Hacked WordPress site, cleaned properly and locked down.

Malware removed, the entry point closed, and blacklist status cleared, with hardening applied afterward so the same vulnerability cannot be used twice. Most infections are identified and cleaned within 24 to 48 hours.

Almost nobody hacks a WordPress site by hand. Bots scan millions of sites at once for a specific, already-known vulnerability — an unpatched plugin, a weak password — and once they get in, the first thing they usually do is plant a backdoor, so they can get back in even after the obvious symptom is fixed.

WHAT USUALLY CAUSES IT

• An outdated plugin or theme with a publicly known vulnerability that was never patched
• A weak or reused admin password, found in a previous data breach and tried automatically
• A nulled or pirated premium plugin with malicious code built into it from the start
• File permissions left too open, letting an attacker write new files to the server
• No firewall or login protection, so automated bots could brute-force their way in unnoticed
• A previous clean-up that removed the visible symptom but missed the backdoor, so it came straight back

SIGNS YOU NEED THIS

• A full malware scan identifying every infected file and database entry
• Infected files and code cleaned without wiping your actual content
• The entry point, plugin vulnerability or leaked credential that let it in, closed
• Blacklist removal requests filed with Google Safe Browsing and your host
• WordPress core, plugins and themes updated to patched, non-vulnerable versions
• Security hardening: firewall rules, login protection and backup configuration
• A written report on what happened and how it was fixed

TECHNOLOGY I USE

• WordPress
• Wordfence
• MalCare
• Sucuri
• PHP
• MySQL
• Cloudflare
• Query Monitor

1. Diagnose and confirm the compromise

   A quick check confirms what is actually infected and how serious it is, so you know what you are dealing with before anything else happens.

2. Check the logs

   Access logs and file-modification timestamps get checked alongside the malware scan itself, since they usually show how and when the attacker got in.

3. Identify the root cause and entry point

   Every file and database table is scanned, not just the obviously affected ones, until the actual vulnerability, credential or backdoor is confirmed, not just the visible symptom.

4. Take a safe backup first

   A snapshot is taken before anything is touched, so there is a fallback point and a forensic copy of what was actually there.

5. Clean without wiping the site

   Infected code is removed and legitimate content restored, rather than defaulting to a full wipe and rebuild, which most hacks do not require.

6. Test functionality

   The site is checked to confirm it works normally after the clean-up, not just that the malicious symptom is gone.

7. Check for mobile-only redirects

   Some malware only redirects visitors on mobile, to stay hidden from a quick desktop check. Both are tested separately before this gets marked resolved.

8. Close the entry point and harden

   The vulnerability, weak credential, or outdated plugin that allowed the breach gets patched, then firewall rules, login protection and backups are put in place so the same route cannot be used again. For a deeper pass afterward, see WordPress Security Hardening.

9. Final quality check and delisting

   A last full scan confirms the site is clean, blacklist removal is requested from Google and your host where relevant, and you get a written report on what happened.

Cleaning up hacked WordPress sites has been a recurring part of eleven years in web development — enough to recognize most infection patterns on sight, and to know the difference between a cosmetic clean-up and one that actually closes the door the attacker used.