Hacked WordPress Site Recovery: Emergency Agency Playbook

Finding out a client’s WordPress site has been compromised (showing Japanese pharmaceutical search results, redirecting mobile users to spam networks, or displaying a bright red “Deceptive site ahead” warning from Google) is an agency emergency.

When a hack strikes, acting fast is vital to protect the domain’s SEO reputation and prevent blacklisting. Here is my step-by-step emergency playbook.

Step 1: Contain the Outbreak

Before attempting cleanup, prevent the malware from executing malicious cron tasks or emailing spam from the server:

1. Quarantine the domain: Isolate the database credentials and block public outbound SMTP traffic if spam scripts are active. Refer to security recommendations on OWASP WordPress Security for server containment standards.
2. Take a forensic snapshot: Save a copy of server access logs (/var/log/nginx/access.log or Apache access logs) to identify the entry point payload.
3. Change all access keys: Immediately invalidate database passwords, FTP/SSH keys, cPanel logins, and WP Admin session tokens.

# Emergency database password reset via CLI using WP-CLI
wp user update admin_username --user_pass="StrongRandomPassword123!"

Check official documentation on WP-CLI User Commands for details.

Step 2: Clean Core, Plugins, and Themes

Malware plugins often inject backdoors into legitimate core files like wp-settings.php, wp-config.php, or .htaccess.

/wp-content/
├── plugins/        <-- Replace with fresh downloads from WordPress.org
├── themes/         <-- Inspect header.php & functions.php to clean hidden base64 scripts
└── uploads/        <-- Remove all .php, .ico, or executable files disguised as images

• Core Reinstallation: Replace /wp-admin/ and /wp-includes/ with fresh copies directly from the official WordPress release archives.
• Uploads Directory Scrubbing: Scan /wp-content/uploads/ for hidden .php files or execute permissions. Images should never have execute access.

# Find and delete malicious PHP scripts hidden inside uploads directory
find wp-content/uploads/ -type f -name "*.php" -exec rm -f {} +

Step 3: Identify & Close the Entry Point

Cleaning the files without patching the entry point means the site will be reinfected within hours. Common entry vectors include:

• Unpatched plugins (for example, vulnerable file uploaders or arbitrary options update bugs).
• Compromised admin passwords or leaked FTP credentials.
• Shared hosting cross-account contamination (symlink attacks between sites on the same account).

Step 4: Request De-Blacklisting & Clear Google Index Spam

Once the site is verified clean and hardened:

1. Submit a Security Review request inside Google Search Console under Security & Manual Actions.
2. Submit URL re-indexing requests for affected pages.
3. File a false-positive review with Microsoft Defender or SmartScreen if blocked on Microsoft Edge.

Need Urgent Same-Day Recovery for an Agency Client?

If a client site is compromised right now, I provide same-day Hacked Site Recovery starting at £600. Email before noon for priority same-day resolution, malware removal, entry point patching, and blacklist removal filing.