How to Fix a hacked WordPress website

There are different ways to get the current version of your hacked WordPress.

Here is a great article how to find out the current version of WordPress

 

Note: If the database use malware in it, you will need to manually clean the malware via phpMyAdmin

Some Guides: Cleaning a WordPress MySQL database after a malware / hacking attack.

The wp-config. php file is usually located in the root folder of your website with other folders like /wp-content/. Via File Manager download a copy on your computer. You will need this file later.

Some hosts will suspend your website until the malware is removed. Thus making it harder to remove the malware.

A workaround is to make a zip archive of the infected directory thus bypassing the malware scan.

It is also good to have a backup, because you can never have enough backups!

Here is a good example how to cPanel File Manager to compress files & directories

 

As in the previous example create a new folder public_html

The fresh copy should be the same version of the hacked website.

Some examples how to install WordPress

1. Manual installation
2. Install by using Softaculous

Replace the fresh copy of wp-config.php with the hacked version of wp-config.php.

You can upload it from your computer, or you can copy it from the hacked directory in File Manager

You will now be able to log into your WordPress and install a fresh copy of your theme.

The specific folder where the image files are stored in WordPress is called the uploads folder located inside the /wp-content/ folder. Inside the uploads folder, your media files are stored by year and month folders. Additionally, you’ll also see folders created by your WordPress plugins to save other uploads.

Copy the uploads folder from your hacked website to your new fresh installation to transfer the images across.

Note: It is important to look inside the uploads folder for files that should not be there. Such as:

• .php files
• .js files

Do not copy those files or folders across as they may contain remains of the virus.

All WordPress plugins you download and install on your site are stored in /wp-content/plugins/ folder.

Have a look at your hacked website for plugins that were installed in your websites.

Install fresh copies of these plugins from reputable sources.

Note: It is important that you do not copy plugins from your hacked directory.

To prevent your website being hacked again. I would also install ninja firewall plugin and activate full WAF mode.

Your WordPress website is now virus free! 

Check that it all works. You may need to re-activate settings that were disabled by missing plugins.

You can compare the appearance of your website with the Wayback Machine to make sure you are not missing anything