Hacked WordPress site: cleanup and protection

Signs of a compromised WordPress site, step-by-step cleanup and the settings that prevent another attack.

OfSec 2 min read

WordPress is the most widely used platform for websites and online shops, which also makes it the most frequent target of automated attacks. Most compromises are caused by outdated plugins, pirated themes and weak passwords rather than by WordPress itself.

Signs

  • the site redirects visitors to adverts, casinos or fake shops, often only on mobile devices or when arriving from Google;
  • Google warns that the site may be hacked, or Search Console reports security issues;
  • the admin area contains users you did not create;
  • the hosting provider has suspended the site because of malicious code or spam.

Before the cleanup

Make a full copy of the files and the database in their current state. You will need it to establish how the attackers got in. If possible, enable maintenance mode so that visitors are not infected.

Step-by-step cleanup

  1. Change all passwords: WordPress administrators, the hosting panel, the database, FTP/SFTP and the administrator's email.
  2. Delete unknown users with the Administrator role.
  3. Check the core and the plugins with WP-CLI. The commands wp core verify-checksums and wp plugin verify-checksums --all list files that differ from the official versions.
  4. Reinstall WordPress, the theme and the plugins from official sources. Remove pirated ("nulled") themes and plugins, which are one of the most common sources of malicious code.
  5. Look for PHP files in wp-content/uploads, where there should be none, and check .htaccess and wp-config.php for injected code.
  6. Check the database: the siteurl and home settings, and the content of posts for injected scripts.
  7. Generate new session keys with wp config shuffle-salts so that all logged-in users are signed out.
  8. Update every component and request a review in Google Search Console.

Protection after the cleanup

  • multi-factor authentication for all administrators;
  • the line define('DISALLOW_FILE_EDIT', true); in wp-config.php, which disables file editing from the admin area;
  • automatic updates and removal of unused plugins and themes;
  • limited login attempts and a web application firewall (WAF);
  • daily backups stored outside the hosting account.

Repeated infection

If the site is infected again after the cleanup, the cause is usually a missed backdoor or a compromised hosting account. In that case the whole server needs to be reviewed, not only the site.

WebsitesWordPress