A compromised WordPress site is an emergency, but it's not a race. Deleting a suspicious file or reinstalling WordPress in a panic can destroy the evidence you need to find the actual entry point. I'd rather move carefully for an hour than clean the same site twice.
1. Take a snapshot before you touch anything
Get a full copy of the files and the database. If the host has daily backups, take a new one now. If you have SSH and WP-CLI, export the database and archive the site:
wp db export before-cleanup.sql
tar -czf files-before-cleanup.tar.gz wp-contentKeep the snapshot somewhere outside the hosting account. You may need it to compare files, recover content, or prove what happened. It also gives you a rollback point if the cleanup goes wrong.
2. Find out how they got in
A clean site is not the same as a secure site. Before removing anything, check the access logs, the list of WordPress users, recent plugin and theme changes, and any unfamiliar scheduled tasks or admin accounts. Common entry points are outdated plugins, weak or reused passwords, stolen FTP/SFTP credentials, and nulled themes.
If the host has a WAF or access logs, ask for the relevant window. The entry point usually leaves a trace, even if it's just a request to a vulnerable file.
3. Stabilize access
Reset passwords for WordPress administrators, hosting, FTP/SFTP, the database, and any services connected to the site. Rotate the WordPress salts in wp-config.php. Remove unknown admin users and check for backdoors in mu-plugins and theme files. If the host has isolated the account, coordinate with them before making changes.
Don't skip the accounts that feel unrelated. Email, DNS, and deployment accounts can all be used to get back in.
4. Clean files and data
Compare WordPress core against a fresh copy and reinstall anything that doesn't match (wp core verify-checksums is a useful start). Remove plugins and themes that aren't in use. Scan uploads for executable files. Search the database for injected scripts, unexpected options, and modified post content. One scanner is not enough; check the files and the database separately.
If the site has been compromised more than once, or the codebase is old and heavily customized, a clean rebuild is often faster and safer than an endless cleanup. Move the content carefully and scan it on the way.
5. Harden the boring parts
Updates, least-privilege accounts, two-factor authentication for administrators, working backups, file permissions, and monitoring. None of this is exciting, but it's what makes the next attempt fail.
A hacked site is usually a symptom of something that was left alone for too long. The cleanup is the visible part. The maintenance is the real fix.
If you're dealing with a compromised site and need a second pair of eyes, email me. I can't promise a magic fix, but I can tell you what I'd check first.