WordPress security and cleanup of a hacked WordPress site

What a hacked WordPress site looks like and why it happens

WordPress runs a very large part of the web, and that’s why it’s a frequent target of automated attacks. Many sites are secured only once: a security plugin is installed, left on autopilot, and nobody goes back to check the configuration, the updates or who has access. A hacked WordPress site shows in several ways: the site appears defaced, redirects to phishing pages, mines crypto in the background, or Google marks it as a “deceptive site” and drops it from the results. When that happens, the business has already taken the hit: lost traffic, red warnings in the browser, rankings falling.

WordPress security before and after a hack

They are two different jobs. One is done before, with the site healthy, and it usually costs quite a bit less than the other one, which is putting out the fire. If you got here with the site already compromised, start with the second block.

If your WordPress site is still healthy

• Website security audit: the real state of your site before something happens. What is exposed, which plugin or theme has a known vulnerability, which accounts are unnecessary and where they would get in. It ends in a prioritized list, with what needs fixing first and why.
• Hardening with judgment: file permissions, protected wp-config, XML-RPC depending on your case, MFA for every administrator, security headers and HTTPS done right. What fits your site based on how it works, so the hardening doesn’t break anything.
• Plugin and theme audit: I identify what’s abandoned, what’s vulnerable and what asks for more permissions than it needs. I replace or remove the dead code, which is one of the most common ways in.
• Server-level protection: WAF rules on the server and the CDN to stop common attacks before they reach PHP, plus orderly access with logs that do get reviewed. Inside the site, a plugin like Wordfence configured for your case also counts.
• Backups that restore: I leave tested backups and a recovery plan that works.
• Ongoing security maintenance, if you want it: periodic review (updates, backups and integrity monitoring) so you don’t fall into the same incident again. No lock-in: you take it with me or with whoever you prefer.

If your WordPress site is already hacked

• Containment first: I isolate the site so it stops doing damage (to your visitors, your reputation and your ranking) before touching anything else.
• Serious malware scan: analysis with wp-cli and my own tools on the database and the filesystem, plus the security plugin’s scanner if the site has one. I find shells, backdoors, injected cron jobs, malicious redirects and hidden SEO injection.
• Cleanup and recovery: I remove the malicious code, rotate every credential and restore from a clean backup when there’s one. Simply restoring on top usually leaves the door open.
• Entry point identified and closed: if the way they got in isn’t closed, they come back through the same door. It’s the first thing worth asking when someone offers to “clean up your site”.
• Getting off Google’s lists: if the site was marked as deceptive or dangerous, it gets properly cleaned and only then is the review requested.

Do you manage several sites?

For agencies, hosting companies or businesses with multiple WordPress sites, I offer the same capability as a security audit at scale: a systematic sweep that detects cloaking, malware already installed and known vulnerabilities, with a report per site and clear priorities. It’s the capability behind wp-seguro, the scanner from my research on Chilean websites. Proactive detection, before Google flags the site or its SEO degrades.

Chilean sites measured

25,399

compromised sites detected

18

Those 18 were verified by hand, one by one, and along the way two coordinated campaigns turned up, one of cloaking and one of command and control. The affected sites were notified. The details of the method are on the case page.

A hacked WordPress site I recovered

The rescue is in the portfolio: the Comercial Moya site was hacked in 2022. It was cleaned up, what happened was documented in a report that the client herself highlighted for its clarity, and the platform was hardened. The relationship didn’t end there: that same site runs today, redesigned, within a relationship that goes back to 2018.