Finding out your website has been compromised is a digital nightmare. Your heart sinks, your stomach drops, and your first instinct might be to frantically click around your dashboard trying to delete suspicious files. But panicking can lead to critical mistakes—like accidentally deleting your only clean database backup or tipping off the hacker before you have secured your server access. Knowing how to recover a hacked WordPress site in those first ten minutes is crucial to limiting structural damage, preserving your hard-earned SEO rankings, and keeping your visitors safe from malicious redirects.

When a breach occurs, time is your absolute enemy. The faster you isolate your environment, the less time malicious scripts have to infect your server files or steal user credentials. This step-by-step triage guide walks you through the immediate actions you must take the moment you realize your security has been compromised.

The 10-Minute Triage Sequence

1. Go Offline and Contain the Damage: Minutes 1 to 2.

The absolute first step is isolation. You must stop the hacker from interacting with your files and prevent search engines from indexing the malicious code. Log into your hosting control panel (cPanel, hPanel, or custom dashboard) and take the site offline.

If your host has a “Maintenance Mode” toggle, turn it on. Alternatively, edit your .htaccess file to block all incoming traffic except your own IP address, or temporarily point your domain name to a static “Down for Maintenance” page. This halts active malware redirects and protects your site visitors from drive-by downloads.

2. Lock the Front Door (Reset Server Credentials): Minutes 3 to 4.

If an attacker has server-level access, changing your WordPress administrator password inside the dashboard is useless. You must lock them out from the server root first.

Go to your hosting panel and change the passwords for your SFTP/FTP accounts, your hosting control panel, and your MySQL database. Once you update the database password, your site will show a “Database Connection Error.” Do not worry; this is normal and prevents the infected WordPress files from communicating with your database while you clean things up.

3. Assess the Entry Point and Backups: Minutes 5 to 7.

Now that the site is isolated, identify your recovery route. Check your hosting account or external cloud backups to see when the last clean, automated backup was generated.

If you have a clean backup from yesterday, restoring it is often the cleanest and fastest way to recover. However, if you must clean the site manually, log into your SFTP client and look for recently modified files. Hackers frequently hide malicious PHP scripts inside the wp-config.php file, the index.php root file, or deep within your active theme folders.

4. Check User Privilege Accounts: Minutes 8 to 10.

Hackers almost always create a “backdoor” account with administrator privileges so they can slip back into your site even after you update your password. If you still have access to your database via phpMyAdmin, open the wp_users tables.

Scan the user list for unfamiliar email addresses or usernames with administrative access (user level 10). Delete these rogue accounts immediately to prevent unauthorized re-entry.

Cleaning the Core Files Safely

Once you have completed the initial 10-minute triage, it is time to systematically purge the infection. If you do not have a clean backup to restore from, you will need to replace your core application files.

Fortunately, you can do this without losing your custom blog posts, pages, or media library:

  • Download a Fresh WordPress Core: Grab a clean ZIP file of your current WordPress version directly from the official repository.
  • Delete Old Core Directories: Using SFTP or your host’s File Manager, delete your existing wp-admin and wp-includes directories completely. Do not touch your wp-content directory yet, as this is where your images and themes live.
  • Upload Fresh Files: Extract your fresh WordPress ZIP file and upload the clean wp-admin and wp-includes directories to your server, overwriting any loose core files in the root folder (like wp-login.php).
  • Inspect the wp-config.php file: Open this file manually and compare it against a default wp-config-sample.php layout. Look for long, obfuscated strings of random letters and numbers at the top of the file—this is a classic sign of injected hacker code. Replace your database salt keys with fresh ones generated by the official WordPress API.

Warning: Never simply upload a clean version over your old directories without deleting them first. Doing so leaves hidden malicious files untouched inside those folders, allowing the hack to persist.

Rebuilding and Future Hardening

Recovering your site is only half the battle; keeping it secure is the other. Once your site is clean and back online, you must put strict defensive protocols in place. Make sure to audit your entire theme and plugin library. Delete any inactive elements, update all active components to their latest versions, and implement a robust security plugin to act as an active firewall.

For a comprehensive guide on keeping your setup permanently locked down, review our 2026 hardening checklist to seal common entry points. If you need step-by-step guidance on choosing the right defensive software to monitor your directories moving forward, consult our breakdown of the best WordPress security plugins on the market today.

For further developer-level resources on repairing database injections, check out the official WordPress support guide on hacked sites to read their technical troubleshooting documentation.

Get Professional WordPress Recovery Support

Finding and neutralizing hidden backdoors, database injections, and malicious redirects is highly technical. If you are struggling to clean your files or if your site keeps getting hacked, let’s get it sorted out permanently. Just contact me here with details about your situation, and I will perform a deep server cleanup to restore your site safely and quickly.