What Really Happens When We Clean Up a Hacked WordPress Site

A client calls because a few product pages suddenly look strange, or Google starts flagging their site in search results, or their hosting account sends a warning email at 2 a.m. By the time anyone notices, the site has usually been compromised for days or weeks already. That’s the uncomfortable truth about WordPress malware: it’s built to be quiet. The goal isn’t to crash your site — a crashed site gets noticed and fixed. The goal is to sit inside it, generating spam pages, stealing traffic, or waiting to be used for something worse, for as long as possible without you knowing.

We’ve cleaned up enough infected WordPress sites at this point to know the process isn’t mysterious. It’s methodical. Here’s what actually happens, step by step, when we get a site back from an infection — and what we put in place afterward so it doesn’t happen again.

It Usually Doesn’t Look Like a Hack At First

Business owners expect a hack to look dramatic — a ransom note, a defaced homepage, something obvious. In reality, the first sign is almost always something small and easy to dismiss:

Any one of these on its own can look like a fluke. Together, or repeated, they’re the pattern we look for. The sites that recover fastest are the ones where someone noticed early and asked for help instead of waiting to see if it “goes away.”

What’s Actually Living Inside an Infected Site

Once we’re in, the infection almost never looks like a single obvious virus file. It’s a small ecosystem of pieces working together, and each one has to be found and removed, or the infection just grows back:

Fake plugins. Attackers love naming malicious plugins things like “WP Security Helper,” “WP Compat,” or “Site Health Utilities” — names designed to look like exactly the kind of plugin a site owner would leave alone. They sit active in the plugin list, blending in.

Database payloads. A huge amount of the actual malicious content lives in the WordPress database itself, not in files — rows in the wp_options table with random hash-like names, holding encoded scripts that regenerate spam content or redirect visitors.

Injected code in core files. We regularly find a single extra line quietly added to wp-config.php or a theme’s functions.php that pulls in a hidden file elsewhere on the server. It’s a one-line change in a file nobody thinks to check.

Rogue admin accounts and backdoor credentials. Attackers frequently create a new administrator account, or — more quietly — generate a WordPress Application Password or API key for an existing account. Those don’t show up as a suspicious login at all, which makes them one of the easiest ways back in after a “cleanup” that only changed the main password.

Scheduled tasks that keep rebuilding the infection. This is the part that trips up a lot of DIY cleanups. A cron job or a background worker process keeps re-writing the malicious files every few minutes. You can delete every infected file by hand, walk away, and find the exact same files back an hour later, because you deleted the symptom and left the thing that keeps recreating it running.

The Cleanup, Step By Step

This is roughly the order we work in, and skipping steps is almost always why a “cleaned” site gets reinfected within a week:

1. Back up first, even the infected version. Before touching anything, we take a full backup of the site exactly as it is. If something goes wrong during cleanup, or if we need to prove what was changed later, we want the original evidence preserved.

2. Quarantine, don’t delete. Suspicious files and plugins get moved to a separate, non-executable folder rather than deleted outright. This matters more than it sounds — sometimes a file that looks malicious turns out to be a legitimate (if oddly named) part of a client’s own integration, and you only find that out if you can still look at it.

3. Find and stop whatever is regenerating the infection. Before any cleanup sticks, we track down the cron jobs and background processes actually causing the reinfection and kill them. This is usually the single step that makes the difference between a cleanup that lasts and one that doesn’t.

4. Replace WordPress core, and audit every theme and plugin file. Core WordPress files get replaced with known-clean copies from the official source rather than “fixed” in place. Every theme and plugin file gets scanned for injected code, obfuscated functions, or anything that doesn’t belong in a legitimate plugin.

5. Clean the database. The malicious option rows, spam posts, and hidden redirects get removed from the database directly. Spam posts get set to trash rather than permanently deleted, so there’s a record if anything needs to be reviewed later.

6. Remove every backdoor, not just the obvious one. Rogue admin accounts get demoted or removed. Every application password and active session gets revoked, not just reset. This is the step people most often forget, and it’s exactly how an attacker walks back in two days after a “successful” cleanup.

Locking The Door So It Doesn’t Happen Again

Cleaning up the infection is maybe half the job. The other half is making sure the same door doesn’t open twice:

What A Hack Actually Costs You

The cleanup itself is rarely the expensive part. The real cost is what happens while the infection is live and unnoticed: Google can flag or de-index the site, which can take weeks to fully recover from even after it’s clean. Visitors who land on a spam redirect don’t come back. Hosting providers sometimes suspend an infected account outright, taking the whole site offline with no warning. And if the site collects leads or customer information, a compromise raises real questions about what else may have been exposed.

None of that is meant to be alarmist — it’s just the practical case for treating “my site feels a little off” as worth a same-day look, instead of something to monitor for a while first.

Why “Just Install a Security Plugin” Isn’t the Full Answer

Security plugins are genuinely useful, and we recommend and configure them on every site we manage. But they’re built to catch known attack patterns and known malware signatures — they’re much better at stopping a new infection than at fully untangling one that’s already established itself across the database, the files, and the admin accounts. A scanner can flag a suspicious file; it generally won’t tell you that a cron job is silently rewriting that file every ten minutes, or that there’s a second, quieter admin account sitting one page away from the one you just secured. That’s the gap between “we have a security plugin installed” and “we actually checked.”

If Something Feels Off, Don’t Wait

Most of the infected sites we’ve worked on had warning signs for days or weeks before anyone acted on them. If your site has strange posts you didn’t write, a security warning from your host or from Google, an admin account you don’t recognize, or it’s simply been a long time since anyone checked, that’s worth a look now rather than later.

Vandulo handles WordPress security hardening, malware cleanup, and ongoing website maintenance for businesses that need their site to just stay up, stay clean, and stay fast. We also set up SSL and core website security correctly from day one on new builds, so there’s less to clean up later. If you’re not sure whether your site is affected, reach out through our contact form or use the chat widget on our site, and we’ll take a look.