How to clean up a hacked website and fix malware
Website hacks manifest as random redirects, injected footer scripts, and unexpected user logouts that force owners to spend entire weekends manually scanning files and troubleshooting PHP functions at 3 AM. This demanding clean-up process stems from neglecting basic security hardening before the breach occurs, leaving sites entirely vulnerable to compromises.
What people tried
Every workaround mentioned in the threads below. We haven’t tested any of them — and nobody here is claiming they worked.
- 1Searching through files manually at 3 AM to find injected malware
- 2Installing security plugins like Wordfence, MalCare, or Virusdie
- 3Hardening server configurations and disabling unused endpoints
- 4Using version control and offsite backups to roll back changes
- 5backing up the site
- 6changing file permissions
- 7changing salts
- 8using security plugins like Wordfence
- 9blocking bots via network level controls
- 10Scanning local computers and browsers for malicious extensions or malware
- 11Manually checking server files, themes, plugins, and database tables for hidden accounts or backdoors
- 12Rotating all passwords, SFTP credentials, and application passwords
- 13Starting fresh by building on a new server or restoring from a clean local backup
- 14Repoint the domain if registered separately
- 15Change every login the site touched
- 16Reply directly to the takedown notice instead of opening a support ticket
In their words
Unedited, most upvoted first, each linked to the thread it came from.
“so yeah... i got hacked last year. it was a mess. random redirects, weird scripts showing up in my footer, users getting logged out for no reason.”source ↗
“spent an entire weekend cleaning it up manually, scanning files, comparing timestamps, googling random php functions at 3am.”source ↗
“My WordPress site was hacked, even though I use security plugins like All-in-One and Wordfence.”source ↗
“Honestly, I’m not sure what else to check—I’ve reviewed the files and set up 2FA for WordPress, and everything seems fine for now, but the IP address thing is still on my mind.”source ↗
“I got hacked recently. Full pain the arse. My own fault as I had done zero to secure the site as it wasn't for a live service.”source ↗
“Any issues are NOT responded to AT ALL.”source ↗
“My website got hacked into and- because the hacker destroyed said website / is using it to slander my business- just got taken down.”source ↗
“My card information is on that website and I have fought tooth and nail with every one of their customer service outlets to absolutely no avail or resolution.”source ↗
“I clearly have a backdoor door somewhere open, I’ve done everything I can and more to fix this issue, I’ve done backups you name it.. can anyone help me out as my Wordpress core files keep changing”source ↗
“So login to Wordpress, Wordfence deactivated, reactivate it.. then deactivated again, login to cloudflare 22,000 traffic for my domain, then login to cPanel.. Wordpress core files changed… get the picture”source ↗
“Brother I’ve tried everything, changing file permissions, salts, wp,admin cloudflare, Wordfence”source ↗
Where this came up
People with this problem also raised
- 5Why does editing AI website code break other parts of the site?
- 3Competitors got my MSP client list and license expiration dates
- 4Why are automated bot attacks and hacking attempts suddenly surging?
- 2How to recover mentally after shutting down a business
- 11How to recover from severe travel burnout and flight dread
- 3How to stop software updates from breaking your production website