Your WordPress Site Got Hacked — Here's the Exact Cleanup Checklist

Malware injections, fake redirects, blacklist warnings — the systematic process to clean a hacked WordPress site and keep it clean.

If you're reading this because your site is redirecting to a sketchy URL, showing pharma spam in search results, or flagged by Google Safe Browsing — stay calm. The cleanup process is mechanical. Follow it in order.

Step 1: Take the site offline

Don't try to clean a live site. Put up a maintenance page or restrict access by IP. Every hour a hacked site stays up is more SEO damage.

Step 2: Backup everything (yes, even the malware)

You need the infected files for forensics. Pull a full file + database backup before you change anything.

Step 3: Rotate every credential

WordPress admin passwords
Database password (update wp-config.php)
SFTP / SSH
Hosting control panel
Any API keys stored in plugins (Stripe, Mailgun, etc.)

Step 4: Replace WordPress core + plugins + theme

Don't 'scan and clean'. Delete /wp-admin, /wp-includes and all plugin folders. Reinstall fresh copies from official sources. For your theme, redeploy from version control if possible.

Step 5: Scan the database

Look for suspicious admin users, malicious wp_options entries (especially active_plugins, siteurl), and injected content in wp_posts. Tools like wp-cli help here.

Step 6: Submit for Google review

Once clean, request a review in Search Console. Most reclassifications happen within 72 hours.

How to stay clean

Enable 2FA on every admin account
Use a managed host with isolated containers
Install Wordfence or Patchstack and actually read the alerts
Run weekly automated backups stored OFF the server