When a WordPress site is compromised — especially through a plugin backdoor or uploaded web shell — simply removing the malicious file is rarely enough. Attackers often plant multiple backdoors, create hidden admin accounts, and exploit other vulnerabilities to regain access.
This guide walks you through the full recovery and hardening process so your site is clean, secured, and significantly more resilient against future attacks.
Important: Partial fixes lead to re-infection. This pattern (repeat compromise via plugin backdoor / web shell) is one of the most common support ticket types. Following all steps in this guide — not just the immediate cleanup — is the best way to prevent re-infection within days or weeks.
Even a compromised site should be backed up before you make any changes. This preserves evidence and gives you a restore point if something goes wrong during cleanup.
To prevent visitors from reaching a potentially infected site while you work:
Backdoor files are scripts left by attackers that allow them to re-enter your site at any time. Web shells (PHP files with names like wp-config2.php, .ico.php, or files hidden in upload directories) are the most common form.
Look for recently modified or suspicious files:
# Find PHP files modified in the last 7 days
find /path/to/wordpress -name '*.php' -mtime -7
# Find files with common backdoor strings
grep -r 'eval(base64_decode' /path/to/wordpress --include='*.php'
grep -r 'system($_GET' /path/to/wordpress --include='*.php'
grep -r 'passthru' /path/to/wordpress --include='*.php'Any file containing eval(base64_decode, system($_REQUEST, or passthru with user-controlled input should be treated as a backdoor and deleted immediately.
wp-content/uploads/ — PHP files should never exist herewp-content/themes/[theme-name]/ — especially in inactive or old themeswp-content/plugins/ — especially in plugins you do not recognisewp-includes/ — core files should match the official WordPress releaseTip: After removing files, verify WordPress core integrity using Wordfence's core file check, or by downloading a fresh copy of WordPress and comparing it against your installation.
The majority of WordPress compromises originate from outdated or vulnerable plugins. After cleaning up backdoors, ensure everything is up to date before bringing the site back online.
Every plugin you don't actively need is a potential attack surface:
WP File Manager (elFinder) and similar file management plugins have been the source of several major WordPress compromise campaigns. These plugins provide web-based file system access and, if unpatched or misconfigured, can be exploited remotely.
Security Notice: CVE-2020-25213 — a critical vulnerability in WP File Manager (versions < 6.9) allowed unauthenticated attackers to upload and execute arbitrary PHP files. Sites running this plugin were mass-compromised within hours of the vulnerability being published.
Recommendation: Remove WP File Manager entirely. If file management is required, use your hosting provider's built-in file manager (cPanel File Manager) or SFTP with a dedicated client instead.
wp-content/plugins/wp-file-manager/Attackers frequently create hidden or obfuscated administrator accounts to maintain persistent access even after malicious files are removed. This step is critical and often overlooked.
Attackers sometimes insert admin users directly into the database to bypass WP Admin visibility. Check using phpMyAdmin or WP-CLI:
# List all WordPress admin users via WP-CLI
wp user list --role=administrator
# Or query the database directly
SELECT user_login, user_email, user_registered FROM wp_users;
SELECT user_id, meta_value FROM wp_usermeta WHERE meta_key = 'wp_capabilities';Even for legitimate admin accounts, reset all passwords as a precaution — your credentials may have been exfiltrated:
wp-config.php and in your hosting control panelEnabling 2FA is one of the highest-impact security improvements you can make. Even if an attacker obtains a password through a future breach, they cannot log in without the second factor.
If you access WP Admin from a known, fixed IP address, you can block all other IPs from reaching the login page. Add the following to your .htaccess file inside the wp-admin/ directory:
order deny,allow
deny from all
allow from YOUR.IP.ADDRESS.HEREBy default, WordPress allows admins to edit plugin and theme files in the browser — a major risk if an admin account is compromised. Disable this in wp-config.php:
define( 'DISALLOW_FILE_EDIT', true );Moving the login page from /wp-login.php to a custom URL reduces automated brute-force attacks. Use a plugin such as WPS Hide Login to do this without editing core files.
# Directories
find /path/to/wordpress -type d -exec chmod 755 {} \;
# Files
find /path/to/wordpress -type f -exec chmod 644 {} \;
# wp-config.php (most sensitive file)
chmod 600 wp-config.phpBefore taking the site out of maintenance mode, confirm all of the following:
This guide covers the most common self-service recovery scenarios. Please open a support ticket if:
Tip: When opening a ticket, please include your list of active plugins, any error messages, and the results of your Wordfence scan. This significantly speeds up our investigation.