Security
Cleaning WordPress after a hack: complete procedure
2 April 2025 · 7 min read
Cleaning a hacked WordPress website is more complex than removing a few suspicious files. Hackers place multiple backdoors, manipulate database entries and hide malware in places you do not expect. A thorough procedure is essential.
At WP Maintainer we perform cleanups weekly with a proven protocol that overlooks no back door. In this article we share our complete procedure.
Phase 1: Isolation (hour 0-1)
**Put the website in maintenance mode** Prevent visitors from seeing malware or your site being blacklisted by Google.
**Make a complete backup** Save a copy of the hacked state for analysis. This may contain evidence about the attack method.
**Change all passwords** WordPress admin, database, FTP, hosting panel, email accounts — everything. Use strong, unique passwords.
Phase 2: Detection (hour 1-4)
**Scan all files** Use multiple scanners (Wordfence, Sucuri, manual check). Compare all WordPress core files, themes and plugins with the official versions.
**Analyse the database** Check wp_users for unknown accounts, wp_options for suspicious entries and all tables for injected content.
**Check server logs** Look for suspicious access patterns, IP addresses and attacks. This gives insight into how the hack happened.
**Identify the attack channel** Was it a vulnerable plugin, a weak password, an outdated WordPress version or a compromise of the hosting?
Phase 3: Cleanup (hour 4-12)
**Remove malware and backdoors** All suspicious files are removed. Infected files are replaced with clean versions from the official repository.
**Restore or replace compromised themes and plugins** Remove all themes and plugins and reinstall clean versions. Check custom code manually.
**Clean the database** Remove unknown users, suspicious entries and injected content. Optimise all tables.
Phase 4: Recovery (hour 12-24)
**Update everything** WordPress core, all themes, all plugins, PHP version. Close all known security holes.
**Strengthen security** Implement a WAF, enable 2FA, limit login attempts, change the admin URL.
**Test everything thoroughly** Check all pages, forms, payments and functionalities. Test on different devices and browsers.
**Google Search Console** Check for warnings and submit a reconsideration request if your site is blacklisted.
Phase 5: Monitoring (ongoing)
After cleanup, continuous monitoring is essential. At WP Maintainer we monitor 24/7 and perform proactive maintenance to prevent recurrence. Our plans start at €49 per month.