WordPress Site Hacked? Emergency Recovery & Triage Guide

Discovering that your WordPress site has been compromised is one of the most stressful events an online business owner or agency manager can experience.

Whether visitors are getting redirected to scam domains, Google Search Console is flagging crimson "Deceptive site ahead" warnings, or your wp-admin access has been revoked, the instinct is often to panic and hit restore or install five different security plugins.

In this guide, we break down the exact triage methodology our engineering team uses to clean infected WordPress installations, eliminate backdoors, and harden the server to prevent recurring attacks.

---

1. Immediate Damage Control (What NOT to Do)

When a compromise occurs, site owners often inadvertently destroy forensic evidence or corrupt their databases by taking hasty actions. Follow these rules first:

• DO NOT blindly restore a backup without scanning: Attackers often plant stealth backdoors weeks or months before activating spam redirects. Restoring a 7-day-old backup frequently re-introduces the identical vulnerability.
• DO NOT install multiple heavy security plugins simultaneously: Running Wordfence, Sucuri, and iThemes at the same time on an already overloaded PHP process pool will exhaust memory limits and cause HTTP 504 Gateway Timeouts.
• DO NOT delete the entire uploads directory: Doing so will destroy your product images, client attachments, and media library permanently.

Immediate First Step: Put your domain behind Cloudflare or enable "Under Attack Mode" to filter malicious bot scrapers while you work, and export a complete snapshot of both files and database in their current state for analysis.

---

2. Identifying the 4 Most Common WordPress Hacks

Understanding what the malware is attempting to accomplish determines where it hides:

Type A: Malicious Spam Redirects

Visitors arriving from Google search results get silently redirected to phishing, casino, or fake tech-support pages, while direct visits or logged-in administrators see the normal site. This is typically injected into .htaccess, the theme's functions.php, or the wp_options table.

Type B: The Japanese SEO Spam Injection

Automated scripts generate thousands of fake product pages written in Japanese or Russian characters, flooding your Google index and destroying your search rankings. This malware injects rogue files into wp-content/uploads/ and creates virtual rewrite rules.

Type C: Rogue Administrator Creation

A backdoor script creates a hidden administrator user (often masquerading as wp_admin_support, backup_user, or a random string) to retain administrative access even after core updates.

Type D: Base64 / Eval Web Shells

Lightweight PHP files (such as class-wp-cache.php, alfa-rex.php, or disguised files inside wp-includes/) that allow attackers to execute arbitrary shell commands and upload new payloads at will.

---

---

3. The 6-Step Engineering Clean-up Process

Here is the systematic CLI-driven workflow for recovering an infected WordPress instance:

Step 1: Export Forensic Database & File Snapshots

Before modifying a single file, create a clean archive of your database:

wp db export pre-cleanup-backup.sql
tar -czf site-files-backup.tar.gz .

Step 2: Nuclear Replacement of WordPress Core

Never try to manually clean thousands of infected core files. Replace them with fresh, verified binaries directly from the official WordPress.org repository:

# Delete infected core directories
rm -rf wp-admin wp-includes
# Download fresh WordPress core without touching wp-content or wp-config
wp core download --skip-content --force
# Verify cryptographic checksums of core files
wp core verify-checksums

If wp core verify-checksums returns "Success: WordPress installation verifies against checksums", your core files are 100% clean.

Step 3: Purge and Reinstall Plugins & Themes

Malware frequently modifies legitimate plugin files to hide logic bombs: 1. Make a list of active plugins: wp plugin list --status=active. 2. Delete the wp-content/plugins/ directory completely. 3. Re-install all active plugins directly from WordPress.org or verified vendor zip files. 4. If using a custom theme, inspect functions.php and header.php using git diff against your original repository.

Step 4: Scan the Uploads Directory for Executable PHP

The wp-content/uploads/ folder should only ever contain static media (images, PDFs, videos). It should NEVER contain executable .php files. Run this command to identify any hidden shells:

find wp-content/uploads/ -type f -name "*.php"

Any PHP script found inside uploads is almost certainly malicious and must be quarantined immediately.

Step 5: Database Payload Audit

Search your database for common injection patterns and rogue admin accounts:

-- Find newly created administrators
SELECT ID, user_login, user_email, user_registered 
FROM wp_users 
ORDER BY user_registered DESC LIMIT 10;
-- Verify core site URLs haven't been hijacked
SELECT option_name, option_value 
FROM wp_options 
WHERE option_name IN ('siteurl', 'home');

Remove any unauthorized users immediately and verify that siteurl points to your official domain.

Step 6: Regenerate WordPress Secret Salts

All active login cookies and session tokens must be invalidated so attackers cannot use hijacked session cookies. Generate fresh salts from the official API (https://api.wordpress.org/secret-key/1.1/salt/) and replace the AUTH_KEY through NONCE_SALT constants in wp-config.php.

---

4. Server-Level Hardening: Preventing Re-Infection

Cleaning the files is only half the battle. If the vulnerability that allowed the breach remains unpatched, the site will be re-infected within 48 hours.

A. Block PHP Execution in Uploads via NGINX

Even if an attacker finds an upload vulnerability, configure your web server to refuse to execute PHP code within media folders:

# In your NGINX site configuration
location ~ /wp-content/uploads/..php$ {
    deny all;
    access_log off;
    log_not_found off;
}

B. Disable the In-Dashboard File Editor

Prevent compromised admin accounts from editing PHP theme files directly in the browser by adding this to wp-config.php:

define('DISALLOW_FILE_EDIT', true);

C. Protect XML-RPC and Admin Endpoints

Automated brute-force attacks hammer xmlrpc.php to test thousands of password combinations. Block XML-RPC completely if you do not use the Jetpack or mobile app:

location = /xmlrpc.php {
    deny all;
}

---

How Minguki Protects Production WordPress Sites

At Minguki, we don't believe in passive maintenance. For clients like WP Site Patrol (where we manage and secure 25+ commercial WordPress sites), we deploy proactive server-level isolation, daily automated staging syncs, and real-time vulnerability tracking.

Read our full WP Site Patrol Case Study to see how our engineering care keeps commercial sites online with zero incidents.

---

Need Emergency Triage or Long-Term Care?

If your WordPress website is currently infected, displaying security warnings, or you want an expert team to take over updates and maintenance, we are ready to assist.

Explore our Managed Website Services or schedule a technical discovery call with our lead engineer to restore and protect your site.