you have premium themes or custom development, use verified source files rather than downloading replacements from unknown locations.
Pay close attention to these areas:
- wp-config.php
- .htaccess
- mu-plugins and plugin folders
- uploads directories containing PHP files
- database entries with injected scripts or spam links
- scheduled tasks, rogue admin users and hidden backdoors
Backdoors are often small, obscure pieces of code with innocent-looking names. They may sit in a plugin file, a fake image file, or a folder that should not contain executable code at all. If you leave one behind, the site may appear clean and then get reinfected.
If you have a clean backup from before the hack, restoring it can save time. But only use that path if you know the backup predates the breach and you still patch the original vulnerability. Restoring a backup without fixing the weak point simply resets the clock until the next compromise.
Restore from backup or rebuild selectively
Backups are valuable, but they are not always the silver bullet people hope for. A backup can contain dormant malware if the site was compromised before the issue became obvious. On the other hand, a recent backup can dramatically reduce downtime if it is verified and clean.
A practical approach is to restore the site into a staging environment first. That lets you test the backup, scan files, inspect users and review functionality before pushing anything live. For business-critical sites, this is usually worth the extra step. It reduces the risk of bringing a broken or infected version straight back into production.
If there is no safe backup, rebuild selectively. Install a clean copy of WordPress, import the database after review, reinstall trusted plugins and themes, and migrate only the media and custom assets you know are safe. This takes longer, but it often produces a more stable result than trying to clean every infected file on a heavily compromised installation.
Secure the site before going live again
Once the site is clean, harden it immediately. Recovery is only half the job. The other half is making sure the same weakness does not put you back in the same position next month.
Update WordPress core, plugins and themes to current versions. Remove anything inactive or unsupported. If a plugin has not been maintained properly, replacing it is usually the safer commercial call than keeping it because it is familiar.
Enable two-factor authentication for administrator accounts. Limit login attempts. Review file permissions and disable PHP execution in upload directories where possible. Make sure your hosting environment is current, including supported PHP versions and sensible server-level protections.
If multiple users access the site, apply least-privilege access. Not everyone needs admin rights. Marketing staff, content editors and developers often need different permission levels, and separating those roles reduces risk.
This is also the right time to review your hosting setup. Cheap or poorly managed hosting can make incident response harder. Strong hosting does not prevent every attack, but it can improve isolation, backup quality, log access and recovery speed.
Check SEO, email and brand damage
A successful recovery is not just about removing malware. You also need to assess the broader business impact.
Search results may still show hacked titles or warnings. Your domain may be blacklisted by security services. Contact forms may have failed. Transactional emails may have stopped sending. If attackers used your domain for spam, email deliverability can suffer even after the site is cleaned.
Review indexed pages for spam content, test forms and checkout flows, and verify that analytics and conversion tracking still work. If your site was flagged, request reviews through the relevant platforms once the clean-up is complete. For organisations that rely on enquiries or online sales, this part matters as much as the technical fix.
When to handle it in-house and when to bring in experts
Some WordPress recoveries are straightforward. If the compromise is limited, you have a known-good backup, and your team understands hosting, databases and file integrity, an internal fix may be viable.
But if the site handles leads, customer data, payments or rankings that directly affect revenue, the cost of getting it wrong can outweigh the cost of expert help. Reinfection, downtime and search visibility loss are expensive. So is the internal time spent troubleshooting a breach instead of running the business.
That is where a specialist team can make a measurable difference. Agencies such as Agenda Web approach hacked site recovery as both a technical and commercial priority – remove the threat, restore performance, close the vulnerability and get the business back online with confidence.
Prevent the next WordPress hack
The best answer to how to recover hacked WordPress is to make the next recovery unnecessary. That means disciplined maintenance, not a set-and-forget website.
Keep software updated, run scheduled backups, monitor uptime, scan for changes, and audit plugins regularly. Choose reputable extensions, reduce plugin bloat, and retire tools that no longer serve the business. If your site is central to marketing and lead generation, ongoing care is not optional overhead. It is part of protecting revenue.
A hacked WordPress site can feel urgent and chaotic, but recovery does not have to be. With the right process, you can contain the damage, clean the site properly and return to a stronger position than before.