Is your WordPress site hacked? How to check and clean up

Signs to look for

• Redirects to spam or scam sites, often only for mobile visitors or visitors from Google.
• A fake CAPTCHA asking visitors to press keys or paste a command.
• Admin users you didn’t create, or plugins you didn’t install.
• Spam pages in a site:yourdomain.com search.
• Warnings in Search Console or Safe Browsing.

1. Back up first

Download the files and the database before changing anything. You may need the evidence, and a safe copy.

2. Check users and core files with WP-CLI

wp user list --role=administrator
wp core verify-checksums
wp plugin verify-checksums --all

verify-checksums compares your files to the official ones from WordPress.org. Premium plugins aren’t on WordPress.org and can’t be verified this way, so reinstall them from the vendor.

3. Look for PHP where it shouldn’t be

find wp-content/uploads -type f -name "*.php"
find . -type f -name "*.php" -mtime -7

4. Clean and close the door

• Reinstall WordPress core and every plugin and theme from clean copies. Delete the ones you don’t use.
• Remove unknown admins. Change all passwords: hosting, SFTP, database, every admin.
• Replace the security keys in wp-config.php with fresh ones from the WordPress.org salt generator. This logs everyone out.
• Turn on automatic updates and two-factor authentication for admins.

5. Ask Google to review

In Search Console → Security issues, mark the issues as fixed and request a review.

Then harden the site with the WordPress hardening checklist.