A hacked WordPress site is an operations problem, not a reason to panic-buy ten security plugins. I have done malware removal and admin-access recovery for client installs, including work recorded in the portfolio as a two-day recovery for Sky Bridge IT Consulting.
What I do first
- Take a backup of the broken state so we can prove what changed.
- Put the site in a maintenance or firewall holding pattern if it is still serving spam.
- Reset passwords, review users, and rotate keys. Hijacked admin accounts are common.
- Compare core, theme, and plugin files against clean copies. Malware often hides in
wp-contentand in old unused themes. - Clean the database for spam users, injected options, and rogue cron jobs.
- Patch the hole: outdated plugin, nulled theme, weak password, or an open file editor.
What I will not do
I will not install a pirated “security theme”, and I will not promise that a cleaned site can never be hit again if passwords and hosting stay weak. Hardening is part of the job: updates, limited plugins, 2FA for admin, and off-site backups.
For companies hiring a developer
Ask any WordPress candidate how they would recover admin access if every email is bouncing. If the answer is only “install Wordfence”, keep interviewing. Recovery is file-level work plus hosting (cPanel, DNS, SSL, mail) — skills I use in full-time roles as well as freelance rescue jobs.