WordPress Malware Removal: How to Clean a Hacked Site

WordPress malware is unwanted code an attacker adds to your site. It might redirect visitors, show spam, steal data, or send email from your server.

Speed matters. Once Google spots it, it can warn visitors away from your site in search results and in the Chrome browser.

Signs Your Site Is Hacked

• Visitors get sent to another site, often only on mobile or from Google.
• Google shows "This site may be hacked" or a red warning page.
• Search results show pages you never made, often spam in other languages.
• New admin users you did not create.
• Unknown files in your folders, or core files that changed.
• Your host suspends the account or reports high resource use.
• Pop ups or ads you never added.
• Search Console shows a Security Issues alert.

How to Remove Malware in 7 Steps

• Take a backup of the hacked site anyway, so nothing is lost while you work.
• Change every password: WordPress users, hosting, database, and FTP. Remove admin users you do not recognize.
• Scan the site with a security plugin such as Wordfence or Sucuri, or ask your host for a malware scan.
• Replace WordPress core files with fresh copies, and reinstall plugins and themes from their official sources.
• Delete plugins and themes you do not use. Clean or remove the infected files the scan found, including in the uploads folder.
• Check the database for injected scripts and spam pages.
• Find how they got in, usually an outdated plugin, theme, or weak password, and fix it so it cannot happen again.

Get Google's Warning Removed

Open the Security Issues report in Google Search Console. Once the site is clean, request a review and explain what you fixed.

Google says phishing reviews take about a day, malware reviews a few days, and spam hacks from a few days to a few weeks. After a clean result, warnings usually clear within a few days.

Do not request a review before the site is fully clean. A failed review can make the next one take longer.

Prevent It Happening Again

• Keep WordPress, plugins, and themes updated.
• Use strong passwords and two factor login for every admin.
• Run daily backups stored away from your host.
• Use a firewall, from a security plugin, your host, or a service like Cloudflare.
• Remove anything you do not use.

Frequently Asked Questions

Can I just restore a backup? Only if the backup is from before the hack, and you still close the hole they used. Otherwise they come back.

Will a hack hurt my rankings? It can. Spam pages, redirects, and warnings all cost traffic. Fast cleanup limits the damage.

Should I pay for malware removal? If the site makes money and the scan keeps finding new files, a professional cleanup is usually cheaper than days of downtime.

How do I know it is fully clean? Scans come back clear, no unknown users or files return over the following days, and Google's review passes.

Want It Watched for You

Most hacks start with something out of date. Our SEO service keeps an agent watching your site every week, so problems get spotted early and your rankings stay protected.