Cleaning a hack is a process, not a scramble. Work the steps in order and you will come out with a clean site and the hole closed; skip around and you will likely be re-hacked within the week — because removing the malware is the easy half. Removing the attacker’s access is the part that counts.
1. Isolate and preserve
Put the site into maintenance mode or restrict it while you work, and take a complete backup of the infected state — files and database. It feels wrong to back up malware, but you need the evidence to find how they got in, and a safety net in case cleanup goes sideways.
2. Replace files instead of cleaning them
Do not grep for evil code line by line. Download fresh copies of WordPress core, your theme and every plugin at their exact versions, and replace the directories wholesale. What cannot be replaced — uploads, wp-config — gets inspected by hand: PHP files inside /uploads/ are almost always malicious, and wp-config should be compared against a known-good copy.
3. Hunt the backdoors
Assume persistence. Check every one of these:
- Admin users you did not create — in the database, not just the users screen.
- Recently modified PHP files — sort by date; the hack has a timestamp.
- Scheduled tasks (cron) that re-download the malware on a timer.
- .htaccess and wp-config.php for injected redirects and includes.
4. Rotate everything
Every WordPress password, the database password, SFTP/hosting credentials, the salts in wp-config, and any API keys the site stores. If the attacker exfiltrated credentials — and you must assume they did — a perfect file cleanup with old passwords is an open door.
5. Close the hole and verify
The way in was almost always an outdated plugin or theme, a weak password, or a nulled premium plugin. Update everything, remove what you cannot trust, then request a review in Google Search Console if the site was flagged. Scan again a week later — a clean second scan is when you can actually relax. If any of this is beyond reach mid-crisis, our security service does exactly this, calmly, on a timeline.