Knowledgebase

WordPress is a powerful open-source platform, but if not properly maintained, it is a common target for hackers. This guide covers everything: detection, cleanup, core file verification, plugin checks, and future prevention.

1. Why WordPress Sites Get Hacked

Common reasons include:

• Outdated WordPress core, themes, or plugins

• Nulled, unofficial, or pirated plugins/themes

• Weak admin, FTP, or database passwords

• Disabled auto-updates

• Malware injected via uploads or modified files

Prevention is always easier than cleanup.

2. Prerequisites

Before attempting a cleanup, ensure:

1. Backups: Make a full backup of the website (files + database).

2. cPanel Access: Ensure you can access File Manager, phpMyAdmin, and WordPress Manager.

3. Passwords: Prepare to reset all admin, FTP, and database passwords.

4. Plugins: Only keep official plugins/themes from WordPress.org or trusted developers.

3. Enable Automatic Updates

Why: Regular updates reduce the chance of hacks.

From WordPress Dashboard

• Dashboard → Updates → Enable auto-updates for WordPress core, plugins, and themes

From cPanel

• Softaculous/WordPress Manager → Enable automatic updates for:

  • Core files

  • Plugins

  • Themes

4. Detect Hacked Files

Step 1: Check Last Modified Files

• cPanel → File Manager → Navigate to WordPress root

• Sort by Last Modified

• Red flags: recently modified files without your knowledge

Step 2: Standard WordPress Architecture Check

Root Folders:

• wp-admin/

• wp-content/

• wp-includes/

Important Files:

• index.php 

<?php
define( 'WP_USE_THEMES', true );
require __DIR__ . '/wp-blog-header.php';

• .htaccess

# BEGIN WordPress
<IfModule mod_rewrite.c>
RewriteEngine On
RewriteBase /
RewriteRule ^index\.php$ - [L]
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule . /index.php [L]
</IfModule>
# END WordPress

• Any deviation, encoded text, or extra PHP code in these files is a malware indicator.

Step 3: Check for Malicious Files

• Look for:

  • base64_decode, eval(), gzinflate

  • Random files like wp-vcd.php, class.wp.php

  • .php files in wp-content/uploads/

5. Verify Plugins & Themes

• Only official plugins from WordPress.org

• Delete unused, nulled, or unverified plugins

• Check recently modified plugin files

6. Reinstall WordPress Core

Why: Ensures no malware in core files.

Steps:

1. Download fresh WordPress from wordpress.org

2. Replace wp-admin/ and wp-includes/ folders

3. Do NOT replace wp-content/ (you’ll lose your themes/plugins)

4. Verify index.php and .htaccess are standard

7. Reset All Passwords

Immediately reset:

• WordPress admin users

• cPanel / FTP accounts

• Database users

8. Scan & Monitor

• Install security plugins:

  • Wordfence

  • Sucuri Security

• Enable real-time file change monitoring

• Schedule regular scans

9. Prevention Best Practices

1. Keep WordPress, themes, and plugins updated

2. Use strong passwords for all accounts

3. Enable auto-updates

4. Remove unused plugins/themes

5. Regular backups via cPanel or plugins

6. Check last modified files periodically

7. Monitor uploads folder for PHP files

10. When to Contact Support

Contact our hosting support if:

• Malware persists after following the steps

• You need ORG enablement or server-level malware scan

• Files are being re-infected repeatedly