{"id":39987,"date":"2026-07-31T22:52:24","date_gmt":"2026-07-31T15:52:24","guid":{"rendered":"https:\/\/dps.media\/xu-ly-wordpress-bi-hack\/"},"modified":"2026-07-31T22:52:24","modified_gmt":"2026-07-31T15:52:24","slug":"handle-hacked-wordpress-2","status":"publish","type":"post","link":"https:\/\/dps.media\/en\/handle-hacked-wordpress-2\/","title":{"rendered":"Dealing with a Hacked WordPress: A 10-Step Process to Remove Malware and Secure It at the Root"},"content":{"rendered":"

One fine day, you visit your website and discover that the interface has been altered, or worse, customers report being redirected to strange gambling websites. When you access the admin dashboard, you notice a few unfamiliar admin accounts that you are certain you never created. Clearly, your website has been infected with malware. At this point, quickly finding a way handle wordpress hacked<\/a><\/strong> is crucial for protecting customer data, maintaining brand reputation, and avoiding being placed on Google's dangerous site warning list.<\/p>

In reality at DPS.MEDIA, we handle many website emergency cases in similar conditions. Most recently, it was the system of An Tam Pharmacy<\/strong>, organic traffic dropped severely by 45% within just a few days. After taking over, the technical team at DPS.MEDIA reviewed the site and discovered 2 fake plugins with the function of creating hidden admin accounts along with 1 fake Google Tag Manager mu-plugin used to inject malicious redirect code. With an optimized remediation process, we cleaned up the malware and restored the website to stable operation in exactly 2 working hours.<\/p>

To help administrators self-troubleshoot or review technicians' work, DPS.MEDIA would like to share the standard 10-step process for handling a hacked WordPress website below.<\/p>

Complete 10-step process for handling a hacked WordPress site<\/h2>

This process requires you to have basic knowledge of server administration (VPS\/Server) and using the command line (CLI). Please follow the steps in order to avoid missing any malware.<\/p>

Step 1: Install and configure Wordfence CLI<\/h3>

Wordfence CLI is a professional open-source malware scanning tool that runs from the command line, helping you scan millions of files much faster than a typical plugin. First, configure its free license on the server:<\/p>

wordfence configure<\/code><\/pre>
Step 2: Scan to detect files containing malware<\/h3>
Run a quick scan command to compare against the database of known malware signatures. The scan results will be exported to a CSV file so you can easily monitor them:<\/p>
wordfence malware-scan --output-format=csv \\\n  --output-path=\/home\/DOMAIN\/public_html\/wordfence-scan-\\\\$(date +%Y%m%d-%H%M%S).csv \\\n  \/home\/DOMAIN\/public_html\/<\/code><\/pre>
If you suspect malware has spread to static files (such as images or the theme's custom JavaScript files), run a deep scan of the entire site:<\/p>
wordfence malware-scan --include-all-files \\\n  --output-path=\/home\/DOMAIN\/public_html\/wordfence-scan-full-\\\\$(date +%Y%m%d-%H%M%S).log \\\n  \/home\/DOMAIN\/public_html\/<\/code><\/pre>
Step 3: Put the website into maintenance mode<\/h3>
To prevent hackers from continuing to interfere or steal customer information during the cleanup process, you need to enable maintenance mode using WP-CLI:<\/p>
wp maintenance-mode activate --allow-root --path=\/home\/DOMAIN\/public_html<\/code><\/pre>
Step 4: Review the list of Admin accounts<\/h3>
List all accounts with the highest privileges on the website:<\/p>
wp user list --role=administrator --allow-root --path=\/home\/DOMAIN\/public_html<\/code><\/pre>
Pay attention to accounts with unusual emails or registration dates that coincide with the time the website began showing signs of interference. You should record the IDs of these fake accounts but do not delete them yet<\/strong>, we will remove them in the next step after cleaning the backdoor files.<\/p>
Step 5: Remove malicious files and fake accounts<\/h3>
Based on the scan results from Step 2, locate and delete the malicious files. They are often disguised as:<\/p>