Clean up a hacked WordPress or PHP site
What to do when we find malware in your site or pause it: the files we locked away, new passwords, updates, a backup from before, and a second look.
Updated 18 Oct 20263 min read
We check every WordPress and PHP site's files for malware once a day. When we find an infected file, we lock it away where it can't run, your site keeps running, and we tell you by email and in the bell. This guide follows Asha, whose site blog in project duka had two infected files one morning.
The infected files are out of your site, in a locked place only we can reach. Nothing in them can run. They stay there for 30 days, so you can put back one that turns out to be yours, then they're deleted.
Step 1: see what was found
Open the site, then its Security card. Each infected file shows its path, what kind of malware it looks like and when it was found. Asha's said:
| File | What it looks like |
|---|---|
wp-content/uploads/2026/10/cache.php | Runs code a visitor sends |
wp-content/plugins/old-slider/inc/x.php | A known backdoor |
A .php file in wp-content/uploads is almost never yours: WordPress puts pictures and documents there, not programs.
Step 2: change the passwords
Whoever put the files there may have a password. Change, in this order:
Your Tanzahost password, and add a passkey or an authenticator app (see login security).
Every WordPress administrator's password, from Users in WordPress's admin page. Delete any administrator you don't know.
The passwords of anything else that can write to the site's files, such as a plugin that uploads files for visitors.
Step 3: update everything, and remove what you don't use
Most break-ins come through an old plugin or theme. In WordPress's admin page:
Update WordPress itself, then every plugin and every theme.
Delete the plugins and themes you don't use. A plugin that's switched off can still be attacked while its files are there.
If the Plugins list on the Security card shows one with a known weakness and no fix yet, switch it off until there is one.
Step 4: look at what changed
The site's Changes card lists the files edited, uploaded or replaced recently, with who did it. Look for files changed on days nobody worked on the site, especially in wp-content/plugins, wp-content/themes and wp-content/uploads, and open them in the file manager.
If you can't tell what was changed, go back to a backup from before the break-in: the site's Backups page keeps one a day. Restoring makes a backup of how the site is now first, so nothing is lost.
Step 5: put back or delete the files
On the Security card, for each file:
Delete it when it isn't yours. The site keeps running without it.
Put back only a file you're sure is yours, such as a plugin's file that looked suspicious. The daily check won't stop that same file again.
Then press Scan now to check the site again. You can run it 3 times an hour.
When your site was paused
We pause a site only when it harms others: it attacks other sites, it's on a safety list that browsers use to warn visitors, or it mines cryptocurrency. The site's page says why, and nothing is deleted.
Clean it up with the steps above.
Press Review my app on the site's page and tell us what you did. When the page says the site is suspended, the button is Tell us what you fixed. A person on our team looks and answers you there and by email.
If browsers warn visitors about your domain, ask Google to look again from Google Search Console once the site is clean. It usually takes a day or two.
Keep it from happening again
Keep WordPress, plugins and themes updated: switch on automatic updates for plugins you trust.
Install plugins only from wordpress.org or their makers' own sites, never a "free" copy of a paid plugin.
Give each person their own WordPress login, with the least role they need.