How to clean up a hacked website and fix malware
Website hacks manifest as random redirects, injected footer scripts, and unexpected user logouts that force owners to spend entire weekends manually scanning files and troubleshooting PHP functions at 3 AM. This demanding clean-up process stems from neglecting basic security hardening before the breach occurs, leaving sites entirely vulnerable to compromises.
What the numbers show
Counted from the threads quoted below. How we count
- The most recent one is from September 2026.
- This comes up 125.6× more often in r/Wordpress than across the site as a whole.
What people tried
Every workaround mentioned in the threads below. We haven’t tested any of them — and nobody here is claiming they worked.
Found another way around this?
Share your steps and trade-offs so fellow engineers don't have to reinvent the wheel. No account required.
- 1Searching through files manually at 3 AM to find injected malwareDid this help you?
- 2Installing security plugins like Wordfence, MalCare, or VirusdieDid this help you?
- 3Hardening server configurations and disabling unused endpointsDid this help you?
- 4Using version control and offsite backups to roll back changesDid this help you?
- 5backing up the siteDid this help you?
- 6changing file permissionsDid this help you?
- 7changing saltsDid this help you?
- 8using security plugins like WordfenceDid this help you?
- 9blocking bots via network level controlsDid this help you?
- 10Scanning local computers and browsers for malicious extensions or malwareDid this help you?
- 11Manually checking server files, themes, plugins, and database tables for hidden accounts or backdoorsDid this help you?
- 12Rotating all passwords, SFTP credentials, and application passwordsDid this help you?
- 13Starting fresh by building on a new server or restoring from a clean local backupDid this help you?
- 14Repoint the domain if registered separatelyDid this help you?
- 15Change every login the site touchedDid this help you?
- 16Reply directly to the takedown notice instead of opening a support ticketDid this help you?
- 17Switching hosting providers to Kinsta or SitegroundDid this help you?
- 18Running a malware scan with WordfenceDid this help you?
- 19Removing unnecessary plugins and updating themesDid this help you?
- 20Using malware cleanup servicesDid this help you?
- 21visiting local food pantriesDid this help you?
- 22reaching out to 211Did this help you?
- 23visiting local churches for helpDid this help you?
- 24freezing credit reports and bank accounts through government departmentsDid this help you?
- 25Switching to alternative platforms like Shopify or WebflowDid this help you?
- 26Building sites directly with code or using AI tools like ClaudeDid this help you?
In their words
Unedited, grouped by where they were said, most upvoted first within each place, each linked to the thread it came from.
“so yeah... i got hacked last year. it was a mess. random redirects, weird scripts showing up in my footer, users getting logged out for no reason.”source ↗
“spent an entire weekend cleaning it up manually, scanning files, comparing timestamps, googling random php functions at 3am.”source ↗
“My WordPress site was hacked, even though I use security plugins like All-in-One and Wordfence.”source ↗
“Honestly, I’m not sure what else to check—I’ve reviewed the files and set up 2FA for WordPress, and everything seems fine for now, but the IP address thing is still on my mind.”source ↗
“I got hacked recently. Full pain the arse. My own fault as I had done zero to secure the site as it wasn't for a live service.”source ↗
“My Flywheel hosted WP site had a virus and I've heard from several ppl to switch off Flywheel?”source ↗
“I clearly have a backdoor door somewhere open, I’ve done everything I can and more to fix this issue, I’ve done backups you name it.. can anyone help me out as my Wordpress core files keep changing”source ↗
“So login to Wordpress, Wordfence deactivated, reactivate it.. then deactivated again, login to cloudflare 22,000 traffic for my domain, then login to cPanel.. Wordpress core files changed… get the picture”source ↗
“Brother I’ve tried everything, changing file permissions, salts, wp,admin cloudflare, Wordfence”source ↗
“We were locked out of all business and personal accounts, and we lost everything we had been building.”source ↗
“Both of our private info was spread across the dark web including Social Security Numbers and all the passwords to our socials and bank accounts.”source ↗
“we won’t be able to make rent, and we currently are unable to get groceries.”source ↗
“Any issues are NOT responded to AT ALL.”source ↗
“My website got hacked into and- because the hacker destroyed said website / is using it to slander my business- just got taken down.”source ↗
“My card information is on that website and I have fought tooth and nail with every one of their customer service outlets to absolutely no avail or resolution.”source ↗
Where this came up
People with this problem also raised
- 2Client doesn't know where their WordPress site is hosted
- 2KB5124008 breaking domain trust?
- 2How to get banks to take responsibility for wire fraud and scams
- 7Do mandatory passkeys bypass traditional two-factor authentication?
- 6Why does editing AI website code break other parts of the site?
- 5Competitors got my MSP client list and license expiration dates