How to Recover a HACKED WordPress Site in Simple Steps

How to Recover a HACKED WordPress Site in Simple Steps

Having your WordPress site hacked is one of the most stressful experiences for any website owner. Not only can it harm your reputation, but it can also affect your SEO rankings, compromise customer data, and even get your site blacklisted by search engines. The good news? Recovering a hacked WordPress site is possible—and easier than you think if you follow the right steps.

In this guide, we’ll walk you through how to recover a hacked WordPress site in simple steps, plus share tips to prevent future attacks.

Why WordPress Sites Get Hacked

Before jumping into recovery, it’s important to understand why hacks happen. Here are the most common reasons:

• Outdated WordPress core, themes, or plugins
• Weak passwords and no two-factor authentication
• Poor-quality hosting without security measures
• Use of nulled (pirated) themes or plugins
• Lack of SSL and basic security configurations

Knowing the root cause helps you secure your site after fixing it.

How to Recover a HACKED WordPress Site in Simple Steps

Step 1: Don’t Panic – Take Your Site Offline

The first thing to do is take your website offline to prevent further damage. You can:

• Put your site in maintenance mode using a plugin
• Or disable it via your hosting control panel

This keeps visitors safe and stops hackers from causing more harm.

Step 2: Scan Your Site for Malware

Use a trusted WordPress security plugin to scan your site for malicious files. Popular options:

• Wordfence Security
• Sucuri Security
• MalCare

These tools identify infected files, suspicious code, and compromised database entries.

Step 3: Change All Passwords

Immediately update all login credentials:

• WordPress admin account
• Database user password
• FTP/SFTP accounts
• Hosting control panel
• Any other linked accounts

Use strong, unique passwords and enable two-factor authentication (2FA) for extra security.

Step 4: Update WordPress Core, Themes, and Plugins

Hackers often exploit outdated software. Update everything to the latest version, including:

• WordPress core files
• All installed themes and plugins
• Delete unused or inactive themes/plugins

If any plugin or theme is not from a trusted source, remove it.

Step 5: Restore From a Clean Backup

If you have a recent clean backup, restoring it is the quickest way to recover your site.

• Use your hosting provider’s backup option or plugins like UpdraftPlus or BlogVault.
• Make sure the backup is clean and created before the hack happened.

If you don’t have a backup, move to the next step.

Step 6: Remove Malware and Clean Files

If restoring isn’t an option, you’ll need to manually remove infected files:

• Access your site files via FTP or hosting file manager.
• Compare suspicious files with fresh WordPress core files.
• Delete or replace corrupted files.
• Check wp-config.php and .htaccess for malicious code.

Tip: If this feels overwhelming, hire a professional or use malware cleanup services like Sucuri or MalCare.

Step 7: Reinstall WordPress Core Files

Download a fresh copy of WordPress from wordpress.org and replace the core files (except wp-content and wp-config.php). This ensures all core files are clean.

Step 8: Remove Unknown Users

Check Users → All Users in your WordPress dashboard.

• Remove any unknown administrators.
• Verify email addresses for all legitimate accounts.

Hackers often create backdoor users, so this step is crucial.

Step 9: Secure Your Database

Hackers sometimes insert malicious code into the database. Use a plugin like WP-Optimize or phpMyAdmin to:

• Remove suspicious entries
• Change database table prefixes if using the default wp_
• Optimize and repair tables

Step 10: Scan Again & Test the Site

Run another full malware scan using security plugins to confirm your site is clean.

• Check your site speed and functionality.
• Make sure there are no redirects or strange pop-ups.

Step 11: Submit a Request to Google

If your site was blacklisted or flagged as “This site may harm your computer”, submit a reconsideration request in Google Search Console after confirming your site is clean.

How to Prevent Future Hacks

Recovering your site is just the first step—prevention is key. Here are essential tips:

• Install a security plugin like Wordfence or Sucuri
• Enable SSL (HTTPS) on your site
• Use strong passwords and 2FA
• Keep everything updated (core, plugins, themes)
• Regularly back up your site (use automated backups)
• Limit login attempts to block brute-force attacks
• Avoid nulled themes or plugins

Final Thoughts

A hacked website can be frustrating, but with the right steps, you can recover your WordPress site quickly and prevent future hacks. Security should never be an afterthought—invest time in hardening your site to keep your business, data, and customers safe.