Hacked WordPress site: clean it in place, or rebuild it?

When a WordPress site gets hacked, the first decision is whether to clean the files you have or rebuild the site on fresh ones. Most owners lean towards cleaning, because a rebuild sounds like starting over. It isn't, and that worry is usually what makes the cleanup slower and less certain than it needs to be.

What a rebuild actually replaces

A WordPress site is two separate things: the files (WordPress itself, the plugins and the theme) and the database (your pages, posts, products, users and settings). A rebuild replaces the files. The database stays where it is. Nothing you wrote or sold goes anywhere.

Why replace the files at all

Malware rarely sits in one obvious place. It hides in a core file that looks normal, in a plugin folder nobody opens, or in an image folder that should never hold code. Cleaning in place means finding every one of those, and you can't prove you have. Fresh copies of WordPress, the plugins and the theme from their official sources remove that doubt in one step.

The database still gets checked

Keeping the database doesn't mean trusting it. Before the site goes back up, check:

• the admin users, for any account nobody recognises
• the site and home addresses, which some infections change to redirect visitors
• the scheduled tasks, where reinfection is often set up
• posts, pages and widgets, for scripts added to the content

The uploads folder is kept too, after removing any PHP files from it. Images and documents don't need code next to them.

Where a rebuild needs care

A premium or custom theme can't be downloaded fresh from WordPress.org. Get a clean copy from the vendor, or compare it against the original line by line. The same goes for any custom code someone added to the theme over the years.

More than one site on the account

If the hosting account holds other WordPress sites, even old ones nobody visits, treat the account as one infection. They usually run as the same user, so an infected unused site can reinfect the live one a week after the cleanup. Scan all of them. Remove the ones you don't need, after a backup, and clean the ones you keep the same way as the main site.

After the site is back

• Change every password on the account: hosting panel, FTP, database user and WordPress admins.
• Reset the security keys, so every old login session ends.
• Update WordPress, the plugins and the theme, and delete anything inactive.
• Fix the file permissions and turn off file editing from the dashboard.
• Add a firewall and login limits, and set up backups stored off the server.

One thing to do first

Before changing anything, take a full backup of the files and the database as they are, infected or not. If the cleanup goes wrong you can go back, and it holds the evidence of how the attacker got in, which is the part that stops it happening again.

Originally published at zeeshanelahi.com on November 5, 2026.