How To Completely Clean Your Hacked WordPress Installation

Posted on June 24th, 2008 at 10:11 am by Michael VanDeMar under blogthropology, coding, how-to, On The Ball-ness, SEO, web design
Update 08/13/2015 – Please note: The following Do It Yourself guide on how to de-hack your website is designed for people who don’t necessarily know how to read php, but do know how to work their way through installing WordPress, themes, and plugins. It also assumes you know your way around whichever hosting control panel it is that comes with your host. Because malicious code can be very hard to weed out from the legitimate stuff, especially for someone who is not a programmer, this guide recommends that you start over with a completely fresh theme on your site. This means that for many, the customizations that were done to the theme will be lost, or will need to be re-done. For those of you who would prefer not to do that, or who have a complicated or ecommerce site, or one with heavy traffic and you would like to completely minimize the downtime, I do offer professional cleaning services. I can de-hack and secure your site without losing any of the design or functionality, and in most cases there is only a few minutes of downtime near the end of the process. For more information, please fill out my contact form.

WordPress hacker removal spray... use in a well ventilated area. Getting hacked sucks, plain and simple. It can affect your rankings, cause your readership to be exposed to virus and trojan attacks, make you an unwilling promoter to subject material you may not actually endorse, and in many cases cause the loss of valuable content. However, once it happens it is usually best to not procrastinate on the clean up process, since a speedy restore will most times minimize the damage that was caused.

While almost all sources will recommend that you upgrade your WordPress to the latest version, what the majority neglect to tell you is that in most cases simply doing so will not prevent the attackers from getting back in, even if there are no known exploits with the latest version. The hackers may have left a back door file hidden in a directory where it wouldn’t get overwritten with an upgrade, or inserted code into your theme, or simply created an account that they then granted admin privileges to. Any one of those would allow them back in, even after you patched what was wrong the first time. Therefore I am providing this step by step process on how to completely clean out and restore a WordPress installation that has been hacked.

1. Backup the site and the database.

Even a hacked copy of your blog still probably contains valuable information and files. You don’t want to lose this data if something goes wrong with the cleanup process. Worst case scenario you can just restore things back to their hacked state and start over.

2. Make a copy of any uploaded files, such as images, that are referenced.

Images are generally exempt from posing a security risk, and ones that you uploaded yourself (as opposed to ones included with a theme, for instance) will be harder to track down and replace after things are fixed again. Therefore it is usually a good idea to grab a copy of all the images in your upload folder so as to avoid broken images in posts later. If you have any non-image files that could potentially have been compromised, such as zip files, plugins, or php scripts that you were offering people, then it is a good idea to grab fresh copies of those from the original source.

3. Download a fresh version of WP, all of the plugins you need, and a clean template.

Using the WordPress automatic upgrade plugin does make it easier to upgrade every time a new version comes out. However, it only replaces WordPress specific files, and does not delete obsolete ones. It also leaves your current themes and plugins in place, as is. This means that if used to upgrade a blog that has already been compromised, it can very well leave the attackers a way back in. It is best to start over from scratch as far as the files portion of your installation goes. Note that if you use the EasyWP WordPress Installer script that I wrote it saves you from having to download, unzip, and then upload all of the core WordPress files, although you will still need to grab fresh copies of the themes and plugins that you want to use.

4. Delete all of the files and folders in the WP directory, either through FTP (slower) or through cPanel’s File Manager (faster).

Now that you have fresh copies of all the files you need, and copied all of your uploaded images, completely delete the entire directory structure your blog is in. This is the only surefire way to completely remove all possibly infected files. You can do this through FTP, but due to the way that FTP handles folder deletion (ie. it walks the directory structure, stores each and every file name that needs to be deleted, and then sends a delete command for each one), this can be slow and in some instances cause you to get disconnected due to flooding the server with FTP commands. If available it is much faster to do this through either cPanel’s File Manager, or via command line if you happen to have shell access.

5. Re-upload the new fresh copies you just grabbed.

This step should be self explanatory, but I would like to mention that if your FTP client supports it (I use FileZilla, which does) and your host allows it, then increasing the number of simultaneous connections you use to upload can greatly reduce your overall transfer time, especially on servers or ISP’s where latency is more of an issue than bandwidth. In FileZilla this setting is found by going to “Edit -> Settings -> File transfer settings”:

FileZilla settings panel

Also, if not using the EasyWP WordPress Installer script, don’t forget to edit and rename your wp-config.php file (when freshly unzipped this is named wp-config-sample.php).

6. Run the database upgrade (point your browser at /wp-admin/upgrade.php).

This will make any necessary changes to your database structure to support the newest version of WordPress.

7. Immediately change your admin password.

If you have more than one admin (meaning any user with editing capabilities), and cannot get the others to change their passwords right then, I would change their user levels until they can change their passwords as well. If there is anyone in your user list that has editing capabilities, and you do not recognize them, it’s probably best to just delete them altogether. If changing passwords is something you hate doing, then maybe my new memorable password generator can make that a little less stressful for you. 😀

8. Go through the posts and repair any damage in the posts themselves.

Delete any links or iframes that were inserted, and restore any lost content. Google and Yahoo’s caches are often a good source of what used to be there if anything got overwritten. The following query run against the database can help you isolate which posts you want to look at:

SELECT * FROM wp_posts WHERE post_content LIKE '%<iframe%'
UNION
SELECT * FROM wp_posts WHERE post_content LIKE '%<noscript%'
UNION
SELECT * FROM wp_posts WHERE post_content LIKE '%display:%'

If you did not change the default prefix for WordPress tables, than you can copy and paste that directly into a query window and run it, and it should pull up any posts that have been modified to hide content using any of the methods I have come across so far (iframes, noscript tags, and display:none style attributes). To get to a query window in cPanel, you would click on the MySQL® Databases icon, scroll to the bottom of the page, and then click on phpMyAdmin. Once the new window or tab opens, you would click on the database in the left hand side that your blog was in, and then in the right side at the top click on the SQL tab. Then just paste the query into the large text area and hit the Go button.

Note, however, that there may be other types of injected content that I haven’t seen yet, and that a manual inspection looking for the types of patterns that first alerted you to the fact that your blog was hacked is always a good idea.

UPDATE: 9. (still valid in 2015) If you are having issues cleaning the installation yourself

When I wrote this post back in 2008 I intended it to be a do it yourself guide for the non-techie. However, I do realize that some people would still rather a professional programmer perform many of the steps I outlined here. If anyone has had their WordPress installation hacked, and either is uncomfortable attempting to clean it on their own, or has tried to do so with no success, I am available on a case by case basis. Most cleanings can be performed in about one hour, two at the most. The time can vary depending on the size of the blog, the amount of customization to the original theme, and the number of plugins installed. Feel free to contact me here if you feel like you could benefit from my help. Please include the site and any details that you think might be relevant (pro theme, anything you may have tried on your own, etc.) in the contact form.

UPDATE #2: 10. A note on hosting.

This past year (2010) has seen multiple waves of attacks on people’s websites that happened not due to insecurities within the WordPress platform itself, as has historically been the issue, but rather due to vulnerabilities with the actual hosts. Some of the bigger names that were hit include GoDaddy, Rackspace Cloud, MediaTemple, and Network Solutions, for instance. It is very important that you use a host that is not only well versed in security, but one that is stable and has knowledgeable tech support as well.

Update #3 11/14/2012:

Please note: if you are currently hosting with either HostPapa or Netregistry and you are here because you were hacked then the following tutorial may not be sufficient. Please see this post for more details:Hosting with HostPapa or Netregistry and Hacked? Switch Hosts Now. (hacked by hacker)

My personal recommendation for shared hosting is Hostgator. It is where this blog and many other sites of mine are currently hosted. Yes, that is an aff. link, but I would recommend them even if it wasn’t. For a dedicated solution that is both affordable and robust I use The Planet, which is where I host Bad Neighborhood. Both companies are ones that I have been using for years without issues, and that I do recommend to my own clients when they find themselves dissatisfied with their current hosts. If you were hacked, and your WordPress was up to date when it happened, then a change of hosts is something you should consider looking into.

Enjoyed what you read here? Subscribe to my feed.

  You should follow me on Twitter!

Be Sociable, Share!

270 Responses to “How To Completely Clean Your Hacked WordPress Installation”

  1. Removing the Hack: Not How But Who | Pharma Hack Says:

    […] how to remove the Pharma Hack from your site I highly recommend you read Michael VanDeMar’s: How To Completely Clean Your Hacked WordPress Installation. In my opinion Michael is the best when it comes to removing hacks from sites. If you can afford […]

  2. Recommended Hack Removal | DLS Consulting Says:

    […] Michael VanDeMar – WordPress […]

  3. Troubleshoot your WordPress Blog » Up Past Midnight Says:

    […] smackdown.blogsblogsblogs.com/2008/06/24/how-to-completely-clean-your-hacked-wordpress-installation […]

  4. Hacked! Again!! | The Stupid Box Says:

    […] http://smackdown.blogsblogsblo.....#038;#8230; […]

  5. Kuldeep Says:

    Thanks for your detailed tutorial. It really helped me a lot 🙂

  6. Quick Tip: WordPress Site Hacked? Follow These Links | JKL WordPress Says:

    […] http://wordpress.org/support/t.....st-1065779 http://smackdown.blogsblogsblo.....#038;#8230; http://ottopress.com/2009/hack.....backdoors/ Additional Resources: Hardening WordPress […]

  7. Thankful Thursday: Hacked « Bekahcubed Says:

    […] to do it – and make it plain so hobbyists like myself can fix their sites with relative ease. This post from Smackdown came in handy as I worked on closing any backdoors the hacker might have […]

  8. Mr.MakingUsmile Says:

    Wow! I’m glad I found your site. Great information. I have experienced being hacked. No fun! Backups were in place. I will be checking your site out on a regular basis.

  9. Soren Says:

    Thanks for your attention to removing malware from my sites. I am completely satisfied with your service, and I feel the cost is well worth it.

  10. Zack Says:

    Pretty good, does this method still work today?

  11. Adrean Says:

    The themes files keep on hacked and can making them readonly will solve the problem?

  12. Michael VanDeMar Says:

    @Adrean – no, that won’t actually fix the issue. Hacks are rarely constrained to a single folder so even if changing the permissions stops the theme files from getting modified it doesn’t stop the hack.

  13. Michael VanDeMar Says:

    @Zack – yes, it does.

  14. Tanya Says:

    I recently had my domain hosted on iPage and was using WordPress for my blog. A few weeks ago my hosting plan ended with iPage and so I did not renew, instead I used my custom domain for my blogger blog and tossed the wordpress version altogether. My domain was parked at ipage in between this process until I moved it too to Google Domains. In between moving it from iPage to Google Domains I received an email from Google saying that my site was hacked. I checked my keywords in the Google search console and all kinds of nasty porn words I dont use came up. All the page references give 404 page now.

    I am sure this hacking happened before I moved to google top host my domain and am no longer using wordpress but blogger instead. Is my blog safe now even though google is still showing it come up on a search (all the porn-tails to my domain) even thought the pages hacked come up as not being there and actually refer back to my home page?

  15. Debra Says:

    Forgive me if I’m wrong but my sites were all hacked recently and I don’t see how following this advice will help as nowhere does it address HOW it happened. I was hacked running my sites with the latest versions of wordpress, plugins and themes. If I clean it all up and reinstall from scratch I haven’t changed anything so what’s to stop them all being hacked again two days later? Changing the admin password seems redundant as I had multiple sites hacked that had different admin logins?

  16. Michael VanDeMar Says:

    Debra, unfortunately without knowing the specifics it’s impossible to say how you were hacked. I can tell you some points that might help though:

    1) You said you had multiple sites that were all hit. If they were all on the same shared hosting account then it only takes 1 site to have a vulnerability for them all to get hacked.

    2) If you get a virus on your local machine, that can steal your ftp password and infect your sites.

    3) Just because you had the latest plugins when you noticed the symptoms doesn’t mean you were running them when you got hit. It can take weeks or months for a exploit to be visible, so it’s possible to get infected, update a week later, then start to see the effects of the hack.

    4) Even if you are running all of the latest plugins and themes it’s still possible to get hit, if a) a zero day vulnerability is discovered, or b) you are using a plugin or theme that is no longer maintained, and a known vulnerability never gets patched.

    5) There is also always the chance that it is a hosting issue, and while this is rare it does happen (see here and here, for instance).

    If you need help analyzing what happened I am available, just hit me up via my contact form. I hope this helps.

  17. Debra Says:

    Wow, I sounded GRUMPY when I wrote that, thanks for replying! It turns out that even though the site I was working on was up to date I was running multiple WP installs across multiple domains and two sites I hadn’t worked on for ages had terribly outdated versions of the core files, plugins and themes. I’m guessing one of those let something in. I’ve now cleaned everything up following your instructions, changed all passwords and installed the Wordfence plugin (which is capable of detecting the malicious changes I had). Thanks for your patience 🙂

  18. Ashley Says:

    What if I cannot log in/get into my wordpress back-end? It won’t let me in…I keep getting a weird error message. I use my site so little lately, that I really don’t want to pay 70 or 100/month or whatever the going rates are.

  19. Michael VanDeMar Says:

    @Ashley – it definitely looks like you are hacked. Cleaning the hack would fix the weirdness at the login screen, and you don’t need the WordPress back end to clean it, you need the hosting login info.

  20. Hannah Says:

    2 of my sites have been hit with pop-up type of malware or similar which comes up when you click on something on my sites. It started happening on the first one and refereed it to our IT dept as its hosted at my work but they have not been able to resolve it. My second one was a new domain and hosted with another one of my domains with A2 hosting and 3 days after launch it was hit with the same problem. My 3rd so far has not been, but I haven’t touched that one since. Ive gone through spam and malware checks on WP, cleared and checked all my browsers. It happens no matter where I am loading, Chrome, Firefox IE and iOS on my mobile. I haven’t found a resolution to this. I am hesitant to try the above as I am afraid I will break something, do you have any advice?

Leave a Reply