The overwhelming majority of hacked WordPress sites are compromised through a known vulnerability in an out-of-date plugin — not through a guessed password, and almost never through anything targeted. Someone ran an automated scan across thousands of sites, yours had an unpatched plugin, and here we are.
That matters because it tells you what to do. This is a cleanup and patching problem with a defined process, not a mystery. Below is that process, including the mistakes that make recovery much harder.
Worth knowing: Do not start deleting suspicious-looking files. It feels productive and it is the most common way people destroy the evidence of how the attacker got in — which means the backdoor stays, and you get reinfected a fortnight later wondering why.
Before touching anything, take a complete copy of files and database. It is compromised, but it is also the only record of how the attack worked. Losing that means you patch the symptom and miss the entry point.
If malware is being served to visitors, every additional visit risks their browser flagging you and Google adding a warning to your search listing. Maintenance mode limits the damage while you work.
Hosting, SFTP, database, and all WordPress administrator accounts. Then look for administrator accounts you do not recognise — attackers routinely add one so they can walk back in after you have cleaned up.
Check server access logs around the time symptoms started, and compare core files against a clean copy of the same WordPress version. The entry point is nearly always an outdated plugin; identify it before you overwrite anything.
Replace WordPress core with a fresh copy of the same version, reinstall plugins and themes from source rather than repairing them, and inspect wp-content/uploads for PHP files — nothing in uploads should ever be executable.
This is the step people skip and the reason reinfection is so common. Look for unexpected scheduled tasks, unknown administrator users, code injected into functions.php, and modified .htaccess rules. Cleaning without this means you will be back here soon.
Update everything, remove plugins you do not use, add file-integrity monitoring, and submit for review in Google Search Console if the site was flagged. Then set up something that keeps it updated, because this happened for a reason.
Only if you are certain the backup predates the compromise — and most people are not, because sites are usually infected quietly for weeks before symptoms appear. Restoring an already-infected backup is a very common way to spend a day fixing nothing. Worse, if you restore without patching the original vulnerability, you get reinfected within days.
Almost always an out-of-date plugin with a publicly known vulnerability. It is rarely targeted — bots scan enormous numbers of sites for specific vulnerable versions. Weak admin passwords and outdated PHP are the next most common causes.
It can, quickly. If Google detects malware it will add a warning to your listing and traffic collapses. Recovery is normally fast once you have cleaned up and requested a review, but the warning stays until you do — which is why speed matters more than tidiness here.
Security plugins are good at detection and hardening, and unreliable at removing an active infection — they miss obfuscated backdoors routinely. Use one to spot the problem and to harden afterwards, but do the actual cleanup properly.
Typically $150–$600 depending on how long the infection has been running and how many sites share the server. We quote a fixed price after diagnosis. Sites left infected for months cost more, because the backdoors multiply.
Send the URL and what happened. You’ll get an assessment today and a fixed quote before any work starts — no monthly plan required.