How Do WordPress Sites Get Hacked? WordPress malware removal guide

How Do WordPress Sites Get Hacked? A Practical Guide to Finding and Removing Malware

Understand the real attack paths hackers use against WordPress sites, how to spot an infection early, and the exact cleanup steps to get your site back safely.

WordPress powers a huge share of the web, which makes it a constant target for automated attacks. Most hacks aren’t the work of a skilled hacker sitting at a keyboard — they’re bots scanning millions of sites for one weak point: an outdated plugin, a leaked password, or a misconfigured file permission. The good news is that nearly every WordPress hack follows a predictable pattern, which means it’s also predictable to prevent and clean up.

~90% of hacked CMS sites analyzed in industry reports run WordPress, largely due to its market share

#1 cause of compromise: outdated or vulnerable plugins and themes

24–48h typical window before a known vulnerability is actively exploited after disclosure

1How WordPress Sites Actually Get Hacked

Attacks rarely target WordPress core itself — the core software is updated frequently and reviewed closely. Instead, hackers go after the layer around it: plugins, themes, hosting configuration, and human error. Here are the paths that account for the overwhelming majority of infections.

Outdated or vulnerable plugins and themes

Every plugin and theme is additional code running on your server. When a security flaw is found and disclosed, automated bots begin scanning the web for sites still running the vulnerable version within hours. Abandoned plugins — ones no longer updated by their developer — are especially risky because the hole never gets patched.

Weak or reused passwords

Brute-force and credential-stuffing bots try thousands of username and password combinations per minute against the /wp-login.php page. If you’ve reused a password that leaked from another breached site, this is often the fastest route in.

Nulled or pirated themes and plugins

“Free” versions of premium plugins downloaded from unofficial sites are one of the most common infection sources in practice. Malicious code is frequently pre-installed inside the files before you ever activate them.

Outdated hosting software

PHP, MySQL, and server-level software that hasn’t been updated can carry their own vulnerabilities, independent of WordPress itself. Shared hosting environments can also expose a well-secured site to a poorly-secured neighbor on the same server.

Insecure file permissions and exposed configuration files

Overly permissive file and folder permissions can let an attacker who gains limited access escalate it into full control. An exposed wp-config.php file, which holds database credentials, is a particularly high-value target.

Phishing and admin-level social engineering

A convincing fake login page or a compromised email account belonging to a site admin can hand over credentials without any code vulnerability being involved at all.

⚠ Why “small” sites get hacked too Most attacks aren’t targeted at you personally. Bots scan the entire internet indiscriminately, so a low-traffic blog is exploited just as often as a large store — the attacker usually just wants server resources, an SEO spam platform, or a phishing host, not your specific content.

2Signs Your WordPress Site Has Been Compromised

Malware doesn’t always announce itself. Some infections are loud and obvious; others quietly run in the background for months. Watch for these warning signs.

Symptom	What it usually means
Site redirects visitors to another URL	Malicious redirect script injected into theme files or the database
Google flags site as “This site may harm your computer”	Malware or phishing content detected by Safe Browsing
Unknown admin users in Users menu	Attacker created a backdoor admin account
Spam pages appear in Google search results for your domain	SEO spam injection (“Japanese keyword hack” and similar)
Site suddenly slow or server resources maxed out	Site may be sending spam email or mining cryptocurrency in the background
Unfamiliar files in wp-content or root directory	Uploaded shell scripts or backdoor files
Hosting provider suspends the account	Host’s automated scanner detected malicious activity

3Step-by-Step: Removing Malware From a Hacked WordPress Site

If you suspect an infection, work through these steps in order. Don’t skip the isolation step — reinfection during cleanup is common if the site stays publicly accessible with the same open door.

Take the site offline or into maintenance modeThis limits damage to visitors and stops the malware from spreading further while you work, without deleting anything yet.
Back up the current (infected) stateBefore changing anything, take a full backup — files and database. You need a snapshot in case a cleanup step goes wrong, and it preserves evidence of what was injected and where.
Change every credentialReset all WordPress admin passwords, database passwords, hosting/cPanel/SFTP passwords, and any API keys stored in wp-config.php. Assume everything was seen by the attacker.
Scan with a security plugin or server-side scannerTools such as Wordfence, Sucuri, or MalCare will scan core, theme, and plugin files against known-good checksums and flag anomalies, injected code, and suspicious file modifications.
Replace core, theme, and plugin files with clean copiesDelete and reinstall WordPress core, and reinstall every plugin and theme fresh from the official WordPress.org repository or the original developer — don’t just “clean” a compromised file if you can replace it outright.
Inspect the database for injected contentSearch the wp_posts, wp_options, and wp_users tables for injected script tags, unfamiliar admin accounts, and suspicious autoloaded options — a common hiding spot for persistent malware.
Remove unknown admin users and audit all user rolesDelete any account you don’t recognize and downgrade any account that doesn’t need administrator access.
Check for backdoors in uncommon locationsBackdoors are frequently hidden in uploads folders, inside image files, or disguised with names resembling core WordPress files. A thorough scanner is far more reliable here than manual inspection alone.
Update everything and re-enable the firewallBring WordPress core, PHP, all plugins, and the theme fully up to date, then activate a web application firewall to block repeat attempts.
Request a review from Google Search Console (if blacklisted)If your site was flagged as unsafe, submit a review request only after you’ve confirmed the infection is fully removed, or it will likely be re-flagged.

💡 When to call in a professional If you’re not comfortable working directly in the database or file system, or the infection keeps returning after cleanup, a managed malware removal service (Sucuri, MalCare, or your host’s security team) is usually worth the cost — reinfection almost always means the original entry point was never actually closed.

4Preventing Reinfection: A Hardening Checklist

Cleaning an infection only fixes the symptom. Closing the entry point is what actually stops it from happening again.

Keep WordPress core, themes, and plugins updated at all times — enable auto-updates where practical
Remove any plugin or theme that is no longer maintained by its developer
Use unique, strong passwords and enable two-factor authentication for all admin accounts
Limit login attempts and rename or protect the default login URL
Install a reputable security plugin with active malware scanning and a firewall
Set correct file permissions (typically 644 for files, 755 for directories)
Only install plugins and themes from official, trusted sources — never nulled or pirated copies
Take automated, off-site backups on a regular schedule so a clean restore point always exists
Remove unused plugins, themes, and user accounts rather than leaving them dormant
Use hosting with server-level malware scanning and isolated (non-shared) environments where possible

5Frequently Asked Questions

Can I remove WordPress malware without a plugin?

Yes, but it requires comparing every core, theme, and plugin file against a known-clean copy and manually inspecting the database — time-consuming and easy to miss a hidden backdoor. A scanner plugin or professional service is faster and more thorough for most site owners.

Will restoring from a backup fix the hack?

Only if the backup predates the infection and you also close the original entry point afterward. Restoring an old backup without updating vulnerable plugins or changing leaked passwords typically leads to reinfection within days.

How do I know if my site is blacklisted?

Check Google Search Console’s Security Issues report, or search “site:yourdomain.com” in Google to see if a warning appears. Google Safe Browsing’s public transparency report tool can also be checked directly by domain.

Can shared hosting cause reinfection even after cleanup?

Yes. On shared hosting, a compromised neighboring site can sometimes reinfect yours through shared server resources. If reinfection keeps happening despite a clean install, ask your host about cross-account contamination or consider isolated/managed WordPress hosting.