Clean up a hacked WordPress site
Does the website redirect to another page, or are there unknown administrators or files? Then it may be hacked. Start with the passwords, to lock the attacker out.
Before you start
- Scan your own devices for viruses.
How to clean it up
- 1
Change all passwords: DirectAdmin, WordPress administrators, FTP and the database.
Important
Everything is replaced with how it was on the date you choose. Changes made after the backup are lost.
- 2
Restore a backup from before the break-in.
- 3
If you have no clean backup, update WordPress and all plugins and themes.
- 4
Then remove plugins, themes and administrators you don’t recognise.
- 5
Install a security plugin, for example Wordfence, and let it scan the website.
How to know it worked
Done
The website is clean and the passwords are changed.
If something doesn’t work
Malicious files keep coming back
We have suspended the website
What to do: Clean up the website. It must be completely clean before we turn it back on.
Good to know
- We help you restore from a backup, but we don’t investigate how the break-in happened.
- Use one security plugin at a time, and avoid WP File Manager. Use DirectAdmin’s File Manager instead.
- Take your own backups regularly, especially before bigger changes.
Related guides
Need more help?
Email [email protected] or call 08-519 70 666.