How to Secure a WordPress Account After Being Hacked in 2026
If your WordPress site has been compromised, speed matters: the longer an attacker has access, the more damage they can do to content, SEO, user data, and site reputation.
This guide explains how to secure WordPress account after being hacked with a practical recovery sequence and the hardening steps that help prevent a repeat incident.
The process is not just about changing one password.
You need to remove the attacker’s access, verify the integrity of files and users, scan for malware, and close the security gaps that allowed the breach in the first place.
First response: contain the incident
Before you start repairing anything, stop additional damage and preserve evidence.
If the site is actively redirecting users, sending spam, or injecting malicious scripts, put it into maintenance mode or temporarily restrict public access while you investigate.
- Change hosting control panel passwords immediately.
- Change the WordPress admin password and any other administrator passwords.
- Change FTP, SFTP, SSH, database, and email passwords tied to the site.
- Enable two-factor authentication on accounts that support it.
- Notify your hosting provider if you suspect server-side compromise.
If you have a security plugin such as Wordfence, Sucuri, or Solid Security, use it to block suspicious IPs and alert on new login attempts while you work.
Verify the breach and identify the entry point
A secure recovery plan depends on understanding how the intrusion happened.
Common attack paths include weak passwords, stolen credentials, outdated plugins, vulnerable themes, and compromised third-party integrations.
Check for suspicious admin activity
Review the list of users in WordPress and look for unfamiliar accounts, especially those with administrator or editor privileges.
Check recent login logs, password resets, and profile changes if you have audit logging enabled.
Inspect plugins, themes, and core files
Review recently installed or updated plugins and themes.
Attackers often exploit outdated components or hide malicious code inside files such as functions.php, wp-config.php, or custom plugin folders.
Review hosting and server logs
Access logs can show unusual requests, brute-force attempts, or exploitation of a vulnerable endpoint.
Error logs may also reveal unexpected PHP execution or file write activity.
Reset every credential tied to the site
Changing only the WordPress password is not enough if the attacker also has access to hosting or email.
A full credential reset reduces the chance of reinfection and shuts down stolen sessions.
- Reset all WordPress user passwords, starting with administrators.
- Force logout of all users and invalidate existing sessions.
- Regenerate WordPress salts in wp-config.php.
- Rotate hosting, cPanel, Plesk, FTP, SFTP, SSH, and database credentials.
- Update email passwords for addresses used for recovery or admin alerts.
Use unique, long passwords stored in a password manager such as 1Password, Bitwarden, or LastPass.
Avoid reusing credentials across hosting, email, and admin accounts.
Remove unauthorized users, files, and code
Once access is contained, clean up the compromise.
Do not assume that deleting one malicious file is enough; attackers frequently plant multiple backdoors for persistence.
Audit WordPress users
Delete any user accounts you do not recognize.
If an attacker created a legitimate-looking admin account, revoke it rather than simply lowering its role.
Also check for suspicious changes to existing user roles.
Scan for malware and web shells
Use a trusted malware scanner at the file and database level.
Look for obfuscated PHP, base64-encoded payloads, suspicious cron jobs, modified .htaccess rules, and injected JavaScript in posts or widgets.
Compare files with clean versions
Replace WordPress core files with fresh copies from the official WordPress.org release.
Reinstall plugins and themes from reputable sources rather than editing compromised files in place.
If a custom theme or plugin was modified, compare it against a known-good backup or version control history.
Restore from a clean backup when needed
If the compromise is widespread, restoring from a clean backup may be faster and safer than manual cleanup.
The backup must predate the intrusion and must not already contain malware or backdoors.
Before restoring, confirm that the backup includes:
- Clean WordPress core files
- Clean plugin and theme files
- A database snapshot without injected users or malicious content
- Fresh wp-config.php and secrets
After restoration, immediately update WordPress core, plugins, and themes to current versions before reopening the site to visitors.
Harden WordPress after recovery
Hardening reduces the probability of another compromise and limits what an attacker can do if they gain partial access later.
Focus on layered controls rather than a single security tool.
Strengthen authentication
- Require two-factor authentication for all administrator accounts.
- Disable or limit password reset abuse by monitoring recovery emails.
- Remove stale accounts that no longer need access.
- Restrict administrator privileges to only trusted users.
Reduce the attack surface
- Delete inactive plugins and themes instead of leaving them installed.
- Keep WordPress core, plugins, and themes updated promptly.
- Use reputable plugins with active maintenance and a strong security track record.
- Disable file editing from the WordPress dashboard by setting define(‘DISALLOW_FILE_EDIT’, true); in wp-config.php.
Protect the server and files
- Set correct file permissions so PHP cannot write where it should not.
- Use SFTP or SSH instead of plain FTP.
- Move wp-config.php if your hosting environment allows it.
- Limit access to sensitive directories with server rules where appropriate.
Check SEO, email, and reputation damage
WordPress hacks often go beyond access theft.
Attackers may add spam pages, inject cloaked redirects, or create spammy outbound links that harm search visibility and user trust.
Inspect the site for:
- Unexpected pages, posts, or categories
- Spammy links hidden in content or widgets
- Injected meta tags, scripts, or redirect rules
- Blacklisting warnings in Google Search Console or other security services
If your site was used to send spam email, notify your email provider and review SMTP configurations, contact forms, and transactional email plugins.
If indexed malicious URLs exist, request removal or recrawl through Google Search Console after cleanup.
Monitor the site closely after cleanup
Post-incident monitoring helps you catch lingering backdoors or new intrusion attempts before they escalate.
Keep an eye on logs, file changes, user creation events, and unusual resource usage for at least several weeks.
- Review security alerts daily at first.
- Set file integrity monitoring for core directories.
- Watch for new administrator accounts or role changes.
- Track outbound traffic and unexpected scheduled tasks.
If your hosting plan supports it, enable server-level malware scanning and automatic backup snapshots.
Pair this with uptime monitoring so you know quickly if the site is defaced, redirected, or taken offline again.
When to bring in a WordPress security professional
Some incidents are too large or time-sensitive for a solo cleanup.
Hire a specialist if you find repeated reinfection, encrypted or missing files, stolen customer data, or signs that the attacker reached the hosting account, database, or server OS.
Professional responders can help with forensic analysis, malware removal, incident documentation, and safe restoration.
They can also recommend long-term controls tailored to your hosting stack, whether you use shared hosting, managed WordPress hosting, or a VPS with custom server rules.
Practical recovery checklist
- Contain the site and change all related passwords.
- Review users, logs, plugins, themes, and core files.
- Remove malicious accounts, files, and code.
- Restore from a verified clean backup if needed.
- Update everything and rotate secrets.
- Enable two-factor authentication and security monitoring.
- Harden file permissions and remove unused software.
- Check search visibility, spam, and email abuse.
Following a structured response makes it much easier to secure WordPress account after being hacked without missing hidden persistence mechanisms or leaving your site exposed to another intrusion.