Clean up a hacked WordPress site

Signs of a hacked WordPress site include redirects to spam pages, unknown admin users, Google "This site may be hacked" warnings, strange files in wp-content/uploads or emails from Imunify360 about malware. Act quickly but methodically: a half-finished cleanup usually leaves a backdoor behind and the site is reinfected within days.

Before you start

• cPanel access and an administrator account in WordPress (or database access if you are locked out).
• A list of plugins and themes you use, with licence keys for premium ones so you can download clean copies.
• Time: a careful cleanup of a typical site takes one to three hours.

Contain the attack

1. Change your cPanel password in the MdmHost dashboard and your WordPress admin passwords from a clean computer.
2. Take a backup of the infected site anyway, in cPanel → Files → Backup or JetBackup. You may need it to recover content or to investigate.
3. If the site sends visitors to malicious pages, put up a maintenance page temporarily so you do not lose search rankings or infect visitors.

Check whether a clean backup exists

The fastest cure is often a restore. Open cPanel → JetBackup → File Backups and Database Backups and look for a restore point from before the first symptom. Restore files and database from the same date, then go straight to the hardening steps below. You lose content written after that date, so export new posts first if needed.

Scan with Imunify360

1. Open cPanel → Security → Imunify360.
2. Start a scan of your home directory and wait for it to finish.
3. Review the list of infected files and use Clean up where offered. Imunify360 keeps a copy of each original so you can restore one if the cleanup breaks a file.

Replace core, plugins and themes

1. Download a fresh copy of WordPress for your exact version. Delete wp-admin and wp-includes on the server and upload clean ones. Replace the root PHP files except wp-config.php.
2. Delete every folder in wp-content/plugins and reinstall plugins from wordpress.org or the vendor. Do the same for themes.
3. In wp-content/uploads search for files ending in .php. Uploads should only contain media; delete any PHP file you find there.
4. Open wp-config.php and .htaccess and remove anything you do not recognise, such as long encoded strings or auto_prepend_file lines.

Clean the database and users

• In Users → All Users delete administrator accounts you did not create.
• In phpMyAdmin search the options and posts tables for <script, eval( and unknown domains.
• Generate new security keys and salts in wp-config.php. This logs out every session, including the attacker's.
• Change the database user's password in cPanel → Databases → Manage My Databases and update DB_PASSWORD.

Prevent reinfection

• Find the entry point: an outdated plugin is the most common cause. Make sure everything is now current.
• Enable 2FA for all admins and disable file editing in wp-config.php.
• Check other sites in the same cPanel account. An infected neighbouring install can reinfect a cleaned one.
• If Google flagged the site, request a review in Google Search Console under Security & Manual Actions.

Next steps

• Harden WordPress after the cleanup
• Set up a reliable WordPress backup routine
• Fix file permissions