If your WordPress site keeps getting reinfected after you’ve already cleaned it, the cleanup almost certainly missed the actual entry point — not a new attack, the same one coming back through a door you didn’t close. A fresh WordPress core install only replaces files inside wp-admin and wp-includes, leaving plugins, themes, and any backdoor planted there completely untouched.
Quick Verdict
Repeated infections are a diagnosis problem, not a bad-luck problem. Before doing another cleanup pass, check three things in order: whether a backdoor survived the last cleanup, whether a specific plugin is the actual entry point, and — if you’re on shared hosting — whether another site on the same account is the real source.
Why the Infection Keeps Coming Back
Reinfection almost always means one specific thing. The original vulnerability or backdoor was never actually closed. A manual cleanup that only removes obviously malicious files — without checking user accounts, scheduled tasks, and core file integrity — leaves attackers a working way back in. They don’t need to re-exploit anything. They just walk back through the door that was never locked.
How to Actually Diagnose It
If You’re Moving to a New Host After This
Take a clean backup, not the compromised site itself. Migrating a hacked installation to a new host carries the infection along with it, even to a more secure host. Rebuild from a backup taken before the compromise. If you don’t have a trustworthy clean backup, rebuild from a fresh WordPress install and re-add your content manually instead.
What Actually Prevents This Going Forward
- A firewall that filters before requests reach your server reduces the odds of the initial compromise happening at all — see our Sucuri review for how a cloud-based firewall differs from a WordPress-plugin firewall.
- A cleanup guarantee, decided before you need it. Some security services include a real human cleanup team if a compromise gets through — worth having decided in advance rather than during an active incident.
- Keeping every plugin current, and removing ones you don’t actually use. An inactive-but-installed plugin can still be an attack surface on some hosting configurations.
- Separate hosting accounts for separate sites, if you’re managing multiple properties — this is the direct fix for the shared-hosting cross-contamination risk above.
Frequently Asked Questions
Why does my site keep getting hacked even after I clean it?
Almost always because the cleanup removed the visible malware but not the actual entry point — an unfamiliar admin account, a backdoor file, or a vulnerable plugin that was never identified. Reinfection is a diagnosis failure, not bad luck.
Is it safe to just reinstall WordPress core?
Reinstalling core files alone doesn’t remove malware sitting in your plugins, themes, uploads folder, or database — it only replaces the wp-admin and wp-includes directories. A real cleanup has to check everywhere, not just core.
Could another site on my hosting account be the source?
Yes — if you host multiple WordPress sites on one shared hosting account, malware can move laterally between them. Cleaning one site while another stays infected on the same account is a common, specific reason for reinfection.
Should I hire someone to clean this up instead of doing it myself?
If you’ve already attempted a cleanup and the site was reinfected, that’s a reasonable point to bring in professional help — a persistent reinfection usually means something was missed that’s worth a more thorough, experienced look.
How do I find out which plugin caused the hack?
Cross-reference your installed plugins against a vulnerability database and check each one’s changelog for recent security fixes — this is a different diagnostic process from finding a plugin causing a functional conflict or error; see our guide to finding a plugin conflict if what you’re actually dealing with is a broken site rather than a security compromise.
How We Assessed This
These steps reflect widely-documented WordPress security incident-response practices, current as of September 2026, not one specific vendor’s proprietary process. Disclosure: this page contains no affiliate links.
Related
- Sucuri review · Sucuri vs Wordfence
- How to find a WordPress plugin conflict
- How to tell if a WordPress plugin is abandoned
