Hacked? How to clean up a WordPress site

What to do when your WordPress site was hacked, in the order WordPress itself advises: document, scan, passwords, new keys, fresh core files, updates.

Key points

Stay calm and write down what you see before you change anything. WordPress’s own guide calls this the first step.
Change every password, give WordPress new secret keys, and replace the core files with fresh copies of the same version.
If personal data may have leaked, the GDPR requires telling the data protection authority, where feasible within 72 hours.

Before you clean up

WordPress keeps a guide for hacked sites, last updated in July 2026. Its first steps are not technical: stay calm, and write down what you saw, when you saw it (with the time zone), and what changed on the site recently, such as a new plugin or an edited theme. These notes help your host, and they help you find out later how the attackers got in.

The steps, in WordPress’s order

Scan the site and your own computer. Use the scanner of a security plugin or a scanner that checks the site from outside. Scan your own computer with an antivirus program too: a stolen password may have come from there.
Contact your host. It may already be taking steps, and on shared hosting other sites can be affected.
Watch for warnings about your site. WordPress advises registering it with Google Search Console and Bing Webmaster Tools, which report problems they find.
Change every password: SFTP or FTP, WordPress, the hosting control panel, and the database. Use long, unique passwords and turn on two-factor sign-in.
Sign everyone out. Make all users, especially administrators, set new passwords. Put new secret keys into wp-config.php, made with WordPress’s key generator. This signs out anyone who is still logged in.
Make a backup of the hacked site before you clean it, so that nothing is lost for good.
Remove the hack. Replace the folders /wp-admin and /wp-includes with fresh copies of the same WordPress version, uploaded through SFTP, not with the reinstall button in the dashboard. Check wp-content with more care, especially the files .htaccess, index.php, header.php, footer.php, and functions.php. A clean backup from before the attack can replace this step.
Update WordPress, the plugins, and the themes once the site is clean. Old versions are easier to break into.
Change the passwords again, including the database password in wp-config.php.
Find out how the attackers got in, for example from the server’s logs, and close that path.

If personal data may have leaked

A shop, a contact form, or a member area holds personal data. Under Article 33 of the GDPR, the operator must report a breach of personal data to the data protection authority without undue delay and, where feasible, within 72 hours of becoming aware of it. This does not apply if the breach is unlikely to put people’s rights at risk. This guide is not legal advice. Your data protection officer or a lawyer can tell you what applies to you.

After the cleanup

Work through the guide How to secure WordPress: the first ten steps, so that the same path does not open again.

Next step

The page Web security tools lists security plugins with malware scanners and a firewall maker that offers cleanups.

The figures in this guide come from the archive and change with every data update. As of November 13, 2026.