Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Scan for outdated or missing drivers - takes under a minute3Clear out junk files and repair common Windows errorsIf your WordPress site is showing unfamiliar redirects, spam, unknown administrator accounts, or a security warning, treat it as a possible compromise. First preserve a copy of the files and database, then choose between restoring a verified clean backup and carefully repairing the installation. A scanner can help find problems, but it cannot prove the whole site is clean.
1. Check whether your WordPress site may be compromised
These signs are reasons to investigate, not a forensic diagnosis. Wordfence recommends treating a listed warning sign as a compromise until you can establish otherwise; WordPress.org also identifies blacklisting, host suspension, malware reports, and unauthorized accounts as warning signs (Wordfence; WordPress.org).
As an Amazon Associate I earn from qualifying purchases.
- Visitors are redirected to unfamiliar sites, or pages display injected spam or phishing content.
- You find administrator accounts, files, or recent file changes that you do not recognize.
- A browser, search service, hosting provider, or security scanner reports malware or unsafe content.
- You have lost access to the dashboard, or your host has suspended the site.
A single unusual file or scanner result may have an innocent explanation. Do not delete files or accounts solely because they look unfamiliar; investigate how they got there and what depends on them.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
2. Preserve a copy and involve your host if needed
Before changing files or database records, make a copy of the site’s files and database and keep it somewhere separate from the live installation. Treat this as an evidence and recovery copy, not as a clean backup: it may contain the malware. Wordfence recommends backing up before cleanup, and Sucuri specifically advises backing up before database changes (Wordfence cleanup guide; Sucuri cleanup guide).
#1 Best Overall
Check your host’s backup and incident-response procedures. If your host suspended the account or you cannot access the site, contact support before attempting dashboard or file-level changes. The host may need to restore access or investigate a problem affecting the server or other sites in the same environment.
3. Choose a recovery route
There is no universally best choice. The right route depends on whether a backup is known to be clean, how much content has changed since it was made, how customized the site is, the apparent extent of infection, and what access and technical skills you have.
| Option | Consider it when | Main trade-off |
|---|---|---|
| Restore a verified clean backup | You can identify a backup from before the compromise and confirm that it is safe to restore. | Changes made after that backup may be lost. A backup of uncertain cleanliness can restore the infection. |
| Inspect and repair the current installation | You need to retain newer content or customizations, or no trustworthy backup is available. | Finding and removing every affected file, account, and database entry is more demanding; overlooked access paths can allow reinfection. |
If you cannot confidently assess a flagged file, edit a database safely, or determine whether the problem extends beyond WordPress files, ask your host or a qualified WordPress incident-response professional to handle the cleanup. Wordfence also recommends expert help when an owner is not comfortable cleaning a site (Wordfence guidance).
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →4. Restore or repair without overwriting what you need
Restore only a backup you can trust
Choose a backup that predates the suspected compromise and is reasonably established as clean. Before restoring it, consider how much legitimate content, orders, or other data changed since it was created. If you cannot establish that the backup is clean, do not treat restoration alone as a fix; get help assessing it.
Repair files against trusted copies
For a manual repair, compare affected WordPress core, plugin, and theme files with clean originals for the matching versions. Replace compromised components with trusted copies, taking care to preserve custom or premium modifications you need. When replacing core files, do not overwrite wp-config.php or the wp-content directory; they contain site-specific settings and content.
A security scanner can identify candidate files and may help repair some of them, but it is not a complete restoration. Wordfence notes that its plugin does not fully restore a compromised site; infections can also involve the database, hidden backdoors, abandoned installations, or server-level issues (Wordfence help).
Review database content carefully
Make a fresh database backup before editing database records. Look for injected content or unfamiliar changes, but assess each finding in context and test the site after changes. Patterns such as eval or base64_decode are not proof of malware by themselves; some legitimate code uses these functions. Deleting visible spam without finding how it was inserted can leave the underlying access path intact.
5. Close likely access paths and harden the site
After removing the infection, address ways an attacker may have gained or retained access. Wordfence and Sucuri identify weak credentials, vulnerable or pirated extensions, exposed backups or configuration, abandoned tools, cross-infection, and unsupported server software among potential issues (Wordfence help; Sucuri cleanup guide).
- Review administrator accounts and other site users; remove or correct accounts you determine are unauthorized.
- Reset exposed WordPress, hosting, SFTP/FTP, and other relevant credentials. Enable two-factor authentication for administrators.
- Update WordPress core, plugins, themes, and relevant server software. Remove extensions, themes, and old installations you no longer use.
- Ask your host whether other sites or installations in the same hosting environment need inspection.
6. Verify the cleanup and clear external warnings
Run another security scan and check important pages and site functions. If the warning persists, investigate rather than assuming that the scan alone has cleared every infection. Once the site is technically cleaned, follow the warning service’s own process to request a review; contact your host separately if you need a suspension lifted. A review request does not clean the site (Wordfence cleanup guide; Sucuri cleanup guide).
If you use WordPress.com
This guide’s file and database repair steps are mainly for self-hosted WordPress. WordPress.com has a separate response path: reset passwords, enable two-step authentication, reset SFTP/SSH credentials where applicable, review activity logs and scans, update extensions, and contact WordPress.com support. Do not assume you have access to the same FTP or database tools as a self-hosted site; follow the instructions for your plan and access level (WordPress.com hacked-site support).
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
