Hacked WordPress site: cleanup and return to safety
It’s not enough to delete the spam article: you find the entry point and close it.
Is your WordPress site showing pages you didn’t create, has it ended up on a Google blacklist or does it lead to unknown sites? I step in personally: first I make a copy of everything, then I identify the entry point, remove malware and backdoors, restore the site and close the hole. Then I put it under monitoring and, when needed, request a review from Google.
What hacked WordPress site recovery includes
recovery of a hacked WordPress site is the work that brings a compromised site back to a clean, protected state: identifying the entry point, removing malware, backdoors, unauthorized plugins and users, cleanup of files and database, regenerating credentials and, if needed, requesting a review from Google. I do it personally, with no intermediaries, and link it to ongoing maintenance and security and to SEO consulting for the recovery of rankings.
Backup before touching anything
A complete copy of files and database before any change. Every later intervention stays reversible: things are moved, not deleted.
Read-only forensic analysis
File dates, folders mu-plugins, suspicious plugins and themes, users, application passwords, server access logs and database queries.
Cleanup of files and database
Fake plugins and themes, hidden backdoors, injected code, spam articles and pages, unrecognized administrator users.
Closing access
Application passwords revoked, sessions logged out, new credentials for WordPress, hosting, FTP and database, security keys regenerated, two-factor authentication.
Updates and hardening
Update of core, plugins and themes, removal of what isn’t needed, blocking of xmlrpc.php and of missing security headers.
Report and SEO recovery
A report with every intervention and how to roll back. Then Search Console: spam URLs to remove, manual actions, review request.
The method: from backup to review request
Backup and snapshot of the state
Full backup of the account, then a list of users, plugins, themes, settings and recently modified files. You work on a safe copy, not blindly.
Reconstructing the timeline
File dates, server logs and database tables tell what happened and when. It serves to understand where the attacker came in from, not just what they left behind.
Quarantine, not deletion
Suspicious components are moved to a folder outside the site. If something was really needed, it goes back in its place in a minute.
Closing access
Revoking application passwords, logging out sessions, changing credentials and keys, checking administrator users.
Update and reinforcement
Core, plugins and themes updated, abandoned components removed, firewall and scanning active, the most commonly attacked points blocked.
Search Console and monitoring
Removal of spam URLs from the index, checking manual actions, review request if needed, then periodic checks to notice a second attempt in time.
Signs of a hacked WordPress site and where to look
| Sign | What it may indicate | Where to check |
|---|---|---|
| Articles or pages you didn’t write | Stolen administrative access or an active application password | List of articles, authors, users table and metadata |
| Unknown administrator users | Account created by the attacker | Users in the dashboard, or wp user list --role=administrator |
| Plugins or themes you don’t remember | Fake components, often with a numeric name | Folders wp-content/plugins and themes, sorted by date |
| Plugins that don’t appear in the list | Backdoor in the folder mu-plugins, which WordPress always loads | Direct check on the server |
| Google results with text in other languages or about casinos and betting | Spam content indexed under your domain | Search site:yourdomain.com and Search Console |
Spikes of requests to xmlrpc.php or wp-login.php | Brute-force attempts in progress | Server access logs |
| Security warnings or a sudden traffic drop | Google flag or pages removed from the index | Search Console, Security and Manual actions sections |
Why a hacked WordPress site is an SEO problem
A compromised site doesn’t only lose security: it loses trust. Spam pages end up under your domain and in Google’s index, the site can receive security warnings or a manual action, and those searching for your service find results with text you didn’t write. Google describes hacked sites and the recovery path in the documentation for site owners.
That is why recovery doesn’t stop at cleanup. Deleted spam articles return a 404 error until Google removes them from the index: they must be checked in Search Console and reported. If a manual action exists, a review is requested only once the site is clean and credentials have been changed; otherwise the request is rejected and timing gets longer. Those who already follow the site with SEO consulting too have the advantage of a history of data to compare against.
Deleting spam articles without finding the entry point means making room for the next one.— Andrea Viggiano, recovery method
A real case of a hacked WordPress site, in brief
A WordPress site of a real estate agency, built with Elementor, had been publishing casino and betting spam for over a month without anyone noticing. The analyses showed a compromised administrator account, a backdoor installed in the folder mu-plugins about two months earlier, more than 25 fake plugin and theme folders and 66 spam articles published through the REST API. In parallel, the site was suffering about 17,700 brute-force requests a month on xmlrpc.php.
The work was done in one day: backup, quarantine, revocation of the application password, update of 15 plugins, a second backup once the cleanup was finished. The report also indicated what I still didn’t know: how the credentials had been stolen. The complete technical timeline, without names, is in the article hacked WordPress site: anatomy of a real case.
The mistakes that leave the site hacked even after cleaning
- 01
Deleting only the spam content
If the backdoor stays, the articles come back. The symptom is not the problem.
- 02
Not changing credentials
With the same password the attacker comes back in through the door they came in by.
- 03
Restoring a backup without understanding the cause
A clean backup becomes infected again if the vulnerability has stayed open.
- 04
Forgetting the mu-plugins folder
Must-use plugins don’t appear in the plugin list and activate on their own. Many cleanups don’t look at them.
- 05
Ignoring application passwords
They survive a password change and allow publishing via API without logging in.
- 06
Neglecting Search Console
Spam pages stay in the index and the SEO damage continues even with a clean site.
After the cleanup: prevention, WordPress and content
Prevention. After a recovery, the highest risk is relapse. Updates with a backup beforehand, two-factor authentication on administrator accounts, few administrators and security headers are the content of the ongoing maintenance and security.
WordPress. If the site has more problems than strengths, sometimes it pays to rebuild it: I talk about it on the page about WordPress site creation.
Content. After an intrusion it pays to reread the legitimate articles and check that no text has been altered or has hidden links: this too is part of the recovery.
To learn more about website creation
Blog guides on the topic of this page.
Hacked WordPress site: anatomy of a real case
Has your WordPress site been hacked?
Write to me what you see: I will answer personally. I’ll tell you what to check right away and whether the recovery is a job of hours or of days.
Request site recoveryFrequently asked questions about recovering a hacked WordPress site
How do I know if my WordPress site has been hacked?+
The most common signs are articles or pages you didn’t write, unknown administrator users, plugins you don’t recognize, Google results with text on topics that aren’t yours, warnings in Search Console and spikes of requests in the logs. A compromised site can look normal to a visitor: you need a check of files, users and logs.
Can I simply restore a backup?+
Only if the backup predates the compromise and the vulnerability is closed immediately afterwards. Otherwise the site gets reinfected. That is why, before restoring, you reconstruct the timeline and change the credentials.
How long does recovery take?+
It depends on severity: from a few hours for a contained case to several days if there are multiple backdoors or a very dirty database. After a first check I tell you which of the two cases it is. SEO recovery in Search Console then takes time that doesn’t depend on me.
What is a backdoor and why does the problem come back?+
It is a file left by the attacker to get back in whenever they want, even after cleanup. It can hide in a folder such as mu-plugins, in a theme or in a fake plugin. If it isn’t found, the site becomes compromised again.
What are application passwords and why should they be checked?+
They are separate credentials that WordPress generates for applications using the REST API. Whoever has them can publish and edit content without going through the login, and they stay valid even if you change the user’s password. They must be listed and revoked.
Does Google penalize a hacked site?+
It can show security warnings, remove pages from the index or apply a manual action. It doesn’t always happen. You check in Search Console and, if needed, request a review once the site is clean.
Do you delete the spam articles?+
I move them to the WordPress trash, which is reversible. The permanent deletion is done by the owner after checking there is nothing to recover. The spam URLs must then be reported to Google.
Does the recovery include future maintenance?+
No, they are two separate jobs: recovery solves the emergency, the maintenance keeps it from happening again. After an intrusion I recommend having it, but it is your choice.