Hacked WordPress site cleanup

Why does this happen?

A site gets hacked when an attacker finds a way to run their own code or log in as an admin. Once in, they add what makes them money: spam pages for Google, redirects to scam sites, or code that copies what shoppers type. Then they leave a backdoor, so they can get back in after you delete the spam.

The ways in we find most often, most common first:

• An outdated plugin or theme. When a security hole in a popular plugin is made public, automated bots scan for sites still running the old version. A site that has not been updated in months is exactly what they look for.
• A stolen or reused password. Attackers try leaked email and password pairs on the login page. If an admin reuses a password from another service and has no second login step, the attacker simply logs in.
• A nulled plugin or theme. Pirated copies of paid plugins often come with a backdoor already inside. The site is compromised the day it is installed.
• An abandoned plugin. A plugin its author no longer maintains never gets security fixes, even when a hole is known.
• Another site on the same hosting account. An old, forgotten install next to your site can be the way in, because the attacker can reach every folder the account can.

What the attacker leaves behind is rarely in one place. Backdoors hide in the uploads folder, in must-use plugins that load on every page and cannot be switched off from the Plugins screen, in the database, or as admin users hidden from the Users screen. That is why deleting the spam you can see is not enough, and why spam often comes back after a quick cleanup.

Try this first

These steps are safe on a live site and change nothing visitors see. Do them in this order.

1. Take a backup of the site as it is now. Use your hosting panel’s backup tool. Check it does not replace your older backups, and download a copy if the panel lets you, because some hosts keep only a few. It sounds odd to back up a hacked site, but it keeps the evidence of how they got in, and it gives you a way back if a cleanup step goes wrong. Do not restore an old backup yet.
2. See what Google sees. Search Google for site:yourdomain.com with your own domain. Pages in Japanese, pharmacy products or brands you do not sell mean spam has been injected. If you use Google Search Console, open Security & Manual Actions, then Security issues. Also check Settings, Users and permissions there for owners you do not recognise, because attackers sometimes add themselves.
3. Check your admin users and payment settings. In wp-admin, go to Users, All Users and click Administrator above the list. Write down any account you do not recognise. Do not delete it, because it helps trace the break-in, but open it, click Set New Password and save a long random one, so it can no longer log in. A hidden account may not show at all. On a store, also open WooCommerce, Settings, Payments and check each enabled method still connects to your own account. If a payout email or key has changed, contact your payment provider straight away.
4. Change your passwords from a clean computer. Change your WordPress admin password, your hosting and SFTP passwords and the password for the admin email account. Changing your WordPress password also signs out every other session on your account. This shuts out anyone using your old password, but it does not remove a backdoor, and some malware records passwords typed on the infected site, so we reset them all again after the cleanup.

Stop there and hand it over. Do not delete files you do not recognise or install several security plugins at once: on a store, removing the wrong file can take checkout down, and it wipes out the trail that shows how they got in. It is most urgent if your host has suspended the account, if checkout or payment settings were touched, or if the spam comes back after you remove it. Our guide to the real cost of a hacked WordPress site explains why acting early matters.

Why does the hack keep coming back?

Because the way in is still open, or a backdoor is still there. A cleanup that removes only the spam pages and the obvious malicious files can miss a second copy of the backdoor, a hidden admin account or a scheduled task that reinstalls the malware. One that removes everything but leaves the outdated plugin lets the same bot back in.

A thorough cleanup works in the opposite order to the hack. We find how the attacker got in, then remove everything they left, then close the way in and check every login. After that, regular updates matter most. On a care plan, BoltPress Security tells you in plain English when a plugin, theme or PHP version you run has a known security problem, and runs updates with a backup first. If the site is far behind, see WordPress update catch-up, and for the defences beyond the cleanup itself, see WordPress security hardening.

Is it a hack or something else?

Not every scare is a hack. A wave of failed orders with fake names is usually a card testing attack on your checkout, with no code on your site changed. A redirect that started right after a plugin update can be a setting, not malware. If you are not sure which you have, browse every fix on the Fix WordPress page.