How to Clean a Hacked WordPress Site (Step-by-Step Backdoor Removal)

Waking up to find your website displaying Google's red "Deceptive site ahead" warning screen, redirecting mobile visitors to spam casino links, or filled with thousands of spam Japanese indexed pages is every business owner's worst nightmare. In minutes, paid ad campaigns get suspended, sales halt, and search rankings plummet.

Simply reinstalling WordPress or deleting a single suspicious file almost never works because modern malware leaves hidden, obfuscated PHP backdoors that re-infect your files every night via cron jobs. In this forensic tutorial, we show you the exact step-by-step methodology our security team uses to clean and harden hacked websites permanently.

Step 1: Immediate Triage & Isolation

Before modifying any code, prevent hackers from destroying evidence or stealing live customer database records:

1. Create a Full Forensic Backup: In cPanel or via SSH, create an uncompressed tarball of your public_html directory and a complete MySQL mysqldump.
2. Put the Site in Maintenance Mode: If you run an e-commerce store, display a clean static maintenance page to protect customer transactions while you disinfect.
3. Verify Blacklist Status: Check your domain and IP on our free IP & Domain Blacklist Checker to identify which security authorities (Google Safe Browsing, McAfee, Norton) have flagged your URL.

Step 2: Hunting and Eradicating PHP Backdoors

Hackers disguise backdoors inside innocent-looking core directories like /wp-includes/, /wp-content/uploads/, or root index.php files using functions like eval(), base64_decode(), gzinflate(), and str_rot13().

Connect via SSH and search for recently modified or suspicious PHP files inside the media uploads folder (where PHP files should never exist):

# Find any PHP files inside uploads directory
find wp-content/uploads/ -type f -name "*.php"

# Search for common obfuscation payloads
grep -rnw public_html/ -e "eval(base64_decode"
grep -rnw public_html/ -e "gzinflate("
grep -rnw public_html/ -e "assert("

Step 3: Replacing WordPress Core Files & Plugins

Instead of manually editing thousands of core files to check for injected code, the cleanest and most reliable strategy is a fresh core replacement:

1. Download a pristine, fresh zip of the current WordPress version from wordpress.org.
2. Delete your existing /wp-admin/ and /wp-includes/ directories.
3. Upload and extract the clean /wp-admin/ and /wp-includes/ folders.
4. Delete and reinstall all active plugins from official WordPress repository sources.
5. Inspect your root wp-config.php and .htaccess files line-by-line, removing any unauthorized code prepended to the top.

Step 4: Cleaning the MySQL Database

Many advanced malware strains inject malicious JavaScript redirects directly into the database within wp_posts or wp_options.

Open phpMyAdmin and run SQL inspection queries to look for injected <script> tags and malicious iframe payloads:

-- Check for rogue JavaScript in post content
SELECT ID, post_title FROM wp_posts WHERE post_content LIKE '%<script%http%';

-- Check for rogue admin users created by the hacker
SELECT ID, user_login, user_email FROM wp_users;

Delete any unknown administrator users immediately and change all existing user passwords.

Step 5: Rotating WordPress Security Salt Keys

Hackers who intercepted your authentication cookies can remain logged in even after you change your password. Invalidate all active sessions by generating fresh security keys in wp-config.php:

define('AUTH_KEY',         'put your unique phrase here');
define('SECURE_AUTH_KEY',  'put your unique phrase here');
define('LOGGED_IN_KEY',    'put your unique phrase here');
define('NONCE_KEY',        'put your unique phrase here');
define('AUTH_SALT',        'put your unique phrase here');
define('SECURE_AUTH_SALT', 'put your unique phrase here');
define('LOGGED_IN_SALT',   'put your unique phrase here');
define('NONCE_SALT',       'put your unique phrase here');

Step 6: Fortifying the Server with Strict Hardening

Lock down common attack vectors to prevent reinfection:

• Disable PHP Execution in Uploads: Create a .htaccess file inside /wp-content/uploads/ containing <Files *.php>deny from all</Files>.
• Block XML-RPC Attacks: If you do not use the Jetpack mobile app, block xmlrpc.php in your root .htaccess to stop automated brute-force attacks.
• Enable 2FA (Two-Factor Authentication): Enforce 2FA on all administrator accounts.

Step 7: Requesting Google Blacklist Review

Once your site is 100% clean and verified, log into Google Search Console:

1. Navigate to Security & Manual Actions → Security Issues.
2. Click Request Review.
3. Explain the exact steps taken (corrupted core files replaced, backdoors eliminated, admin passwords rotated, firewall active).

Google typically reviews and clears the red warning banner in 6 to 24 hours.

Need Guaranteed Emergency Help in Under 2 Hours?

If you don't have the time or Linux command-line background to manually comb through tens of thousands of infected lines of code, our certified security analysts are ready 24/7.

Explore our Emergency Malware Removal & Hack Repair Service — we guarantee 100% disinfection, backdoor elimination, and Google delisting within 2 hours, backed by a 30-day warranty starting at \$49.