Website Malware Removal — Clean a Hacked Site

Signs you're actually hacked (not just broken)

• Redirects that only happen from Google — visitors from search go elsewhere, but typing the URL directly works. Classic conditional redirect.
• Pages or files you didn't create, often with pharma or casino keywords, sometimes only visible to search engines (cloaking).
• A browser or Google Safe Browsing warning, or your host suspending the account.
• Unknown admin users, or your own login suddenly failing.
• Spam sent from your domain, or the domain landing on a blocklist and email bouncing.
• Unexpected outbound traffic or CPU spikes from cron-driven malware.

How a proper cleanup runs

Patching the symptom without this sequence is why hacks recur.

1. 1

   Take a forensic copy first

   Before changing anything, copy the site and database off the server. This preserves evidence of how the attacker got in — without it you're guessing, and you'll likely miss the entry point.

2. 2

   Find the entry point, not just the payload

   Access and error logs usually show the initial breach — a vulnerable plugin, a stolen password, an exposed backup. The injected code is the symptom; the entry point is the disease. Cleaning one without the other guarantees reinfection.

3. 3

   Remove the malicious code and files

   Compare core, theme and plugin files against known-good versions so injected code stands out. Malware hides in more places than the obvious ones: wp-config, .htaccess, must-use plugins, the database options table, and scheduled tasks.

4. 4

   Close the hole

   Update or replace the vulnerable component, rotate every credential (admin passwords, database password, hosting, SFTP, and any API keys or salts in wp-config), and remove unknown users.

5. 5

   Verify and get delisted

   Confirm the site is clean, then request review from Google Safe Browsing and any blocklists so warnings clear and email delivery recovers.

What you must change after any hack

Reinfection almost always comes from a credential the cleanup missed:

• Every admin and user password, and the hosting/SFTP/database passwords.
• The WordPress secret keys and salts in `wp-config.php` (this invalidates stolen session cookies).
• Any API keys, tokens or webhook secrets that lived in config or the database.
• Review who has access and remove anything you don't recognise.

Hacked-site questions