Assume a WordPress site is compromised when you see unexplained redirects, spam pages, defacement, unfamiliar administrator accounts, new files, browser warnings, or a hosting suspension. Treat it as an incident: record what happened, preserve a complete snapshot, contain access, inspect both files and the database, replace compromised code, remove persistence mechanisms, rotate every credential, harden the installation, and then verify Google’s security status.
What to do first when a WordPress site may be hacked
Do not begin by deleting the first suspicious file you find. A backdoor can recreate deleted malware, and an infected computer can immediately put the replacement credentials back in the attacker’s hands. The safest order is documentation, containment, preservation, investigation, cleaning, credential rotation, hardening, and verification.
As an Amazon Associate I earn from qualifying purchases.
Record the indicators of compromise
Write down the exact time and date you noticed each symptom. Save browser-warning text, screenshots, affected URLs, redirect destinations, unfamiliar user names, modified-file paths, host notices, antivirus alerts, and any Search Console messages. Include whether the problem appears for every visitor or only logged-out users, mobile visitors, a particular country, or a particular URL. This timeline helps distinguish a one-time defacement from an active reinfection.
Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Repair Windows errors before they cause bigger problems3Fix the driver behind crashes, sound loss and screen glitches- Unexpected redirects, pop-ups, downloads, or phishing pages
- Defaced pages, altered titles, or spam topics you did not publish
- Unknown administrator or editor accounts
- Files you cannot explain, especially PHP files in uploads or the document root
- Unexpected changes to themes, plugins, configuration, or scheduled tasks
- A host suspension, abuse notice, browser warning, or antivirus detection
Confirm the public symptoms
Search Google for site:example.com, replacing the domain with yours. Look for indexed pages, titles, languages, casino or pharmaceutical terms, and URL paths that nobody on your team created. Google says unexpected indexed pages can be evidence of a hack, even when the home page looks normal.
#1 Best Overall
- [Ultra-Lightweight Ear Buds Designed for Small Ears] Each earbud weighs only 3.7g and features a compact, ergonomic in-ear design made especially for small ears. Secure, low-profile, and comfortable for workouts, all-day wear or overnight sleeping.The ultra-slim profile sits flush in your ear with no hard edges poking or rubbing, so you can even sleep on your side without discomfort.
- [Immersive Stereo Sound with TOZO OrigX Technology] TOZO OrigX tuning delivers clear vocals, balanced mids, and natural stereo sound for music, podcasts, and videos.
- [Long Battery Life for Daily Use] Get up to 7 hours of playtime on a single charge, with up to 32 hours total using the charging case—ideal for workdays, commuting, and extended listening sessions.
- [Bluetooth 5.3 & Stable Connection] Bluetooth 5.3 provides fast pairing, stable wireless performance, and reduced dropouts as you move around home or office.
- [Deep Bass with Clear Vocals] High-performance drivers produce punchy bass while keeping vocals clean and detailed for everyday listening.
Open the Security Issues report and messages in Google Search Console. That report lists hacked pages Google detected and gives issue-specific instructions. Also check Google Safe Browsing or the warning shown by the browser, plus security or abuse notices from your host. A warning can reflect malware, a hacked page, or phishing content; it does not identify the exact file that must be removed.
Contain the incident without destroying evidence
Involve the host early
Tell the hosting provider that you are investigating a compromise and ask for relevant access logs, malware notices, account isolation, and a snapshot if those services are available. On shared hosting, another site or account may be involved, and your host may need to isolate the account before cleanup. If the host has suspended the account, follow its reactivation and evidence-preservation process instead of repeatedly trying to log in.
Limit administrative access
Until you know the entry point, restrict access to the dashboard and file-transfer services where practical. Use a temporary allowlist or maintenance restriction if your host supports one. Do not install an unfamiliar “cleanup” plugin into a site you already suspect is executing attacker code. Perform sensitive work from a known-clean computer and a trusted network.
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Take a complete snapshot
Preserve the current state even if it is infected. Keep a copy of every site file, the database dump, web-server logs, PHP or application logs, and the list of users and scheduled tasks. Label the snapshot with the time and never treat it as a clean backup. A second copy on separate storage protects evidence if the live account is altered during cleanup.
If you have a backup from before the first observed compromise, check that it is actually clean before restoring it. Compare its date with the timeline, scan it, and inspect its files and database. A restore that contains the original backdoor simply gives the attacker a fresh starting point.
Rank #2
- 【IP68 Waterproof Multifunctinal Smart Watch】Torjalph fitness activity tracker smart watch is IP68 waterproof technology ,you can wear it when swimming,handwashing,it's rain-proof which means that you perform multiple exercise modes outside without worrying about sweat or rain corroding your fitness smart watch,and this watch equipped with a 230 mAh large capacity battery magnetic charging ,and this sports activity tracker watch can be used 5-7 days If fully charged.
- 【Larger 1.83'' Full Screen Watch & Multi-dial Selection】1.83 inch full HD color touch screen smart watch for men / women provides excellent 240*284 resolution image quality ,This Bluetooth smart watch offers a better touch experience and remarkable immersion and ,more than 200 watch faces for you to choose from App"Da Fit ", you can change the dial style according to your mood to wear keeping the world on your wrist
- 【Accurate Activity Tracker Smart Watch 】sports watch activity tracker uses sweat and dust resistant breathable silicone strap, our Fitness Tracker Smart Watch for Android iOS Phones supports 12 sports modes,walking,running,bicycle,swimming,badminton,basketball,football,rope skipping. This bluetooth calls smart watch for men women is lightweight and stylish, bringing more convenient and relaxing sports experience while also providing more protection.
- 【Your 24 Hour Personal Daily Health Monitor】Fitness watch for women men full touch screen IP67 waterproof bluetooth smartwatch for Android iOS Phones with heart rate blood pressure monitor multifunction Andriod smart watch with steps counter sleep monitor sports fitness watch, monitoring blood oxygen saturation allows you to understand your physical condition in real time to track fitness progress ,to know your health status in time.
- 【More Functions Bluetooth Call Smart Watch】This fitness activity smart watch full screen for iPhone and Android phones includes a bunch of new features including:The bluetooth smart watch can hang up the phone, receive and display WhatsAPP /Text /Facebook /Twitter /Messenger reminder.Support sedentary reminder, alarm clock, stopwatch, timer,weather information,music control, remote camera control compatible with Android 5.0 and above or iOS 9.0 and above smartphones.
How to investigate a WordPress installation
Compare files with a known-clean copy
The most reliable way to identify altered files is to compare the installation with a known-clean backup or the official package for the exact WordPress version. Record file paths, modification times, ownership, permissions, and hashes where your host provides them. A recent timestamp is a clue, not proof: attackers can preserve timestamps, and legitimate updates change many files.
Pay particular attention to:
- New PHP files in the document root,
wp-admin,wp-includes, plugin directories, theme directories, and uploads - Legitimate files containing obfuscated, encoded, or unexpectedly remote-executed PHP
- Configuration files, web-server rules, and files beginning with a dot
- Upload directories containing scripts rather than images or documents
- Diagnostic files, web shells, mailers, or files with random names
Use a reputable remote scanner as a second view of the public site, but do not treat a clean remote result as proof that the server is clean. A scanner may not see code that runs only for logged-out visitors, a particular referrer, or a direct request to an obscure file. Also scan every local computer used to administer the site. WordPress.org warns that malware on a workstation can steal FTP or /wp-admin credentials and re-infect a cleaned site.
Inspect accounts and persistence
List all WordPress users, their roles, registration dates, email addresses, and recent activity. Remove accounts that no owner can explain, but preserve their details in your incident notes first. Check hosting-panel, FTP/SFTP, SSH, database, email, API, and deployment accounts as well; a WordPress user may not be the original entry point.
Review scheduled actions in WordPress and server-level cron jobs. Attackers can schedule code that recreates a deleted file. Examine web-server rewrite rules, auto-prepend settings, PHP configuration, deployment hooks, and any maintenance scripts. Search logs for requests that created users, uploaded files, edited options, or accessed unusual PHP paths.
Inspect the database
Search posts, pages, widgets, options, navigation menus, and plugin tables for injected scripts, hidden iframes, spam links, redirects, and unfamiliar administrator records. Check for malicious JavaScript in fields that normally contain formatted content and for options that load external code or alter the site URL. Export the database before making edits. Removing a suspicious row without understanding its purpose can break the site and erase evidence.
Rank #3
- [Low Noise High Fidelity] New bee guitar cord with 22AWG oxygen-free-copper center conductors provides enhanced signal transfer, the PVC insulation material and the high-density stranded copper double shield provide noise rejection for quiet operation
- [Ideal for Choice] New bee 1/4 straight and right angle metal connectors, ensures a secure connection in any instrument, pedal, or amp jack. L shape great fro on stage guitar stands
- [Wide Compatible] Suitable for mixer, power amplifier, microphone, effector, decoder, equalizer, electoronic organ, electric guitar, electric bass and other electronic equipments. Widely used in the installation of smart home, karaoke speaker, professional stage audio, etc
- [Easy Disassemble] Making incidental repairs quick and easy! Very nice, flexible cable
- [Dont Hesite to Order] 24 hours customer services and professional technology team are standing by
Clean the site in a controlled sequence
1. Replace WordPress core files
Download the exact matching WordPress release from WordPress.org. Using FTP or SFTP, replace the core directories and files with the clean package while preserving wp-config.php and the wp-content directory. Do not assume an administrator-side reinstall is sufficient: an attacker may have added files that a reinstall does not remove. Verify that the downloaded archive is from the official source and that the version matches the site’s database and requirements.
2. Reinstall plugins and themes from trusted sources
For every plugin and theme, record whether it is required, supported, and obtained from an authorized source. Delete abandoned or unknown components rather than merely deactivating them. Remove the existing directory and install a fresh copy from the official directory or the vendor that supplied it. Never replace only the file that a scanner named if other files in the same component may also be altered.
Inspect custom code separately. A bespoke theme, mu-plugin, integration, or build artifact cannot be safely replaced by a generic package; compare it with your version-controlled or known-clean copy and have its author review unexpected changes.
3. Handle uploads and other writable directories
Uploads should normally contain media and documents, not executable PHP. Remove malicious scripts only after preserving the snapshot and confirming they are not legitimate application files. Review directory permissions and web-server rules so an uploaded file cannot execute as server-side code where your platform supports that restriction.
4. Remove database injections and unknown accounts
Clean malicious content from the database, remove unauthorized users, and review options that control redirects, admin email addresses, home URLs, or code-loading behavior. Use a transaction or a tested backup when making bulk changes. Afterward, test login, publishing, media uploads, forms, search, feeds, and any e-commerce or membership functions that depend on those tables.
Free tools Windows power users keep installed
One-click scans. No signup required.
Rank #4
- Digital Family Calendar: BSIMB digital calendar wall touch screen puts an end to your chaotic life. Designed for busy families, the digital calendar keeps you organised and in step with your family. Assign different colours and tasks to each family member to make family scheduling easier and more intuitive.
- Easy Setup and Auto-Sync: Plug in, connect to WLAN and auto-syn your electric calendar in minutes. Digital wall calendar compatible with Google calendar, iCloud calendar, Outlook calendar, Cozi calendar and Yahoo calendar. Add events directly on the device or through the ecalendar app. Electronic calendar stays current whether you're at work or traveling—no manual updates needed.
- All-In-One Home Assistant: Smart calendar builds habits and encourage independence with personalised chores. Display daily meal plan to reduce the daily ‘What's for dinner?’ stress. To-do lists keep track of everything you want. Turning chores into valuable achievements with stars and rewards, making life easier and more enjoyable.
- Manage Anytime Anywhere: BSIMB electronic calendar for family stay connected with the powerful ecalendar app. Access and manage your digital wall calendar anytime, anywhere with free features like stars & rewards, photo screensaver, chore charts, meals plans, to-do lists etc. Electronic planner paid features like Magic Import tailor advanced tools for users with special needs.
- Stay in Touch with Loved Ones: Share photos or videos from your phone to electronic wall calendar with app, instantly update your life moment, and keep in touch with your family, especially those who are far away; you can also surprise your smart calendar digital wall by sending him a wish card; it's also great for keeping tech-illiterate elders in touch with the youngsters.
5. Find and remove the backdoor
A backdoor can be a newly added PHP file, a few altered lines inside a legitimate file, a hidden administrator, a scheduled task, a database payload, or stolen credentials used through a normal login. Search for code that is heavily obfuscated, dynamically evaluates input, decodes long strings, fetches remote content, creates users, or writes files without a clear business purpose. Context matters: some legitimate libraries also use encoding or dynamic loading, so verify against a clean release or have an experienced PHP professional review it.
Delete the persistence mechanism as well as the visible payload. If a file returns after deletion, stop making isolated edits and investigate cron, credentials, server access, and database-triggered code. File deletion alone is not remediation when the entry point remains active.
Rotate credentials after the code is clean
Change credentials only after replacing compromised code, and do it from a known-clean device. Rotate each category, not just the main administrator password:
- Every WordPress administrator, editor, and other user who can upload or edit code
- Hosting-panel and server accounts
- FTP, SFTP, SSH, deployment, and version-control credentials
- Database users and passwords
- Email accounts associated with administration or password recovery
- API keys, webhooks, payment integrations, and other connected services
Use long, unique passwords and remove unused accounts. WordPress.com recommends resetting the account, WP Admin, and other user passwords; WordPress.org advises changing passwords again after the site is clean. Revoke active sessions and tokens where the service provides that control. If a local computer was infected, clean or rebuild it before using the new credentials.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Update and harden the recovered site
Bring WordPress, every retained plugin, and every theme up to supported versions. Remove components that are abandoned or no longer needed. Give each person the least-privilege role required for their work, restrict administrative access where practical, and require strong authentication for privileged accounts.
Enable file-integrity monitoring or a security tool that alerts when files are added, changed, or removed. Keep tested, offline or separately stored backups and document how to restore them. Review PHP and web-server permissions, disable unnecessary write access, protect configuration secrets, and keep logs long enough to investigate a future incident. Hardening guidance from WordPress.org emphasizes official releases, account discipline, security plugins, and integrity monitoring; these controls reduce reinfection risk but do not replace updates and backups.
Verify that cleanup worked
Test the site as an owner and a visitor
- Run a second remote scan and a local scan from a clean workstation.
- Review web-server, WordPress, hosting, and scheduled-task logs for new suspicious activity.
- Open the home page, representative posts, search, feeds, forms, logins, media URLs, and any transactions.
- Test logged-in and logged-out views, mobile rendering, and a page that previously redirected.
- Watch for new files, users, redirects, or database changes over the next several days.
Clear search and browser warnings
In Search Console, fix every listed Security Issues item, not just the page that first alerted you. Search again with site:example.com for residual spam or phishing URLs. Verified owners can use Search Console to investigate and request or monitor recrawling. Google says a Safe Browsing warning may remain until a later crawl confirms that the issue has been fixed; it is not evidence that the cleanup failed during the interval before recrawling.
Choose the right remediation option
The choice is not simply “plugin or no plugin.” Compare the coverage and responsibility of each option before touching production files.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Clear out junk files and repair common Windows errorsFree Scan →| Option | What it can cover | Main limitation | Best fit |
|---|---|---|---|
| Remote scanner | Public pages, redirects, visible malware, blacklist signals | May miss dormant, authenticated, server-side, or database-only code | Initial triage and post-cleanup verification |
| Self-service scanner or integrity tool | Added, changed, or removed files and some known malware patterns | Requires you to interpret results, edit files safely, and investigate the entry point | Owners comfortable with backups, PHP, databases, and server access |
| Manual cleanup | Files, database, users, scheduled tasks, credentials, and configuration when investigated thoroughly | Easy to miss persistence or destroy evidence | Small sites with a trustworthy backup and experienced operator |
| Managed incident response | Forensics, file and database cleanup, backdoor hunting, blacklist and host coordination, and follow-up monitoring, depending on the service | Cost and the need to grant controlled access to a third party | No clean backup, repeated reinfection, sensitive data, suspension, or limited technical skill |
A service that only scans is not the same as one that restores, removes backdoors, rotates credentials, coordinates with the host, and monitors for recurrence. Ask specifically whether the provider handles both files and databases, identifies the original entry point, supports backup and restore, remediates accounts and credentials, assists with host or blacklist notices, and provides post-cleanup monitoring.
When to stop and hire a specialist
Escalate instead of experimenting when you have no trustworthy pre-compromise backup, the infection returns after a complete cleanup, the site stores sensitive or regulated information, the host has suspended the account, or you cannot safely use SSH, SFTP, database tools, and logs. A managed malware-removal service can be appropriate for suspected infection or blacklist status, but confirm its scope, evidence handling, credential process, and follow-up monitoring before granting access.
Quick Recap
Common cleanup mistakes and their fixes
- Deleting only the visible spam page: inspect files, databases, users, and scheduled tasks because the page may be a symptom of a deeper backdoor.
- Restoring an unverified backup: scan and compare the backup first; otherwise the same persistence mechanism returns.
- Changing one WordPress password: rotate hosting, transfer, database, email, API, and connected-service credentials as well.
- Cleaning from an infected laptop: scan or rebuild the workstation before entering new credentials.
- Trusting a clean home page: check logged-out views, obscure URLs, uploads, Search Console, Safe Browsing, and indexed results.
- Reinstalling without removing added files: replace core through FTP or SFTP and inspect the entire installation.
- Deleting unknown content without a snapshot: preserve evidence and understand the file or database row before removal.
- Ignoring reinfection: treat a returning file as evidence that an entry point, credential, cron job, or database payload remains.
A practical recovery checklist
- Record symptoms, URLs, warning text, users, files, and timestamps.
- Notify the host and restrict unnecessary access.
- Capture a full snapshot of files, database, and logs.
- Locate a dated, known-clean backup and verify it.
- Scan the public site and every administration workstation.
- Compare files with the matching official WordPress package and clean copies of plugins and themes.
- Inspect uploads, configuration, logs, cron jobs, database content, and all accounts.
- Replace core and reinstall trusted components; remove persistence mechanisms.
- Rotate every credential and revoke sessions or tokens.
- Update, remove abandoned code, apply least privilege, and enable integrity monitoring.
- Re-scan, test important functions, monitor logs, and watch for reinfection.
- Fix all Search Console security issues and monitor Google recrawling and Safe Browsing status.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
