WordPress Site Hacked? The Complete Cleanup and Hardening Guide for 2026

If your WordPress site was hacked, here is the short version: isolate the site, change every credential, restore or clean the files, patch the entry point, then harden so it cannot happen again. This guide walks through each step in order, what professional cleanup costs in Canada, and the exact hardening checklist we run on every client site we maintain.

Summary

• Most WordPress hacks come from outdated plugins, nulled themes, weak passwords, or abandoned admin accounts. Not from WordPress core.
• The first hour matters: put the site in maintenance mode, rotate all credentials, and snapshot everything before touching files.
• Cleanup means finding every backdoor, not just the visible payload. Attackers plant multiple re-entry points on purpose.
• Professional cleanup in Canada runs $300 to $2,500 CAD depending on severity. Ongoing maintenance that prevents it runs $75 to $300 per month.
• Hardening is layered: updates, least-privilege accounts, 2FA, a firewall, file integrity monitoring, and offsite backups.

Table of Contents

• How do WordPress sites get hacked in the first place?
• How do you know your WordPress site was actually hacked?
• What should you do in the first hour?
• What if you run WooCommerce or store customer data?
• How do you find and remove the malware?
• How do attackers get back in after a cleanup?
• What does hacked site recovery cost in Canada?
• How do you harden WordPress so it does not happen again?
• Should you handle security yourself or pay for maintenance?
• Common mistakes
• FAQ

How do WordPress sites get hacked in the first place?

Knowing the entry points changes how you clean and what you harden. Across the compromised sites we have rebuilt for Canadian clients, the causes cluster into a short list:

• Outdated plugins with known vulnerabilities. The single biggest cause. A disclosed plugin vulnerability gets scanned for across the entire web within hours of publication, and sites that patch monthly instead of weekly sit exposed in that window.
• Nulled (pirated) themes and plugins. These frequently ship with the backdoor pre-installed. The hack does not need to break in; you installed it.
• Credential attacks. Reused passwords from old breaches, admin usernames left as “admin,” and no 2FA. Login endpoints get hammered by credential-stuffing bots around the clock.
• Abandoned accounts and old installs. The former employee who still has admin. The forgotten staging copy at /old/ running a three-year-old WordPress. Attackers find these faster than owners remember them.
• Cross-contamination on shared hosting. One compromised site on a hosting account with loose file permissions can infect every neighbouring install.

Notice what is not on the list: WordPress core. Core exploits are rare and patched fast. The ecosystem around a site, and the habits of the people running it, are the attack surface.

How do you know your WordPress site was actually hacked?

Some compromises are loud. Others run quietly for months. Signs of a hacked WordPress site include:

• Google Search Console warnings (“This site may be hacked” or a Security Issues notice).
• Redirects to spam, pharma, or casino pages, sometimes only for mobile visitors or only from Google referrals.
• New admin users you did not create, or users with subscriber roles suddenly holding admin rights.
• Unknown PHP files in wp-content/uploads, or core files with recent modification dates you cannot explain.
• Spikes in outbound mail, spam pages indexed under your domain (check with a site: search), or your host suspending the account.
• Sudden ranking collapse with no algorithm update to blame.

One quiet Tuesday check we recommend to every Canadian business owner: search site:yourdomain.com on Google monthly. If you see pages in Japanese or pages selling products you do not sell, you are compromised, regardless of how normal the site looks to you.

What should you do in the first hour?

The first hour is about containment and evidence, not repair. In order:

1. Snapshot everything. Take a full file and database backup of the infected state before changing anything. You will need it to trace the entry point.
2. Put the site into maintenance mode or password-protect it at the server level so visitors stop hitting infected pages.
3. Rotate every credential. WordPress admin passwords, database password, hosting control panel, SFTP, and any reused passwords elsewhere. Assume all of them leaked.
4. Audit the users table. Delete admin accounts you do not recognize and downgrade anything suspicious.
5. Check with your host. Many Canadian hosts keep 14 to 30 days of server backups and can tell you when file changes started, which narrows the infection window.
6. Do not delete anything yet. Deleting visible malware before finding the backdoor just tells the attacker to rotate to their spare entry point.

What if you run WooCommerce or store customer data?

A hacked brochure site is a technical problem. A hacked store or membership site is a legal one, and Canadian businesses have specific obligations here.

Under PIPEDA, if a breach of security safeguards creates a real risk of significant harm to individuals, you are required to report it to the Office of the Privacy Commissioner of Canada, notify the affected individuals, and keep records of the breach. Alberta’s PIPA has its own notification requirements for provincially regulated private organizations. “We cleaned it quietly and moved on” is not a compliant option if customer names, emails, addresses, or payment details may have been exposed.

Practically, that changes your first-hour list in three ways:

1. Preserve evidence properly. The infected-state snapshot is now a compliance record, not just a debugging aid. Store it securely and note timestamps.
2. Determine what data was reachable. Order tables, customer tables, and any stored payment tokens. If you use a hosted gateway like Stripe, card numbers were likely never on your server, which materially reduces the harm assessment. Confirm rather than assume.
3. Get advice before communicating. Notification wording and timing have legal weight. A short call with a privacy lawyer costs a few hundred dollars; a mishandled notification costs much more. (This paragraph is general information, not legal advice.)

Stores also justify a heavier prevention posture: staging environments for updates, a stricter firewall ruleset, and shorter patch windows. If your revenue flows through the site, treat security spend as a cost of goods sold, not overhead.

How do you find and remove the malware?

Cleanup has one goal: remove every trace of attacker access, not just the parts causing symptoms. The reliable sequence:

1. Compare core files against a clean copy. Download your exact WordPress version from wordpress.org and diff it against your install. Replace all core files outright.
2. Scan for injected code. Look for eval, base64_decode, gzinflate, and str_rot13 patterns in themes, plugins, and especially wp-content/uploads, which should never contain PHP at all.
3. Reinstall every plugin and theme from source. Never trust the copies on the server. If a plugin has no clean source (nulled or abandoned), it goes.
4. Inspect wp-config.php and .htaccess. These two files are favourite hiding spots for injected redirects and file inclusion tricks.
5. Check scheduled tasks. Malware frequently reinstalls itself through wp-cron entries or server cron jobs. List them and remove anything you cannot identify.
6. Clean the database. Search wp_options and wp_posts for script tags and iframe injections, and check for rogue entries in the active_plugins option.
7. Re-scan with two independent tools. One scanner is an opinion. Two agreeing is a diagnosis.
8. Request a review in Google Search Console once clean, so warnings and blacklist flags are lifted.

How do attackers get back in after a cleanup?

Reinfection within days is the most common cleanup failure, and it almost always traces to one of four leftovers: a web shell buried in uploads with an innocent filename, a rogue admin or application password that survived the rotation, the original vulnerable plugin restored from an old backup, or a compromised neighbouring site on the same hosting account. Shell scripts of the wp2shell family are specifically designed to scatter copies of themselves so that deleting the obvious one accomplishes nothing.

This is why the snapshot from hour one matters. Tracing the actual entry point, then closing it, is the difference between a cleanup and a subscription to cleanups.

What does hacked site recovery cost in Canada?

Scenario	Typical cost (CAD)	Timeline
Simple defacement, clean backup available	$300–$600	Same day
Malware injection, no clean backup	$600–$1,500	1–3 days
Deep compromise (backdoors, SEO spam indexed, blacklisted)	$1,500–$2,500+	3–10 days plus reindexing
Ongoing maintenance plan that prevents most of this	$75–$300/month	Continuous

The hidden cost is usually bigger than the invoice: lost rankings while spam pages are indexed, lost revenue while the site is down, and lost trust if customers hit a redirect. For a breakdown of what ongoing care actually includes, see How Much Does Website Maintenance Cost in Canada?

Run the downtime math for your own business before deciding any of this is expensive. A site producing $10,000 CAD a month in attributable revenue loses roughly $330 for every day it is offline or blacklisted, and a Search Console reinfection flag can suppress clicks for weeks. Two other line items surprise owners: developer hourly rates for emergency work run $90 to $180 CAD against $60 to $120 for scheduled work, and if you carry cyber insurance, check whether it requires documented security practices. Some Canadian policies will not pay out on a site running years-old software with no backups, which turns “we never got around to maintenance” into an uninsured loss.

How do you harden WordPress so it does not happen again?

Hardening is layers, not a single plugin. The checklist we run on every site we maintain:

• Automatic updates for core and minor plugin releases, with weekly manual review of majors.
• Delete inactive plugins and themes entirely. Deactivated code is still attackable code.
• Two-factor authentication on every admin account, no exceptions.
• Least privilege: authors get author accounts, clients get editor accounts, almost nobody gets admin.
• A web application firewall in front of the site.
• Block PHP execution in wp-content/uploads at the server level.
• Disable file editing in the dashboard (DISALLOW_FILE_EDIT).
• File integrity monitoring that alerts on changed core files.
• Daily offsite backups with at least 30 days of retention, tested quarterly by actually restoring one.
• Unique passwords from a password manager, and remove former staff and agency accounts the day the relationship ends.

None of this is exotic. It is discipline, applied weekly. Managing this across many sites is its own operational problem, which we covered in How Do You Manage 10+ Client WordPress Sites Without Losing Your Mind?

What does a good weekly security routine look like?

Hardening decays without a routine. The weekly pass we run takes about 15 minutes per site once systemized:

• Apply pending plugin, theme, and core updates, reading changelogs for anything flagged as a security release.
• Review the firewall and login logs for repeated blocked attempts from single sources.
• Check the file integrity report for unexpected changes.
• Confirm last night’s backup completed and spot-check its size against the previous week.
• Glance at Search Console for new security issues or odd indexed pages.

Monthly, add a user audit (remove anyone who no longer needs access), a site: search for spam indexation, and a test restore each quarter. Boring, repeatable, and the reason maintained sites almost never appear in our cleanup queue.

Should you handle security yourself or pay for maintenance?

A simple decision framework:

• DIY makes sense if the site is a low-stakes brochure, you are comfortable with SFTP and backups, and an outage costs you reputation but not revenue.
• Pay for maintenance if the site generates leads or sales, you run WooCommerce or store customer data, or the honest answer to “when did you last test a backup restore” is never.

At $75 to $300 CAD per month, professional maintenance costs less per year than a single deep cleanup, before counting downtime. A slow, compromised site also bleeds conversions long before it fails outright, a pattern we documented in Is a Slow Website Costing You Sales?

Common mistakes

• Restoring a backup that already contains the backdoor, then declaring victory.
• Deleting the visible payload without diffing core files or checking uploads for PHP.
• Rotating the WordPress password but not the database, SFTP, and hosting credentials.
• Keeping nulled plugins because “they still work.” They are the single most common infection source we see.
• Skipping the Search Console review request, leaving the site flagged for weeks after it is clean.
• Treating security as a one-time project instead of a weekly routine.

FAQ

What should I look for in a malware scanner?

Three capabilities matter more than brand names. Server-side scanning, because remote scanners only see rendered pages and miss backdoors that produce no visible output. Core file integrity checking against wordpress.org checksums, because signature databases lag new malware but a changed core file is always a red flag. And scheduled scans with alerting, because a scanner you have to remember to run is a scanner that runs after the damage. Pair one plugin-based scanner with one independent server-side or external scan so a compromised WordPress install cannot lie to you about its own health. Free tiers cover most brochure sites; stores should budget $100 to $300 CAD per year for the paid tier of whichever stack their maintenance provider standardizes on.

Can I just restore a backup instead of cleaning?

Only if the backup predates the infection and you patch the entry point immediately after restoring. Restore an infected backup, or restore a clean one without fixing the vulnerable plugin, and you will be reinfected within days.

Why does my hacked site look completely normal to me?

Modern SEO spam hacks cloak: they show clean pages to logged-in users and direct visitors, and spam or redirects only to search engine crawlers and Google referrals. Check as Googlebot or use an incognito search click, and run a site: search on your domain.

How long does it take rankings to recover after a hack?

Once the site is clean and the Search Console review passes, most sites recover in 2 to 8 weeks. If spam pages were indexed under your domain, expect the longer end while Google recrawls and drops them.

Is WordPress itself insecure?

No. Core WordPress is well maintained and patched quickly. The overwhelming majority of compromises come through outdated or pirated plugins and themes, weak credentials, and poor hosting hygiene. WordPress runs over 40% of the web, so it is the biggest target, not the weakest one.

Conclusion

A hacked WordPress site is recoverable, but the sequence matters: contain, snapshot, rotate credentials, clean everything from source, close the entry point, then harden in layers. The businesses that get hacked twice are the ones that stopped at “the redirect is gone.”

And the cheapest cleanup is the one that never happens. Fifteen disciplined minutes a week, 2FA on every admin account, and a tested backup will keep you out of every table in this article. Whether you build that routine yourself or hand it to a maintenance provider matters far less than starting it this week, while your site is still clean.

If you would rather never think about this again, our website growth packages include the full hardening stack, monitoring, and same-day response as standard. Start with our intake form and we will audit your site’s current exposure.