How to Fix a Hacked WordPress Site (Including the Redirect Hack)

The most common WordPress compromise redirects visitors — often only visitors arriving from Google, and often only on mobile — to a spam site. Because it hides from logged-in administrators and direct visits, it can run for weeks before anyone notices.

Cleaning it is straightforward. Not getting reinfected is the actual job, and it depends entirely on finding the entry point.

1. Contain it

1. Put the site in maintenance mode, or take it offline if you can afford to.
2. Take a full backup now, infected as it is. You will want it for forensics, and to recover anything you delete by mistake.
3. Change all passwords: WordPress admins, hosting panel, SFTP/SSH, and the database.
4. Rotate the salts in wp-config.php using the official generator. This logs everyone out, including the attacker's session.

2. Find the entry point before cleaning

This is the step people skip, and it is why sites get reinfected. Look for:

• Out-of-date plugins and themes, especially any with a known vulnerability. Check their changelogs for security releases you missed.
• Unexpected admin users in Users → All Users. Note the registration date — it tells you roughly when they got in.
• Access logs around that date. Look for POSTs to unusual paths, especially in wp-content/uploads/.
• Recently modified files. On a server you control: find . -type f -mtime -14 -name "*.php". Anything modified recently that you did not change is suspect.
• PHP files in the uploads folder. There should be none, ever. A PHP file under wp-content/uploads/ is a backdoor until proven otherwise.

3. Clean

1. Replace core. Download a fresh copy of your WordPress version and overwrite wp-admin and wp-includes entirely. Never overwrite wp-content.
2. Reinstall every plugin and theme from source rather than trying to clean them. Delete and reinstall — do not patch.
3. Check wp-config.php, .htaccess and index.php for injected code. Redirect hacks very often live in .htaccess as a conditional rule that only fires for search-engine referrers.
4. Check the database. Look in wp_options for injected scripts in siteurl, home, and any custom header/footer option. Then check wp_posts for injected <script> tags.
5. Check scheduled tasks. Attackers add cron events that reinstall the payload after you clean it. A cron-viewing plugin will list them; anything unfamiliar goes.
6. Delete unknown admin users — after you have noted their creation dates.

4. Verify

• Test as a search visitor, not as yourself: use a private window and arrive via a Google result, on mobile. That is the exact condition many redirect hacks trigger on.
• Scan with a reputable security plugin, and separately with an external scanner so you are not trusting a single source.
• Check Search Console → Security Issues, and request a review if the site was flagged.
• Compare your site's source against a known-good copy if you have one.

5. Close the door

• Update everything, and remove every plugin and theme you are not using — inactive code is still reachable.
• Add define( 'DISALLOW_FILE_EDIT', true ); to wp-config.php.
• Block PHP execution in wp-content/uploads/ at the server level.
• Enforce strong passwords and two-factor for every administrator.
• Set up file-integrity monitoring so the next change is noticed in hours, not weeks.
• Make sure backups are automated, off-site, and that you have restored one at least once as a test.

When to bring in help

If the site handles payments or personal data, if you cannot find the entry point, or if it reinfects after a clean, get a professional incident-response service. The cost of a second compromise on a commercial site is far higher than the clean-up fee — and with personal data involved there may be disclosure obligations that are not optional.