If your WordPress site is hacked, enable maintenance mode, scan with Wordfence or MalCare, restore from a clean backup, close the entry point, and reset every credential before you even consider a wordpress malware removal service. Work in that order: containment first, cleanup second, prevention last. Hire professional help once the scope of the damage is fully understood, not before.
Every WordPress hacked incident follows a similar arc: a quiet compromise, a visible symptom (a redirect, a browser warning, a client complaint), then a scramble to fix it before search rankings or customer trust take a hit. This runbook walks through that arc in order, then answers the question most guides skip: when a DIY cleanup is enough, and when it is worth paying a wordpress malware removal service to finish the job properly.
Signs Your WordPress Site Has Been Hacked
A malware infection rarely announces itself cleanly, so look for more than one of these signs before concluding it is a genuine compromise rather than a plugin conflict:
- Unexpected redirects to unfamiliar domains when visitors land on your pages.
- A Google warning, “this site may be hacked,” in search results or Search Console.
- Unfamiliar admin or editor accounts you did not create.
- Injected spam links or pop-ups on pages you know you did not write.
- Sudden traffic or performance changes with no matching change on your end.
- Malware detection alerts from your browser or hosting provider.
Any single signal on its own can have an innocent explanation. Two or more together, especially an unfamiliar admin account combined with a Search Console warning, is a strong indicator of a real malware attack and a reason to start containment immediately rather than waiting to confirm further.
Assign One Owner and Contain the Damage
Confirm the hack from more than one source before you act. Compare how the site behaves logged in versus logged out, check Google Search Console for security warnings, and note every symptom you find (redirects, defaced pages, spam in search results, unfamiliar admin users). Assign one person to own the response timeline; a hacked recovery worked by three people in parallel, with no shared log, usually takes longer, not less.
Once the hack is confirmed, reduce public exposure right away. Put the site into maintenance mode, or restrict access at the hosting level if maintenance mode itself is compromised. If the malware is serving spam, redirects, or phishing pages to visitors, every hour it stays live adds to the blacklist risk and the cleanup workload later.
Preserve Evidence Before You Touch Anything
Before you clean or restore anything, make a labelled backup of the compromised state exactly as you found it. This preserved copy matters for two reasons: it lets a specialist diagnose the entry point later if your own cleanup does not fully resolve it, and it gives you something to compare against if a client, insurer, or hosting provider asks what happened.
Preserve access logs, error logs, firewall or WAF events, the list of currently active users, and the list of active plugins and themes. Infected files and malicious code are far easier to trace with a timeline in hand than without one, so do this step even under time pressure.
Lock Down Every Access Point, Not Just WordPress Admin
Most recovery guides stop at resetting the WordPress admin password. That is not enough. Reset credentials for hosting, the database, SFTP/FTP, your CDN, the domain registrar, any deployment or CI tooling, and account-recovery email addresses, all from a device you trust is clean. Remove any admin or editor account you do not recognize, and turn on two-factor authentication on every account that supports it.
This full-stack credential rotation is the single biggest gap between a cleanup that holds and one that gets reinfected within a week. Attackers who gained access through a stolen FTP password or an exposed database credential will simply walk back in through the same door if only the WordPress admin password changes.
Find the Entry Point, Then Scan Files and Database
Review recent file changes, outdated plugins and themes, unusual modification timestamps, unexpected files in the uploads folder, and anything unfamiliar in wp-config.php, .htaccess, mu-plugins, or scheduled cron jobs. This is where most compromises start: an outdated plugin, a weak or reused password, or a vulnerable theme.
Run a full malware scan with a reputable scanner (Wordfence’s own cleanup process and MalCare both offer file-integrity and database scanning), then compare flagged files against a trusted, unmodified copy of WordPress core, your plugins, and your theme. A scanner will flag suspicious patterns automatically, but manual removal work, comparing flagged files line by line against known-good copies, still catches malicious code a signature-based scanner misses, particularly custom backdoors written for a specific site.
Some security plugins will remove common, well-known malware automatically once detected, but that automatic cleanup is not a substitute for the manual comparison above. Automated removal tools are built to catch known patterns quickly, not to guarantee a complete, verified cleanup of a targeted, custom-written attack.
Clean, Restore, and Validate Before Reopening
Remove the malware and any injected code, reinstall WordPress core, plugin, and theme files from trusted sources rather than trying to hand-edit infected copies, and patch whatever vulnerability let the attacker in. A thorough cleanup also means checking the database for injected spam links or rogue admin accounts, not just the file system. Rotate any credentials you have not already rotated, then test every critical user journey (login, checkout, contact forms, key landing pages) before you take the site out of maintenance mode.
Only after validation is complete should you request a malware or blacklist review from Google Search Console. Reopening the site, or requesting review, before cleanup is fully verified is one of the most common reasons a site gets reflagged within days.
Should You Remove the Malware Yourself or Hire a WordPress Malware Removal Service?
A confident DIY cleanup works well when the site is small, you have a clean backup from before the infection, and you are comfortable working in an SFTP client and a WordPress security plugin. Most single-site owners with a recent backup can complete the steps above in an afternoon.
Hiring a professional malware removal service makes more sense when the infection keeps coming back after cleanup, when customer data or payment details may be exposed, when you cannot identify how the attacker got in, or when downtime is actively costing revenue. A specialist brings tooling and experience that catches persistence mechanisms (scheduled backdoors, hidden admin accounts, database-level injections) that a first-time manual cleanup often misses. Choosing the best wordpress malware removal service for your situation usually comes down to how much of the entry point and full scope of the infection you can confidently identify yourself, and whether a one-time cleanup or an ongoing monitoring plan fits your risk tolerance.
What a WordPress Malware Removal Service Actually Costs
Professional WordPress malware removal typically runs from around $100 for a straightforward, single-site cleanup up to $1,000 or more for a complex case, according to published industry ranges from vetted-expert marketplaces like Codeable. What separates the low end from the high end is mostly how clean your starting point is:
| Case | Typical cost | What drives it |
|---|---|---|
| Straightforward, single-site | ~$100-$300 | Clean recent backup, one obvious entry point |
| Moderate | ~$300-$600 | No reliable backup, or a few infected files beyond the obvious ones |
| Complex | ~$600-$1,000+ | Hidden backdoor, infection spread across core and custom code, urgent same-day turnaround |
If a quote sits well outside that range in either direction, ask what the malware removal process actually includes: a one-time scan and file cleanup is a different job than ongoing monitoring, blacklist removal, and a hardening pass to prevent recurrence. A lower quote that only covers the initial scan and removal, with no verification pass or follow-up monitoring window, often costs more in the long run if the same entry point causes a second infection a few weeks later.
Are Free Malware Removal Tools and Services Reliable?
Free tiers of Wordfence, MalCare, and similar wordpress security plugins are genuinely reliable malware detection tools. They will scan your WordPress core files, plugins, and database and flag most common malware signatures without cost. Where free malware removal tools fall short is the cleanup itself: most free tiers detect but do not remove infections automatically, offer no manual review by a human analyst, and provide no guarantee against reinfection.
That gap, not detection accuracy, is the real reason a paid plugin tier or a reliable wordpress malware removal service earns its cost for anyone who has already been through one hacked recovery and wants to avoid a second one. If keeping your site safe long term matters more than the upfront saving, budget for the paid tier once you are past this immediate incident.
Why WordPress Sites Get Hacked (and How to Prevent Future Attacks)
Almost every WordPress hacked case traces back to one of a small number of causes: outdated plugins or themes, weak or reused admin passwords, an outdated WordPress core install, or insecure hosting configuration. WordPress core itself is actively maintained and secure; the weak points are almost always unpatched extensions and credentials, which is exactly why vulnerability scans keep flagging the same categories of issue year over year, as the OWASP Top 10 documents for web applications broadly.
To harden WordPress against a repeat incident and prevent malware infections going forward, keep WordPress, every plugin, and your theme updated, enforce strong unique passwords with two-factor authentication, run a tested off-server backup on a schedule, keep a reputable security plugin and firewall active, remove any plugin you are not actively using, and put a recurring security review on the calendar rather than treating hardening as a one-time task. Protecting a WordPress site long term is a maintenance habit, not a single project you finish once. See our WordPress security checklist for the full hardening list and our backup strategy guide for a tested backup schedule that would have made this recovery faster.
Frequently Asked Questions
How do I recover a hacked WordPress website?
Contain the site with maintenance mode, scan for malware with Wordfence or MalCare, remove the malware or restore a clean pre-hack backup, reset every credential and close the entry point, harden the site with a firewall and updates, then request a Search Console review to clear any blacklist. This mirrors the general recovery sequence WordPress.org recommends for a hacked site, and working the steps in that order prevents reinfection.
What are the best WordPress malware removal plugins?
Wordfence and MalCare are the two most widely used options, both offering file-integrity scanning, malware signature detection, and a firewall layer. Sucuri is a common alternative, particularly for sites that also want a server-side scanning layer. The best WordPress malware removal plugin for your site depends more on whether you need automated cleanup (MalCare) or a deeper free scanning tier (Wordfence) than on any single feature.
Why do malware scanners fail to detect all threats?
Most scanners rely on known signatures, so a custom-written backdoor or a newly modified variant of common malicious code can slip past automated detection. This is why manual comparison against trusted core, plugin, and theme files still matters even after running a scan; a scanner narrows down where to look, it does not replace a human review of flagged files.
Can malware infect my core WordPress files?
Yes. Attackers frequently modify WordPress core files directly, alongside plugin and theme files, because a modified core file can be harder for site owners to notice than an obviously unfamiliar plugin. Comparing your installation against a fresh, trusted copy of WordPress core is one of the more reliable ways to catch this.
When should I hire a professional for a WordPress hacked recovery?
Hire a professional wordpress malware removal service when the site keeps getting reinfected after cleanup, when customer data or payment details are at risk, when you cannot identify how the attacker got in despite a careful review, or when downtime is costing meaningful revenue. A professional cleanup typically includes a deeper scan for persistence mechanisms (hidden admin users, scheduled backdoors, database-level injections) than a first-time DIY pass usually catches, plus verification steps that confirm the site is genuinely clean, not just symptom-free, before it goes back online. This matters because a site that looks clean after a surface-level cleanup can still contain a dormant backdoor that reactivates weeks later, which is the single most common reason sites end up needing a second, more expensive cleanup. If your first attempt at removal did not fully resolve the infection, that alone is a strong signal to bring in a specialist rather than repeating the same steps.
How long does it take to recover a hacked WordPress website?
A straightforward case with a clean recent backup can be resolved in a few hours. A deep compromise involving a hidden backdoor or no usable backup can take a day or more, mostly because verifying the site is genuinely clean takes longer than the cleanup itself.
Are free WordPress malware removal services reliable?
Free scanners are reliable for detection but rarely include automated removal, manual analyst review, or a guarantee against reinfection. For a first, simple infection with a clean backup available, a free tool plus this runbook is often enough. For anything more complex, that detection-versus-cleanup gap is where a paid tier or a professional service earns its cost.
How can I prevent my WordPress website from being hacked again?
Keep WordPress core, every plugin, and your theme updated, run tested off-server backups on a schedule, enforce strong unique passwords with two-factor authentication, keep a security plugin and firewall active, remove unused plugins, and schedule a recurring security review rather than a one-time hardening pass. Consistent maintenance, not a single cleanup, is what keeps a site secure over time.
For ongoing coverage of newly disclosed WordPress and WooCommerce vulnerabilities, see our WooCommerce security vulnerability watch, and browse the full security and compliance hub for related hardening guides. If you would rather have this handled for you, our WordPress support team can run this entire recovery process on your behalf, and our security headers guide and troubleshooting guide cover related hardening and diagnostic steps.
If incident response is part of a support agreement you’re setting up, GEENXT’s Freelance Web Support SLA Template is a ready-to-use structure for documenting scope, response times, and escalation.
