Redirects to pharmacy sites, weird Japanese pages in search results, Google warning visitors: the WordPress hack moment arrives for many owners eventually.
Updated August 09, 2026, after a fresh review, with updated visuals and links.
It's fixable, systematically. Panic costs days; method costs hours. Follow the order and your site comes back cleaner than it was.
Get this ready first
- Hosting access (control panel, file manager or FTP)
- Your calm
- Two to four hours
Doing it properly
1. Confirm and contain
Verify it's really a hack (redirects, foreign files, search warnings) then put the site in maintenance or take it offline at the host level: protecting visitors from infection matters more than appearances while you work.
2. Restore from backup if you have one
A clean backup predating the infection is the gold path: restore, then HARDEN heavily (below), whatever door they used was photographed in your logs. No backup: continue the manual cleanup path next, it works, just more slowly.
3. Manual clean: core files first
Download fresh WordPress core from wordpress.org and replace wp-admin and wp-includes directories completely, plus root files except wp-config.php and wp-content. Most infections live in modified core files, this move amputates them wholesale.
4. Sweep wp-content like a detective
Sort files by modified date: suddenly edited themes/plugins in recent days are the crime scene. Reinstall all plugins and themes fresh from official sources, delete uploads of .php files (uploads should hold images, not scripts), and remove anything you don't recognize.
5. Hunt the backdoors and rogue admins
Attackers leave spare keys: check Users for admins you didn't create, search files for evil code signatures (base64_decode, eval(, gzinflate in odd places), and scan the database with Wordfence post-restore for injected spam links. One missed backdoor repopulates the whole clown show.
6. Rotate every credential in existence
WordPress admin passwords, hosting panel, FTP/SSH, database password (in wp-config.php), API keys, everything. Assume full compromise: total rotation is the only honest response.
7. Harden so the sequel never premieres
All software updated (WordPress, theme, every plugin), delete unused themes/plugins, security plugin installed with firewall on, two factor on admin logins, disable file editing in wp-config (define DISALLOW_FILE_EDIT true), XML-RPC off if unused, backups now scheduled and shipped off site automatically.
8. Clean the reputation
Google Search Console, Security issues: request a review once cleaned, warnings lift within days. Any blocklists flagged, request delisting with evidence: your traffic returns as the labels fade.
A few things worth knowing
- Change database table prefix? Given a rebuild, yes (wp_ to random), it's the little extra many guides skip.
- Host logs show the entry point (file uploads, a plugin's old version): hosts' support teams often help identify it, ask them.
- Consider managed WordPress hosting or a cleanup service (Sucuri etc) if time exceeds budget: professionals clean in hours what costs mortals weekends.
Keep reading
- How to Install Windows 11 on an Unsupported PC (No TPM 2.0, Older CPU)
- How to Use AI to Write a Cover Letter That Doesn't Sound Like AI
- QR Code Scams Are Everywhere: How to Scan Safely (Parking Meters, Menus, Packages)
Contain, restore or rebuild, sweep content, salt every password, harden everything, ask for review. The hack ends up being the day your site's security finally grew up.
