Your WordPress Site Keeps Getting Hacked. Here Is Why the Cleanup Didn't Stick

The spam came back

You search for your business and Google shows pages you never wrote. Casino links. Pharmacy ads. Titles in a language nobody on your team speaks. Someone cleaned it up last month. Now it is back.

If your WordPress site keeps getting hacked, the problem is rarely bad luck. The attackers never left. The cleanup removed what you could see and missed the way back in.

We are getting more of these calls than ever. As attackers use AI to find and exploit flaws faster, small business and nonprofit sites are getting hit harder, and the usual cleanup no longer holds. Here is what we have learned from fixing them.

Signs your WordPress site has been hacked

Some signs are loud. Most are quiet. Watch for:

• Pages in Google you did not create. Search site:yourdomain.com and scroll. Spam pages often only show up in search, not on the site itself.
• Admin users you do not recognize. Check Users in the dashboard. Attackers like names that look technical, or a copy of a real staff member's name.
• Files that should not be there. PHP files in the uploads folder, or files with names that look like WordPress files but are not, such as wp-cron-something.php.
• Visitors sent somewhere else. Often only on mobile, or only when they arrive from Google, so you never see it yourself.
• Forms or payments that quietly stop working. A plugin gets switched off, a payment setting changes, and nobody notices for weeks.
• A warning from your host, Google or your browser. By then, the hack has usually been there a while.

Why WordPress cleanups fail

A typical cleanup deletes the infected files, restores a few from a backup, and changes the admin password. It looks done. Two weeks later, the spam is back.

That is because the visible spam is the last step of the attack, not the first. Security firm Sucuri published the main reasons sites get reinfected back in 2011. More than a decade later, they still match what we see:

A backdoor is still there. Before attackers do anything visible, they hide small programs that let them back in. They go in plugin folders, theme files, the uploads folder and even the database. Miss one and the site is theirs again.

The way in is still open. Most hacks start with a plugin flaw. Patchstack counted 11,334 new vulnerabilities in the WordPress ecosystem in 2025, 42% more than the year before, and 91% of them were in plugins. WordPress itself had almost none. If the plugin that let them in is still there and still out of date, they walk back in.

Passwords and accounts were taken. Attackers copy passwords, create extra admin users, and sometimes take over the hosting account itself. Changing one password does not undo that.

The server itself is compromised. On cheap shared hosting, one hacked site can infect its neighbours. Cleaning WordPress does nothing if the server underneath is still theirs.

Assume your keys and customer data were copied

Once attackers can run code on your server, they can read everything WordPress can read. That includes the file holding your database password and every setting stored in the database.

API keys are the part most cleanups miss. Payment plugins, email services, newsletter tools, maps and SMTP plugins all keep keys inside WordPress. A stolen payment key can be used to read transactions or issue refunds. A stolen email or newsletter key lets attackers write to your real list from your real address, which is the most convincing phishing there is. Deleting the malware does not cancel any of these keys. They keep working until you replace them.

Your customer and email lists may be gone too. Orders, form entries, donor and member records, newsletter subscribers. If the attackers reached the database, they could have copied all of it.

What to do:

• Rotate every key, not just passwords. Create new keys in each service, put them in the clean site, then revoke the old ones. That means payments, email, newsletter, SMTP, Google and any connected app. Generate new WordPress security keys too, which signs everyone out.
• Change the database password and any password saved in a plugin's settings.
• Watch the accounts behind those keys. Look for refunds, new webhooks, new users or campaigns you did not send.

What to do in the first 24 hours

Act fast, but in the right order.

1. Take a full backup before you delete anything. Files and database. You need it to understand what happened, and you may need the content later.
2. Change every password. WordPress admins, hosting, database, FTP, email accounts linked to the site, and your domain registrar. Turn on two step login wherever you can. Then rotate your API keys, as described above.
3. Remove users you cannot account for. Write down their names and when they were created first. That date often tells you when the attack started.
4. Check your money. Look at payment, donation and order settings. Make sure payments still go to your account and that forms still work.
5. Open Google Search Console. Check the Security Issues report and look for pages you did not create.

Clean or rebuild?

Cleaning is cheaper when the hack is fresh, small and fully understood. A rebuild costs more upfront and is often cheaper over a year.

Rebuild when:

• The site has been reinfected after a cleanup.
• You do not know how they got in.
• Attackers had admin access or hosting access.
• The site runs plugins or themes you cannot update, or that have been abandoned.
• Your host cannot or will not help.

A rebuild does not mean starting over. You keep your pages, posts, events and images. They are checked one by one and moved to a fresh WordPress install on a clean server. Plugins and themes are installed fresh from trusted sources. Every password and API key is replaced. Nothing executable comes across from the hacked site. That is the part that makes it stick.

Getting Google to drop the spam pages

Fixing the site does not fix your search results. Google can keep showing spam pages under your name for weeks.

• Make the spam addresses return "gone". A proper "410 Gone" response tells Google the page was removed on purpose, which is faster than leaving a generic error.
• Use the Removals tool in Search Console for the worst pages. It hides them for about six months, which buys time for Google to recrawl. It does not delete them from the index by itself.
• Submit a clean sitemap so Google finds your real pages first.
• Request a review if Google flagged the site as hacked.

Expect a few weeks, not a few days. This part runs on Google's schedule.

Keeping it from happening again

The sites that stay clean have three things in common.

Updates happen in hours, not weeks. For the most heavily exploited flaws, Patchstack found the median time from going public to the first attack was five hours. We wrote about how fast this moves in what php2shell taught us about patch speed. If updating your site means waiting for someone to find the time, you are exposed.

Backups live somewhere else. A backup stored on the same server is lost along with that server. Keep copies off the server, and test that you can actually restore one.

Admins log in with two step login. Stolen passwords are one of the most common ways in, and two step login stops most of them cold.

How we approach this

We build custom AI agents and the software around them, and we run that software ourselves. The same habits apply: every update is routine, every backup is tested, and nothing reaches the public internet without a login in front of it.

When a hacked WordPress site comes to us, we use AI on the defence side too. We scan every post, page and database row for hidden code, review each finding by hand, and move only verified content to a clean server. Then we put patching, off-site backups and monitoring on a schedule, so the site stays clean after we are done.

If your WordPress site keeps getting hacked, send us the address. We will take a first look and tell you honestly whether a cleanup will hold or a rebuild is the better fix.

Frequently asked questions

Can I just restore an old backup?

Only if you know the backup is from before the attack, and you close the way in before you go live. Attackers often sit quietly for weeks before doing anything visible, so last month's backup may already include the backdoor.

Will a security plugin fix it?

A security plugin can find known malware and block some attacks. It cannot remove a backdoor it does not recognize, and it cannot fix a compromised server or stolen hosting account.

How long until Google stops showing the spam?

Usually a few weeks after the site is clean and the spam addresses return "gone". The Removals tool can hide the worst pages sooner.

Is my site a target because of who we are?

Almost never. Attacks are automated. Bots scan the whole internet for any site running a vulnerable plugin. Being out of date is the only thing that makes you a target.