If your WordPress site has been hacked, the single most common mistake is treating it like a one-time cleanup: delete the obvious malware, restore a backup, change a password, and move on. Reddit’s WordPress community is full of people who did exactly that and got reinfected within days — an admin account that keeps recreating itself, a “clean” backup that turns out to already be compromised, or six sites on one shared hosting account taking turns getting hit. This guide covers why that happens and the actual process to stop it, not just the first-pass symptoms.
Quick Verdict
A hacked WordPress site is rarely fixed by deleting the malware you can see. The real work is finding the persistence mechanism — the backdoor that lets an attacker back in after you’ve cleaned everything visible — and confirming your hosting environment itself isn’t cross-contaminating your other sites. Do that properly and a DIY cleanup is realistic for most single-site infections. Skip it and you’ll be back here in a week, which is exactly what happens to a large share of the people who post about this.
Hacked WordPress cleanup checklist
Work through this in order. Skipping straight to “delete the malware” is the step that causes reinfection — the checklist is ordered specifically to avoid that.
0 of 9 steps done
Real-World Signs You’re Dealing With a Persistence Mechanism, Not Just Malware
- An admin account keeps coming back after you delete it. This means the deletion is treating a symptom — something else (an injected `functions.php` snippet, a scheduled cron task, or a database trigger) is recreating it. Deleting the account again without finding that source just repeats the cycle.
- You restore from backup and get reinfected within days. If the infection was present before the backup was taken, restoring it brings the backdoor back too. Confirm the backup’s date predates the compromise, or scan the backup itself before restoring it — a “clean” restore that reinfects you a second time is usually this, not a new attack.
- Multiple sites on the same shared hosting account get hit, one after another. Shared hosting environments can let an infection spread laterally between sites sharing the same account, especially with loose file permissions. Cleaning one site while three others on the same account stay infected just gives the attacker a way back in through a neighbor.
Why the First-Pass Cleanup So Often Fails
The pattern across nearly every “I cleaned it and it came back” report is the same: the visible symptom gets removed — a spam plugin, an obvious malicious file, a suspicious admin account — but the mechanism that put it there in the first place stays intact. A backdoor can live in a single injected line inside `wp-config.php` or a theme’s `functions.php`, both of which look completely normal at a glance unless you’re specifically checking for unfamiliar code. Removing the malware without finding that line is like changing the lock but leaving a copy of the key under the mat.
This is also why “delete and reinstall WordPress core” alone doesn’t fix a persistent infection — core files aren’t usually where the backdoor lives. Plugins, themes, uploads directories, and the database itself are all more common hiding places, and a fresh core install does nothing to any of them.
DIY Cleanup vs. a Paid Security Service
| DIY cleanup | Paid security service (e.g. Sucuri, Solid Security) | |
|---|---|---|
| Cost | Free (your time) | Typically $200-500 for a one-time cleanup, or a subscription that includes ongoing monitoring |
| Best for | A single infected site, comfortable with file/database access | Multiple infected sites, shared hosting cross-contamination, or repeated reinfection you can’t trace yourself |
| Finds sophisticated backdoors | Possible, but requires knowing where to look and how injected code is typically obfuscated | Purpose-built scanning tools specifically trained on backdoor patterns |
| Ongoing protection after cleanup | Manual — you’re responsible for updates and monitoring | Usually included as a subscription feature |
If you’ve been through the checklist above once, found and removed a backdoor, and the site stays clean for a week, DIY was almost certainly sufficient. If the infection keeps coming back after a genuine attempt, or you’re dealing with more than one compromised site on the same hosting account, that’s the point where a paid service earns its cost — see our Sucuri review and Solid Security review for what each one actually includes and what it costs.
If You Genuinely Can’t Afford a Paid Cleanup
A $200-500 quote is a real barrier for a lot of site owners, and it’s a common enough situation that it’s worth addressing directly rather than assuming everyone can just pay for it. The checklist above is free and gets a meaningful share of single-site infections fully cleaned without paying anyone — the steps that matter most (checking for an unfamiliar admin account, scanning `wp-config.php` and `functions.php` for injected code, checking shared-hosting neighbors) don’t require specialized tools, just knowing what to look for. Where DIY genuinely falls short is a sophisticated, well-obfuscated backdoor that isn’t visible on a manual read-through — if you’ve done the checklist carefully and the site is still getting reinfected, that’s the realistic point to prioritize a paid service over continuing to guess.
Preventing This From Happening Again
- Keep WordPress core, plugins, and themes updated. Outdated software with a known vulnerability is the most common way sites get compromised in the first place — this single habit prevents more infections than any cleanup step.
- Use unique, strong passwords for every account tied to the site — WordPress admin, hosting, database, and email — since a compromised email account is a common way an attacker resets everything else.
- Remove plugins and themes you’re not actively using, even deactivated ones. An inactive plugin with a known vulnerability is still a valid entry point if its files remain on the server.
- Consider a security plugin with active malware scanning rather than relying on noticing an infection yourself — by the time you notice something’s wrong, the backdoor has often been there a while already.
Frequently Asked Questions
How do I know if my site is actually clean, or just clean-looking?
Watch for the admin account or malicious files reappearing over 48-72 hours after cleanup — if they don’t come back, that’s a reasonably strong signal the persistence mechanism was found and removed, not just the visible symptom. A malware scan from a security plugin or service adds more confidence than a manual check alone, since some backdoors are deliberately obfuscated to survive a casual read-through.
Is my backup safe to restore, or could it be infected too?
Only if it predates the compromise. If you’re not certain when the infection started, either scan the backup itself before restoring it, or treat any backup taken after the infection could plausibly have begun as unsafe. Restoring a compromised backup is one of the most common reasons people report “cleaning” a site and getting reinfected almost immediately.
I’m on shared hosting and other sites on my account got hacked too — is that connected?
Very likely, yes. Shared hosting environments can allow an infection to spread between sites on the same account, particularly with loose file permissions between them. Check every site and domain on the account, not just the one you noticed first — cleaning one while the others stay infected just gives the attacker a path back in.
Can’t I just delete the malicious admin account and move on?
If it comes back, no — that means something else is recreating it, and deleting it again just restarts the cycle without fixing anything. Find what’s recreating it (usually injected code in `functions.php` or `wp-config.php`, or a scheduled task) before considering the account itself dealt with.
How We Assessed This
This guide reflects widely-documented WordPress compromise and cleanup patterns, cross-checked against real accounts of the specific failure modes covered here (reinfection after backup restore, recreating admin accounts, shared-hosting cross-contamination). Disclosure: this page contains no affiliate links currently.
Related
- Sucuri review — firewall and malware cleanup service
- Solid Security review — free vs. paid WordPress hardening
