How to Fix a Hacked Website: Step-by-Step Guide

Finding out your website got hacked feels like walking into your house and seeing the door kicked in. Your traffic, your rankings, your income, and your visitors' trust all sit on that site. Almost every hacked site can come back, but a rushed or half-finished cleanup often leads to a second infection within weeks.

How to Fix a Hacked Website: Step-by-Step Malware Cleanup, Recovery and Prevention Guide

This guide walks you through the recovery in the order that actually matters, from the first hour to long-term protection. It covers WordPress in detail because most hacked sites run on it, but the logic works for any CMS or custom build.

How to Tell If Your Website Has Been Hacked

Some hacks shout. Others whisper for months. Watch for these warning signs:

Browser or search warnings such as "This site may harm your computer" or a red Safe Browsing screen
Redirects that send visitors (often only mobile users or Google visitors) to gambling, pharma, or scam pages
Spam pages in Google results under your domain that you never wrote, often in Japanese or Russian
Unknown admin accounts in your dashboard or users whose role suddenly changed
Strange files in your hosting account, like wp-logon.php, wp-config1.php, or random PHP files inside /uploads/
Traffic swings, either a sudden drop or a flood of visits from countries you never target
Email problems, where your site's emails start landing in spam because your server now sends junk mail
Slow pages or blank screens caused by injected scripts or crypto mining code
A suspension notice from your host

Run your domain through a few free scanners before you start: Sucuri SiteCheck, Google Safe Browsing's site status page, and VirusTotal's URL check. Each tool catches different things, so one clean result does not mean you're safe.

Why Hackers Target Websites (Even Small Ones)

Most owners ask "why me?" The honest answer: nobody chose you. Bots crawl millions of sites every day looking for known weaknesses. If your site has one, it becomes a target automatically. Size and niche do not matter.

Attackers break in through a handful of predictable doors:

An outdated plugin, theme, or CMS core with a public vulnerability
A weak, reused, or leaked password
Nulled (pirated) themes and plugins that ship with backdoors built in
Poor server isolation on cheap shared hosting, where a neighbor's infection spreads
Insecure forms or code that allow SQL injection or file uploads

Once inside, they use your site for spam SEO links, phishing pages, malware delivery, email spam, crypto mining, or simply to resell access.

What to Do First When Your Website Gets Hacked

Speed matters here, but calm speed. Do these things before you touch a single infected file.

Put the Site in Maintenance Mode

An infected site can push malware to every visitor and keep feeding spam to Google. Switch on a maintenance page through a plugin, upload a simple static HTML page, or use your CDN's page rules (Cloudflare can serve a maintenance screen). If you can't log in at all, ask your host to suspend public access temporarily.

Take a Snapshot of the Hacked Site

This sounds backwards, but download a full copy of the infected files and database now. That copy preserves recent content you might lose, gives you evidence to trace how the attacker got in, and lets you start over if the cleanup goes wrong. Label it clearly as infected and store it apart from your clean backups so you never restore it by mistake.

Call Your Hosting Provider

Your host can see server-level logs you can't, tell you whether other accounts on the same server got hit, and confirm whether they've restricted your account. Many hosts also offer a malware cleanup service. If the infection came from a neighboring account on shared hosting, cleaning only your site won't help, and you need that information early.

How to Lock Hackers Out of Your Website

Audit Every User Account

Attackers love creating a quiet admin account as a way back in. Open your Users screen and check every administrator and editor. Delete any name you don't recognize and downgrade anyone who has more access than they need. If the dashboard won't load, open phpMyAdmin and inspect the wp_users and wp_usermeta tables directly.

Do the same review for your hosting panel sub-users, FTP/SFTP accounts, database users, CDN, and any third-party tools connected to the site.

Change Every Password

Reset passwords for:

Your hosting account
All FTP and SFTP accounts
Every CMS admin and editor
The database user (then update wp-config.php with the new credentials, or the site breaks)
Email accounts on the domain
Your domain registrar and CDN

If you reused any of these passwords elsewhere, change them there too. Use a password manager to generate long, unique ones.

Replace Your WordPress Security Keys

WordPress stores eight keys and salts in wp-config.php (AUTH_KEY, SECURE_AUTH_KEY, and so on). Generate a fresh set from the official WordPress salt generator and paste them over the old ones. This instantly logs out every session, including any the attacker still holds.

Turn On Two-Factor Authentication

Enable 2FA on your CMS logins, hosting account, registrar, and email. A stolen password alone stops being enough to get in.

How to Find the Entry Point of the Hack

Cleaning without finding the entry point is like mopping the floor while the pipe still leaks. Spend real time here.

Start with your access logs and error logs in the hosting panel. Look for a spike in requests, repeated POST requests to odd files, or login attempts from unusual IPs. That narrows down when the breach happened.

Then look at what changed around that time. Did you install a new plugin? Skip an update for months? Add a theme from a random download site? Search the plugin and theme names on WPScan's vulnerability database or Patchstack to see whether a known flaw exists for your installed version.

If the logs show nothing useful, ask your host for server-level logs. Note your findings in a simple document: when it started, what got changed, how the attacker likely entered. You'll need this later.

How to Remove Malware From a Hacked Website

You have two main routes: restore a clean backup or clean the files by hand. Many owners end up doing a bit of both.

Option 1: Restore a Clean Backup

If you have a backup from before the hack, this is the fastest route. Check the date carefully. Some infections sit dormant for weeks, so pick a backup from well before the first symptom. Load it on a staging copy first if your host allows it, scan it, and only then push it live.

Remember two things. A restore wipes every post, order, and comment made after that backup date. And a restore does not fix the hole the attacker used, so you still need to patch it.

Option 2: Clean the Files Manually

When no clean backup exists, work through the site layer by layer.

Replace core files. Delete the wp-admin and wp-includes folders and upload fresh copies from WordPress.org that match your version. Leave wp-config.php and wp-content in place, but inspect them.

Reinstall plugins and themes. Delete each plugin folder and install a fresh copy from the official source. Remove anything you don't use. Delete any nulled or pirated extension outright.

Hunt in wp-content. Updates never touch this folder, which makes it the favorite hiding spot. Search for PHP files inside /uploads/, which should only hold media. Check inactive themes and child themes too.

Search for obfuscated code. Malicious code often hides at the very top or bottom of a file and uses functions like these:

eval()
base64_decode()
gzinflate()
str_rot13()
preg_replace() with the /e modifier
assert()

Give extra attention to functions.php, header.php, footer.php, index.php, wp-config.php, and wp-load.php. Compare your theme files against a clean copy of the same version using a diff tool to spot any added lines.

Check .htaccess. Attackers use this file to redirect search engine visitors or error pages to malicious sites. Restore the default WordPress rules and look for extra .htaccess files inside subfolders.

Clean the database. Export a backup first, then search the wp_posts and wp_options tables for <script> tags, eval, base64, iframes pointing to unknown domains, and spam words like casino or viagra. Security plugins such as Wordfence, Sucuri Security, MalCare, or Jetpack Scan speed this up a lot on large databases.

Scan your own computer. If malware stole your FTP credentials from your PC, the attacker will simply log back in. Run a full scan with an updated antivirus before you upload anything.

Option 3: Hire a Professional

If server files and SQL tables feel out of your depth, pay for help. Your host may offer a cleanup service, and companies like Sucuri and Wordfence run paid malware removal. Check reviews and avoid the cheapest freelancer you can find, since a bad cleanup leaves backdoors behind.

How to Safely Relaunch Your Website After a Hack

Once the cleanup is done:

Update the CMS core, every plugin, and every theme to the latest version
Update your PHP version if your host still runs an old one
Set file permissions to sensible defaults (usually 644 for files, 755 for folders, and 440 or 400 for wp-config.php)
Clear your site cache, CDN cache, and browser cache
Remove maintenance mode
Open the site in an incognito window on desktop and mobile to confirm no redirects remain
Test forms, logins, checkout, and search
Run a fresh external scan and an internal plugin scan

Keep a close eye on the site for the next few days. Check your user list and file changes daily during that period.

How to Remove Google and Blocklist Warnings From Your Site

If Google flagged your site, the warning won't vanish on its own.

Open Google Search Console and go to Security & Manual Actions, then Security issues. Review what Google found, confirm you fixed every listed problem, and click Request Review. Explain briefly what you cleaned and how you closed the entry point. Malware reviews usually finish within a few days; spam-related reviews can take longer.

Check Bing Webmaster Tools too, since Bing runs its own malware detection. If your traffic depends on Bing, this step matters as much as Google.

Then check email blocklists with MxToolbox. If your server sent spam during the hack, your domain or IP may be listed. Each blocklist has its own delisting form.

Finally, use the Removals tool in Search Console to speed up removal of any spam URLs the attacker created, and make sure those URLs now return a 404 or 410.

Do You Need to Notify Users About a Website Breach?

If the hack exposed visitor data such as emails, passwords, or payment details, you need to tell people. In many regions it's also a legal duty. GDPR, for example, gives you 72 hours to report a qualifying breach to the data protection authority, and many US states have their own notification rules.

Keep the notice plain and honest:

What happened and roughly when
What type of data got exposed
What you did to fix it
What users should do now, such as changing reused passwords and turning on 2FA
How to contact you with questions

Hiding a breach almost always backfires harder than admitting it.

How to Prevent Your Website From Getting Hacked Again

A cleaned site with the same habits will get hacked again. Build these into your routine:

Automatic backups stored off the server, ideally daily, with at least one copy in cloud storage
Updates every week for core, plugins, and themes, or auto-updates where you trust them
A web application firewall through Cloudflare, Sucuri, or Wordfence
Login protection: 2FA, limited login attempts, and a changed default admin username
Least privilege: give writers the Author role, not Administrator
Only official extensions: never install nulled themes or plugins
Activity logging so you see logins, file edits, and plugin changes as they happen
Uptime and malware monitoring that alerts you within minutes, not weeks
Good hosting with account isolation and server-side malware scanning
HTTPS everywhere with a valid SSL certificate

Set a monthly calendar reminder to review users, test a backup restore, and delete plugins you no longer use.

Frequently Asked Questions

How long does it take to fix a hacked website?

A simple restore from a clean backup can take under an hour. A manual cleanup of a heavily infected site can take one to three days. Getting off Google's warning list adds a few more days after you submit the review.

Will my site lose its Google rankings after a hack?

Rankings often dip while warnings show or spam pages sit in the index. Once you clean the site, pass the security review, and remove the spam URLs, most sites recover their positions within a few weeks.

Can I just restore a backup and move on?

You can restore, but you can't move on yet. A restore brings back the same vulnerable plugin or weak password the attacker used. Patch the entry point and change all credentials, or the site will get reinfected.

Are free security plugins enough?

Free versions of Wordfence or Sucuri cover scanning, firewall basics, and login protection well for most small sites. Paid tiers add real-time firewall rules and cleanup help, which makes sense for sites with revenue or customer data.

Why does my site keep getting hacked after I clean it?

Usually a backdoor survived the cleanup, often a PHP file in the uploads folder or a hidden admin user, or the original vulnerability never got fixed. Recheck wp-content, replace security keys, and confirm every plugin runs its latest version.

Should I move to a new host after a hack?

Only if the hack came from the server itself or your host offers no isolation, logs, or support. If the cause was an outdated plugin or a weak password, switching hosts will not help on its own.

How to Fix a Hacked Website: Step-by-Step Malware Cleanup, Recovery and Prevention Guide

How to Tell If Your Website Has Been Hacked

Why Hackers Target Websites (Even Small Ones)