{"id":211,"date":"2026-07-13T06:37:19","date_gmt":"2026-07-13T06:37:19","guid":{"rendered":"https:\/\/www.guardiangaze.com\/blog\/?p=211"},"modified":"2026-07-14T06:44:05","modified_gmt":"2026-07-14T06:44:05","slug":"wordpress-hacked","status":"publish","type":"post","link":"https:\/\/www.guardiangaze.com\/blog\/wordpress-hacked\/","title":{"rendered":"WordPress Hacked? How to Fix, Clean and Recover Your Site (2026)"},"content":{"rendered":"\n<p class=\"wp-block-paragraph\">Your WordPress site has been hacked. Here is exactly how to confirm it, clean every infection point, and get your Google rankings back.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>The fastest path:<\/strong><\/p>\n\n\n\n<ol class=\"wp-block-list\">\n<li><strong>Confirm the hack<\/strong> using the checks in section 2. Some hacks are completely invisible when you visit your own site.<\/li>\n\n\n\n<li><strong>Run the 12-step removal protocol<\/strong> in section 4, in order, without skipping steps. One missed component means reinfection within hours.<\/li>\n\n\n\n<li><strong>Close the original entry point<\/strong> before going back online. This is the most common reason hacks return.<\/li>\n\n\n\n<li><strong>Submit a recovery request<\/strong> to Google if your rankings have dropped.<\/li>\n<\/ol>\n\n\n\n<p class=\"wp-block-paragraph\">Most &#8220;cleaned&#8221; WordPress sites get reinfected within 30 days. The reason is always the same: the cleanup removed visible files but left the database loader, the cron job, or the mu-plugins backdoor behind. This guide covers all of them.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Table of Contents<\/h2>\n\n\n\n<ol class=\"wp-block-list\">\n<li>How to tell if your WordPress site has been hacked<\/li>\n\n\n\n<li>The 17 signs of a hacked WordPress site<\/li>\n\n\n\n<li>The most common WordPress hack types in 2026<\/li>\n\n\n\n<li>Complete hack removal protocol (12 steps)<\/li>\n\n\n\n<li>How to recover your Google rankings after a hack<\/li>\n\n\n\n<li>How to stop it happening again<\/li>\n\n\n\n<li>FAQ<\/li>\n<\/ol>\n\n\n\n<p class=\"wp-block-paragraph\">Most site owners find out from someone else. A customer emails. A Google search result looks wrong. The host suspends the account. Organic traffic drops overnight with no obvious cause.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Modern WordPress malware is built specifically to hide from the site owner while staying visible to Google&#8217;s crawler and to visitors arriving from search results. You can visit your own homepage a hundred times and see nothing wrong. Your customers are seeing something very different.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Here are the five fastest checks.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\"><strong>1. How to Tell if Your WordPress Site Has Been Hacked<\/strong><\/h2>\n\n\n\n<h3 class=\"wp-block-heading\">Check 1: Search Google for your site with spam keywords<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">In any browser, type these searches one at a time:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>site:yourdomain.com viagra\n\nsite:yourdomain.com casino\n\nsite:yourdomain.com \"buy cheap\"<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">If any spam result appears, the site is infected. Go straight to section 4.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Check 2: Fetch your site as Googlebot<\/h3>\n\n\n\n<pre class=\"wp-block-code\"><code># Fetch as Googlebot\n\ncurl -A \"Mozilla\/5.0 (compatible; Googlebot\/2.1; +http:\/\/www.google.com\/bot.html)\" \\\n\nhttps:\/\/yourdomain.com\/ | grep -i \"viagra\\|casino\\|redirect\\|location:\"\n\n# Fetch as a normal browser for comparison\n\ncurl -A \"Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7)\" \\\n\nhttps:\/\/yourdomain.com\/ | grep -i \"viagra\\|casino\\|redirect\\|location:\"<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">If the Googlebot version returns content the browser version does not, your site is cloaking malware from you specifically.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Check 3: Check Google Search Console<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Go to Search Console, then Security and Manual Actions, then Security Issues.<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"683\" src=\"https:\/\/www.guardiangaze.com\/blog\/wp-content\/uploads\/2026\/07\/Malware-Detected-1024x683.jpg\" alt=\"\" class=\"wp-image-230\" srcset=\"https:\/\/www.guardiangaze.com\/blog\/wp-content\/uploads\/2026\/07\/Malware-Detected-1024x683.jpg 1024w, https:\/\/www.guardiangaze.com\/blog\/wp-content\/uploads\/2026\/07\/Malware-Detected-300x200.jpg 300w, https:\/\/www.guardiangaze.com\/blog\/wp-content\/uploads\/2026\/07\/Malware-Detected-768x512.jpg 768w, https:\/\/www.guardiangaze.com\/blog\/wp-content\/uploads\/2026\/07\/Malware-Detected.jpg 1536w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">Any entry here, such as &#8220;Hacked: malware&#8221;, &#8220;Social engineering&#8221;, or &#8220;Harmful downloads&#8221;, confirms a hack.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Check 4: Check your server access logs<\/h3>\n\n\n\n<pre class=\"wp-block-code\"><code># Find suspicious POST requests to wp-login.php\ngrep \"POST \/wp-login.php\" \/var\/log\/nginx\/access.log | tail -50\n\n# Find recently modified PHP files\nfind \/var\/www\/yoursite\/ -name \"*.php\" -mtime -14 -not -path \"*\/wp-admin\/*\"<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\">Check 5: Check for PHP files in uploads<\/h3>\n\n\n\n<pre class=\"wp-block-code\"><code>find \/var\/www\/yoursite\/wp-content\/uploads\/ -name \"*.php\"<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">There should be zero PHP files in your uploads folder. Any PHP file there is malware.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\"><strong>2. The 17 Signs of a Hacked WordPress Site<\/strong><\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">You do not need command-line access to spot most hacks. These are the observable symptoms.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>In Google search results:<\/strong><\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Your site appears with spam titles (Viagra, casino, payday loans, fake brands)<\/li>\n\n\n\n<li>Clicking your Google result redirects visitors to a different site<\/li>\n\n\n\n<li>Google shows a &#8220;This site may be hacked&#8221; warning below your listing<\/li>\n\n\n\n<li>Search Console shows a Manual Action or Security Issue<\/li>\n\n\n\n<li>Your organic traffic dropped suddenly, 30% or more overnight, with no content changes<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>On the site itself:<\/strong><\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Mobile visitors get redirected, but desktop visitors do not<\/li>\n\n\n\n<li>Visitors arriving from Google get redirected, but direct visitors do not<\/li>\n\n\n\n<li>New pages or posts appeared that you did not create<\/li>\n\n\n\n<li>The homepage shows spam content, foreign language text, or pharmaceutical products<\/li>\n\n\n\n<li>A &#8220;Deceptive site ahead&#8221; warning appears in Chrome or Firefox<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>In the WordPress backend:<\/strong><\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Admin accounts you do not recognise appear in Users, then All Users<\/li>\n\n\n\n<li>Plugins or themes you did not install are present<\/li>\n\n\n\n<li>Email logs show spam being sent from your hosting account<\/li>\n\n\n\n<li>Your hosting provider suspended or flagged your account<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>In your analytics:<\/strong><\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>A sudden spike in traffic from unusual countries<\/li>\n\n\n\n<li>Bounce rate went to 95% overnight<\/li>\n\n\n\n<li>Pages ranking for spam keywords you have never written about<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">If three or more of these match, you have a hack. If any of the Google or Search Console signs match, you definitely have one.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">3. The Most Common WordPress Hack Types in 2026<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Knowing which hack you are dealing with helps locate the malware faster.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">WordPress Pharma Hack (Viagra or SEO Spam)<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Injects pharmaceutical spam into your site but shows it only to Googlebot, never to you. Your Google snippets advertise cheap Viagra while your homepage looks clean. Full guide:<a href=\"https:\/\/claude.ai\/chat\/c98a5e8d-aeae-40f5-a94d-d38952307919#\"> WordPress Pharma Hack: Detection, Removal and Prevention<\/a><\/p>\n\n\n\n<h3 class=\"wp-block-heading\">WordPress Redirect Hack<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Sends some or all of your visitors to scam sites, fake pharmacies, or drive-by malware downloads. Usually conditional: only mobile, only first visit, or only visitors from Google. Full guide:<a href=\"https:\/\/claude.ai\/chat\/c98a5e8d-aeae-40f5-a94d-d38952307919#\"> WordPress Redirect Hack: Detect and Remove It<\/a><\/p>\n\n\n\n<h3 class=\"wp-block-heading\">WordPress Japanese SEO Spam<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Similar to the pharma hack but injects Japanese keyword spam. Your site starts ranking in Japanese search results for counterfeit product searches. Full guide:<a href=\"https:\/\/claude.ai\/chat\/c98a5e8d-aeae-40f5-a94d-d38952307919#\"> WordPress Japanese SEO Spam Hack<\/a><\/p>\n\n\n\n<h3 class=\"wp-block-heading\">WordPress Backdoor<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">A hidden PHP file, usually disguised as a legitimate WordPress file, that lets the attacker regain access at any time. Without removing the backdoor, every cleanup is temporary.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Admin User Creation<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Attackers create hidden administrator accounts, sometimes manipulating the user_status field so accounts do not appear in the WordPress Users list.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">WooCommerce Credit Card Skimming<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">JavaScript injected into checkout pages that silently copies card details as customers type. The site functions normally, customers complete purchases, but their card data goes to the attacker.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">4. Complete Hack Removal Protocol (12 Steps)<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Do these in order. Do not skip any step. The most common reason hacked WordPress sites get reinfected within 30 days is an incomplete cleanup. One remaining persistence point is enough to rebuild the entire infection.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Step 0: Take a snapshot before touching anything<\/h3>\n\n\n\n<pre class=\"wp-block-code\"><code># Backup files\n\ntar -czf infected-files-$(date +%Y%m%d-%H%M).tar.gz \/var\/www\/yoursite\/\n\n# Backup database\n\nmysqldump -u root -p yoursite_db > infected-db-$(date +%Y%m%d-%H%M).sql<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Label this backup as INFECTED \u2014 DO NOT RESTORE. You need it for forensics, not recovery.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Step 1: Put the site into maintenance mode<\/h3>\n\n\n\n<pre class=\"wp-block-code\"><code>wp maintenance-mode activate<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">This stops malware from being served to visitors while you work.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Step 2: Find every modified file<\/h3>\n\n\n\n<pre class=\"wp-block-code\"><code># PHP files modified in last 30 days\n\nfind \/var\/www\/yoursite\/ -name \"*.php\" -mtime -30 \\\n\n-not -path \"*\/wp-admin\/*\" \\\n\n-not -path \"*\/wp-includes\/*\" \\\n\n-printf \"%TY-%Tm-%Td %p\\n\" | sort\n\n# All PHP files in uploads (should be zero)\n\nfind \/var\/www\/yoursite\/wp-content\/uploads\/ -name \"*.php\"\n\n# Obfuscated code patterns\n\ngrep -rEln \"eval\\s*\\(|base64_decode|str_rot13|gzinflate\" \/var\/www\/yoursite\/ \\\n\n| grep -v \"vendor\/\" | grep -v \"wp-includes\/\"<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Every PHP file in \/wp-content\/uploads\/ is malware. Delete it. Any file outside of \/wp-admin\/ and \/wp-includes\/ that contains eval(base64_decode( is malware.<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"683\" src=\"https:\/\/www.guardiangaze.com\/blog\/wp-content\/uploads\/2026\/07\/ChatGPT-Image-Jul-14-2026-11_30_30-AM-1024x683.jpg\" alt=\"\" class=\"wp-image-232\" srcset=\"https:\/\/www.guardiangaze.com\/blog\/wp-content\/uploads\/2026\/07\/ChatGPT-Image-Jul-14-2026-11_30_30-AM-1024x683.jpg 1024w, https:\/\/www.guardiangaze.com\/blog\/wp-content\/uploads\/2026\/07\/ChatGPT-Image-Jul-14-2026-11_30_30-AM-300x200.jpg 300w, https:\/\/www.guardiangaze.com\/blog\/wp-content\/uploads\/2026\/07\/ChatGPT-Image-Jul-14-2026-11_30_30-AM-768x512.jpg 768w, https:\/\/www.guardiangaze.com\/blog\/wp-content\/uploads\/2026\/07\/ChatGPT-Image-Jul-14-2026-11_30_30-AM.jpg 1536w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<h3 class=\"wp-block-heading\">Step 3: Check the mu-plugins folder<\/h3>\n\n\n\n<pre class=\"wp-block-code\"><code>ls -la \/var\/www\/yoursite\/wp-content\/mu-plugins\/<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Most WordPress installs have an empty mu-plugins folder. Any file here you did not knowingly install is malware. Must-use plugins run on every page request and cannot be deactivated from the WordPress admin. They are a favourite persistence point for sophisticated attacks.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Step 4: Replace WordPress core, plugins, and themes<\/h3>\n\n\n\n<pre class=\"wp-block-code\"><code># Save wp-config.php and uploads\n\ncp wp-config.php \/tmp\/wp-config.php.safe\n\ncp -r wp-content\/uploads \/tmp\/uploads.safe\n\n# Replace core\n\nwp core download --force --skip-content\n\n# Reinstall all plugins from wordpress.org (clean copies)\n\nwp plugin list --field=name | xargs -I {} wp plugin install {} --force\n\n# Reinstall active theme\n\nwp theme install $(wp theme list --status=active --field=name) --force\n\n# Restore config and uploads\n\ncp \/tmp\/wp-config.php.safe wp-config.php\n\ncp -r \/tmp\/uploads.safe wp-content\/uploads<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">If you have any nulled or pirated plugins or themes, delete them entirely. They are the original entry point in approximately 20% of hacks.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Step 5: Clean .htaccess<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Open .htaccess at the WordPress root and delete anything you did not add. Replace it with the WordPress default:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code># BEGIN WordPress\n\n&lt;IfModule mod_rewrite.c>\n\nRewriteEngine On\n\nRewriteRule .* - &#91;E=HTTP_AUTHORIZATION:%{HTTP:Authorization}]\n\nRewriteBase \/\n\nRewriteRule ^index\\.php$ - &#91;L]\n\nRewriteCond %{REQUEST_FILENAME} !-f\n\nRewriteCond %{REQUEST_FILENAME} !-d\n\nRewriteRule . \/index.php &#91;L]\n\n&lt;\/IfModule>\n\n# END WordPress<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Check all .htaccess files, not just the root. Attackers often inject redirects into subdirectory .htaccess files:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>find \/var\/www\/yoursite\/ -name \".htaccess\" -exec grep -l \"Rewrite\\|Redirect\" {} \\;<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\">Step 6: Clean wp-config.php<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Open wp-config.php. Anything between &lt;?php and define(&#8216;DB_NAME&#8217; that you did not put there is malicious. Any eval(), base64_decode(), or gzinflate() outside of a comment is malicious. Delete it.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Step 7: Clean the database<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">This is the step most site owners skip, and the reason most cleaned sites get reinfected.<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>-- Find suspicious encoded options\n\nSELECT option_name, LENGTH(option_value) AS size\n\nFROM wp_options\n\nWHERE LENGTH(option_value) > 10000\n\nOR option_value LIKE '%eval(%'\n\nOR option_value LIKE '%base64_decode%'\n\nOR option_value LIKE '%str_rot13%'\n\nOR option_value LIKE '%window.location%'\n\nORDER BY size DESC\n\nLIMIT 30;<\/code><\/pre>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"683\" src=\"https:\/\/www.guardiangaze.com\/blog\/wp-content\/uploads\/2026\/07\/Hacked-Site-1024x683.jpg\" alt=\"\" class=\"wp-image-233\" srcset=\"https:\/\/www.guardiangaze.com\/blog\/wp-content\/uploads\/2026\/07\/Hacked-Site-1024x683.jpg 1024w, https:\/\/www.guardiangaze.com\/blog\/wp-content\/uploads\/2026\/07\/Hacked-Site-300x200.jpg 300w, https:\/\/www.guardiangaze.com\/blog\/wp-content\/uploads\/2026\/07\/Hacked-Site-768x512.jpg 768w, https:\/\/www.guardiangaze.com\/blog\/wp-content\/uploads\/2026\/07\/Hacked-Site.jpg 1536w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">Common malicious option names seen in active 2025-2026 campaigns: _<strong>hdra_core, _wp_core_cache, widget_jquery_cache, theme_mod_optimization, _seo_meta_cache.<\/strong><\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>-- Delete confirmed malicious options (add your specific names)\n\nDELETE FROM wp_options\n\nWHERE option_name IN (\n\n'_hdra_core',\n\n'_wp_core_cache',\n\n'widget_jquery_cache'\n\n-- add any others found above\n\n);\n\n-- Remove injected scripts from posts\n\nUPDATE wp_posts\n\nSET post_content = REGEXP_REPLACE(\n\npost_content,\n\n'&lt;script&#91;^>]*src=\"https?:\/\/&#91;^\"]*\\.(shop|click|xyz|top|fun|live)\/&#91;^\"]*\"&#91;^>]*>&lt;\/script>',\n\n''\n\n)\n\nWHERE post_content REGEXP '&lt;script&#91;^>]*\\.(shop|click|xyz|top|fun|live)';<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Test your UPDATE statements on a copy of the database before running against production.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Step 8: Remove unauthorized administrator accounts<\/h3>\n\n\n\n<pre class=\"wp-block-code\"><code>-- List all administrator accounts\n\nSELECT u.ID, u.user_login, u.user_email, u.user_registered\n\nFROM wp_users u\n\nINNER JOIN wp_usermeta m ON u.ID = m.user_id\n\nWHERE m.meta_key = 'wp_capabilities'\n\nAND m.meta_value LIKE '%administrator%'\n\nORDER BY u.user_registered DESC;<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Any administrator you do not recognise, especially one created in the same timeframe as the hack, is the attacker&#8217;s persistent access.<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>DELETE FROM wp_users WHERE ID = &lt;rogue_id>;\n\nDELETE FROM wp_usermeta WHERE user_id = &lt;rogue_id>;<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\">Step 9: Remove malicious scheduled events<\/h3>\n\n\n\n<pre class=\"wp-block-code\"><code># List all cron events\n\nwp cron event list\n\n# Delete any hook you do not recognise\n\nwp cron event delete &lt;hook_name><\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Attackers use WP-Cron to rebuild deleted malware hourly. A cron job named gg_pharma_reinstall, wp_check_remote, or theme_optimization_run was not created by WordPress or any legitimate plugin.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Step 10: Rotate every credential<\/h3>\n\n\n\n<pre class=\"wp-block-code\"><code># Reset all WordPress user passwords\n\nwp user list --field=ID | xargs -I {} wp user reset-password {}\n\n# Generate fresh authentication keys\n\ncurl https:\/\/api.wordpress.org\/secret-key\/1.1\/salt\/<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Paste the output of the salt generator into wp-config.php, replacing the AUTH_KEY block. Also rotate: database password, SFTP\/SSH keys, hosting control panel password, and any API keys the site uses.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Step 11: Verify the cleanup<\/h3>\n\n\n\n<pre class=\"wp-block-code\"><code># Check for remaining obfuscation\n\ngrep -rEln \"eval\\s*\\(|base64_decode|str_rot13\" \/var\/www\/yoursite\/ \\\n\n| grep -v \"vendor\/\" | grep -v \"wp-includes\/\"\n\n# Confirm no PHP in uploads\n\nfind \/var\/www\/yoursite\/wp-content\/uploads\/ -name \"*.php\"\n\n# Re-fetch as Googlebot to confirm malware is gone\n\ncurl -sA \"Mozilla\/5.0 (compatible; Googlebot\/2.1)\" https:\/\/yourdomain.com\/ \\\n\n| grep -i \"viagra\\|casino\\|redirect\"<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Any results from these checks mean you missed something. Repeat steps 2 through 9.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Step 12: Bring the site back online<\/h3>\n\n\n\n<pre class=\"wp-block-code\"><code>wp maintenance-mode deactivate<\/code><\/pre>\n\n\n\n<h2 class=\"wp-block-heading\">5. How to Recover Your Google Rankings After a Hack<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Removing the malware is step one. Your Google rankings will not recover automatically. You need to work with Google directly to remove the warning and rebuild trust.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Submit a Security Review Request<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">In Search Console, go to Security and Manual Actions, then Security Issues, then Request Review.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Include:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>What the infection was (for example, &#8220;pharma SEO spam injected via outdated plugin&#8221;)<\/li>\n\n\n\n<li>The specific steps you took to remove it<\/li>\n\n\n\n<li>What you have done to prevent reinfection (server-side scanning, 2FA, plugin update policy)<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">Security review decisions typically arrive within 24 to 72 hours for malware, and up to 10 days for spam-related issues.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Force Re-Crawl of Your Most Important Pages<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">In the URL Inspection tool, paste each of your top 10 pages, then click Request Indexing. Do this after the security review is cleared.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Submit a Fresh Sitemap<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Generate a clean sitemap from Yoast, RankMath, or wp sitemap generate, then resubmit it in Search Console under Sitemaps. This signals which URLs are legitimate and helps Google deindex spam URLs faster.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">What to Expect<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Sites caught within 2 weeks: Most rankings recover within 4 to 6 weeks of the security review being cleared<\/li>\n\n\n\n<li>Sites infected for 1 to 3 months: Rankings recover over 2 to 4 months<\/li>\n\n\n\n<li>Sites infected for 3-plus months: Some keyword positions may not fully recover<\/li>\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\">6. How to Stop It Happening Again<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">A cleaned WordPress site has a 60% reinfection rate within 30 days without preventative measures. The root causes, in order of frequency:<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The entry point was never closed. The vulnerability that let attackers in, whether an outdated plugin CVE, a nulled theme, or a weak admin password, is still present. Audit every plugin against the WPScan vulnerability database immediately after cleanup.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The cleanup was incomplete. One persistence point (a cron job, a database option, a mu-plugins file) was left behind. Follow steps 1 through 11 above without shortcuts.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">No virtual patching. A new plugin vulnerability is exploited within 4 hours of public disclosure. The official patch typically arrives 7 to 14 days later. That gap is when reinfections happen.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Compromised hosting credentials. If your host password or SSH key is in any breach database, attackers can re-compromise at the server level regardless of WordPress hardening. Check at haveibeenpwned.com and rotate.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The prevention checklist:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Server-side malware scanning (runs outside WordPress, malware cannot tamper with it)<\/li>\n\n\n\n<li>WAF with virtual patching for the top WordPress plugin CVEs<\/li>\n\n\n\n<li>2FA on every administrator account, no exceptions<\/li>\n\n\n\n<li>Database scanning enabled (the part most plugins skip entirely)<\/li>\n\n\n\n<li>DISALLOW_FILE_EDIT and DISALLOW_FILE_MODS in wp-config.php<\/li>\n\n\n\n<li>PHP execution disabled in \/wp-content\/uploads\/<\/li>\n\n\n\n<li>Daily off-server backups, tested by restore at least quarterly<\/li>\n\n\n\n<li>Quarterly plugin audit, remove anything not actively maintained<\/li>\n\n\n\n<li>Zero nulled or pirated plugins or themes<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\"><a href=\"https:\/\/www.guardiangaze.com\/\">GuardianGaze<\/a> ships all of these by default. Install the free plugin or see the paid plans.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">7. Frequently Asked Questions<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>My site looks completely normal but a customer says it is hacked. Is that possible?<\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Yes. This is the standard presentation of cloaked WordPress malware. Modern attacks serve clean content to the site owner (logged-in users, direct visitors, familiar IP addresses) while serving malicious content to visitors arriving from search engines. Test using curl with a Googlebot User-Agent, or open your site in an incognito window on a mobile data connection you have not used before.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>My security plugin says everything is clean but I am still seeing spam in Google. Why?<\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">File-based security plugins scan PHP files against known malware signatures. The pharma hack and several redirect variants store their payload in the WordPress database, specifically wp_options, which file scanners never read. A clean scan result from a plugin that does not scan the database is not evidence that you are clean.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>How did my site get hacked in the first place?<\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The most common entry points in 2025-2026: an outdated plugin with a known CVE (around 60% of cases), a nulled or pirated plugin or theme (20%), a brute-forced admin password (10%), and cross-site contamination from a neighbouring site on shared hosting (10%).<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>How long will it take for Google to remove the hacked warning?<\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">After a successful security review, the warning is typically removed within 24 to 72 hours. Your search rankings then take a separate recovery period, usually 2 to 8 weeks for sites cleaned quickly, and 2 to 6 months for longer infections.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Should I just restore from a backup?<\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Only if you can verify the backup predates the infection. Pharma and redirect malware often sits dormant for 2 to 8 weeks before activating. If you restore, run the full cleanup protocol against the restored site as if it were a fresh infection.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Do I need to notify my customers about the hack?<\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">If your site collected any personal data (names, emails, passwords, payment information) and attackers had file-system or database access, you may have a notification obligation under GDPR Article 33 (72-hour report to the ICO if you are in the UK or EU), CCPA, or PCI-DSS. The threshold is whether the attacker could have accessed personal data. On a typical compromised WordPress install, the answer is usually yes.<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><a href=\"https:\/\/claude.ai\/chat\/c98a5e8d-aeae-40f5-a94d-d38952307919#\">WordPress Pharma Hack: Detection, Removal and Prevention<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/claude.ai\/chat\/c98a5e8d-aeae-40f5-a94d-d38952307919#\">WordPress Redirect Hack: Detect and Remove It<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/claude.ai\/chat\/c98a5e8d-aeae-40f5-a94d-d38952307919#\">WordPress Brute Force Attack Prevention<\/a><\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">Stop the next hack before it starts. <a href=\"https:\/\/www.guardiangaze.com\/\">GuardianGaze&#8217;s<\/a> server-side scanner catches malware that hides from ordinary plugins, including the database half most scanners miss. <a href=\"https:\/\/wordpress.org\/plugins\/guardian-gaze\/\">Install the free plugin<\/a> or <a href=\"https:\/\/guardiangaze.com\/wp\/subscription\">see the paid plans<\/a>.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Think your WordPress site has been hacked? Learn how to confirm the infection, clean every compromised file and database entry, and restore your Google rankings.<\/p>\n","protected":false},"author":1,"featured_media":235,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[2],"tags":[],"class_list":["post-211","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-blog"],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v27.6 - https:\/\/yoast.com\/product\/yoast-seo-wordpress\/ -->\n<title>WordPress Hacked? How to Fix, Clean and Recover Your Site (2026)<\/title>\n<meta name=\"description\" content=\"Your WordPress site has been hacked. Here is exactly how to confirm it, clean every infection point and get yourGoogle rankings back.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.guardiangaze.com\/blog\/wordpress-hacked\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"WordPress Hacked? How to Fix, Clean and Recover Your Site (2026)\" \/>\n<meta property=\"og:description\" content=\"Your WordPress site has been hacked. Here is exactly how to confirm it, clean every infection point and get yourGoogle rankings back.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.guardiangaze.com\/blog\/wordpress-hacked\/\" \/>\n<meta property=\"og:site_name\" content=\"Guardian Gaze Blog\" \/>\n<meta property=\"article:published_time\" content=\"2026-07-13T06:37:19+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2026-07-14T06:44:05+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/www.guardiangaze.com\/blog\/wp-content\/uploads\/2026\/07\/WordPress-Hacked.jpg\" \/>\n\t<meta property=\"og:image:width\" content=\"1448\" \/>\n\t<meta property=\"og:image:height\" content=\"1086\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/jpeg\" \/>\n<meta name=\"author\" content=\"gazeblogadmin\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"gazeblogadmin\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"11 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/www.guardiangaze.com\\\/blog\\\/wordpress-hacked\\\/#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.guardiangaze.com\\\/blog\\\/wordpress-hacked\\\/\"},\"author\":{\"name\":\"gazeblogadmin\",\"@id\":\"https:\\\/\\\/www.guardiangaze.com\\\/blog\\\/#\\\/schema\\\/person\\\/d9ce71728e9ff02ac5cd486b0d3c23ea\"},\"headline\":\"WordPress Hacked? How to Fix, Clean and Recover Your Site (2026)\",\"datePublished\":\"2026-07-13T06:37:19+00:00\",\"dateModified\":\"2026-07-14T06:44:05+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/www.guardiangaze.com\\\/blog\\\/wordpress-hacked\\\/\"},\"wordCount\":2168,\"publisher\":{\"@id\":\"https:\\\/\\\/www.guardiangaze.com\\\/blog\\\/#organization\"},\"image\":{\"@id\":\"https:\\\/\\\/www.guardiangaze.com\\\/blog\\\/wordpress-hacked\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/www.guardiangaze.com\\\/blog\\\/wp-content\\\/uploads\\\/2026\\\/07\\\/WordPress-Hacked.jpg\",\"articleSection\":[\"Blog\"],\"inLanguage\":\"en-US\"},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/www.guardiangaze.com\\\/blog\\\/wordpress-hacked\\\/\",\"url\":\"https:\\\/\\\/www.guardiangaze.com\\\/blog\\\/wordpress-hacked\\\/\",\"name\":\"WordPress Hacked? How to Fix, Clean and Recover Your Site (2026)\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.guardiangaze.com\\\/blog\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/www.guardiangaze.com\\\/blog\\\/wordpress-hacked\\\/#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/www.guardiangaze.com\\\/blog\\\/wordpress-hacked\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/www.guardiangaze.com\\\/blog\\\/wp-content\\\/uploads\\\/2026\\\/07\\\/WordPress-Hacked.jpg\",\"datePublished\":\"2026-07-13T06:37:19+00:00\",\"dateModified\":\"2026-07-14T06:44:05+00:00\",\"description\":\"Your WordPress site has been hacked. Here is exactly how to confirm it, clean every infection point and get yourGoogle rankings back.\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/www.guardiangaze.com\\\/blog\\\/wordpress-hacked\\\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/www.guardiangaze.com\\\/blog\\\/wordpress-hacked\\\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/www.guardiangaze.com\\\/blog\\\/wordpress-hacked\\\/#primaryimage\",\"url\":\"https:\\\/\\\/www.guardiangaze.com\\\/blog\\\/wp-content\\\/uploads\\\/2026\\\/07\\\/WordPress-Hacked.jpg\",\"contentUrl\":\"https:\\\/\\\/www.guardiangaze.com\\\/blog\\\/wp-content\\\/uploads\\\/2026\\\/07\\\/WordPress-Hacked.jpg\",\"width\":1448,\"height\":1086,\"caption\":\"Wordpress hacked\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/www.guardiangaze.com\\\/blog\\\/wordpress-hacked\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/www.guardiangaze.com\\\/blog\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"WordPress Hacked? How to Fix, Clean and Recover Your Site (2026)\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/www.guardiangaze.com\\\/blog\\\/#website\",\"url\":\"https:\\\/\\\/www.guardiangaze.com\\\/blog\\\/\",\"name\":\"Guardian Gaze Blog\",\"description\":\"\",\"publisher\":{\"@id\":\"https:\\\/\\\/www.guardiangaze.com\\\/blog\\\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/www.guardiangaze.com\\\/blog\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/www.guardiangaze.com\\\/blog\\\/#organization\",\"name\":\"Guardian Gaze Blog\",\"url\":\"https:\\\/\\\/www.guardiangaze.com\\\/blog\\\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/www.guardiangaze.com\\\/blog\\\/#\\\/schema\\\/logo\\\/image\\\/\",\"url\":\"https:\\\/\\\/www.guardiangaze.com\\\/blog\\\/wp-content\\\/uploads\\\/2026\\\/05\\\/Screenshot-at-May-20-21-05-16.png\",\"contentUrl\":\"https:\\\/\\\/www.guardiangaze.com\\\/blog\\\/wp-content\\\/uploads\\\/2026\\\/05\\\/Screenshot-at-May-20-21-05-16.png\",\"width\":268,\"height\":193,\"caption\":\"Guardian Gaze Blog\"},\"image\":{\"@id\":\"https:\\\/\\\/www.guardiangaze.com\\\/blog\\\/#\\\/schema\\\/logo\\\/image\\\/\"}},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/www.guardiangaze.com\\\/blog\\\/#\\\/schema\\\/person\\\/d9ce71728e9ff02ac5cd486b0d3c23ea\",\"name\":\"gazeblogadmin\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/160aa129c0d33d97f8c9a11e24f68d53ea797f00ebb88e4ed61faa2090a25085?s=96&d=mm&r=g\",\"url\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/160aa129c0d33d97f8c9a11e24f68d53ea797f00ebb88e4ed61faa2090a25085?s=96&d=mm&r=g\",\"contentUrl\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/160aa129c0d33d97f8c9a11e24f68d53ea797f00ebb88e4ed61faa2090a25085?s=96&d=mm&r=g\",\"caption\":\"gazeblogadmin\"},\"sameAs\":[\"https:\\\/\\\/wp.guardiangaze.com\\\/blog\"],\"url\":\"https:\\\/\\\/www.guardiangaze.com\\\/blog\\\/author\\\/gazeblogadmin\\\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"WordPress Hacked? How to Fix, Clean and Recover Your Site (2026)","description":"Your WordPress site has been hacked. Here is exactly how to confirm it, clean every infection point and get yourGoogle rankings back.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.guardiangaze.com\/blog\/wordpress-hacked\/","og_locale":"en_US","og_type":"article","og_title":"WordPress Hacked? How to Fix, Clean and Recover Your Site (2026)","og_description":"Your WordPress site has been hacked. Here is exactly how to confirm it, clean every infection point and get yourGoogle rankings back.","og_url":"https:\/\/www.guardiangaze.com\/blog\/wordpress-hacked\/","og_site_name":"Guardian Gaze Blog","article_published_time":"2026-07-13T06:37:19+00:00","article_modified_time":"2026-07-14T06:44:05+00:00","og_image":[{"width":1448,"height":1086,"url":"https:\/\/www.guardiangaze.com\/blog\/wp-content\/uploads\/2026\/07\/WordPress-Hacked.jpg","type":"image\/jpeg"}],"author":"gazeblogadmin","twitter_card":"summary_large_image","twitter_misc":{"Written by":"gazeblogadmin","Est. reading time":"11 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/www.guardiangaze.com\/blog\/wordpress-hacked\/#article","isPartOf":{"@id":"https:\/\/www.guardiangaze.com\/blog\/wordpress-hacked\/"},"author":{"name":"gazeblogadmin","@id":"https:\/\/www.guardiangaze.com\/blog\/#\/schema\/person\/d9ce71728e9ff02ac5cd486b0d3c23ea"},"headline":"WordPress Hacked? How to Fix, Clean and Recover Your Site (2026)","datePublished":"2026-07-13T06:37:19+00:00","dateModified":"2026-07-14T06:44:05+00:00","mainEntityOfPage":{"@id":"https:\/\/www.guardiangaze.com\/blog\/wordpress-hacked\/"},"wordCount":2168,"publisher":{"@id":"https:\/\/www.guardiangaze.com\/blog\/#organization"},"image":{"@id":"https:\/\/www.guardiangaze.com\/blog\/wordpress-hacked\/#primaryimage"},"thumbnailUrl":"https:\/\/www.guardiangaze.com\/blog\/wp-content\/uploads\/2026\/07\/WordPress-Hacked.jpg","articleSection":["Blog"],"inLanguage":"en-US"},{"@type":"WebPage","@id":"https:\/\/www.guardiangaze.com\/blog\/wordpress-hacked\/","url":"https:\/\/www.guardiangaze.com\/blog\/wordpress-hacked\/","name":"WordPress Hacked? How to Fix, Clean and Recover Your Site (2026)","isPartOf":{"@id":"https:\/\/www.guardiangaze.com\/blog\/#website"},"primaryImageOfPage":{"@id":"https:\/\/www.guardiangaze.com\/blog\/wordpress-hacked\/#primaryimage"},"image":{"@id":"https:\/\/www.guardiangaze.com\/blog\/wordpress-hacked\/#primaryimage"},"thumbnailUrl":"https:\/\/www.guardiangaze.com\/blog\/wp-content\/uploads\/2026\/07\/WordPress-Hacked.jpg","datePublished":"2026-07-13T06:37:19+00:00","dateModified":"2026-07-14T06:44:05+00:00","description":"Your WordPress site has been hacked. Here is exactly how to confirm it, clean every infection point and get yourGoogle rankings back.","breadcrumb":{"@id":"https:\/\/www.guardiangaze.com\/blog\/wordpress-hacked\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.guardiangaze.com\/blog\/wordpress-hacked\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.guardiangaze.com\/blog\/wordpress-hacked\/#primaryimage","url":"https:\/\/www.guardiangaze.com\/blog\/wp-content\/uploads\/2026\/07\/WordPress-Hacked.jpg","contentUrl":"https:\/\/www.guardiangaze.com\/blog\/wp-content\/uploads\/2026\/07\/WordPress-Hacked.jpg","width":1448,"height":1086,"caption":"Wordpress hacked"},{"@type":"BreadcrumbList","@id":"https:\/\/www.guardiangaze.com\/blog\/wordpress-hacked\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/www.guardiangaze.com\/blog\/"},{"@type":"ListItem","position":2,"name":"WordPress Hacked? How to Fix, Clean and Recover Your Site (2026)"}]},{"@type":"WebSite","@id":"https:\/\/www.guardiangaze.com\/blog\/#website","url":"https:\/\/www.guardiangaze.com\/blog\/","name":"Guardian Gaze Blog","description":"","publisher":{"@id":"https:\/\/www.guardiangaze.com\/blog\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.guardiangaze.com\/blog\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/www.guardiangaze.com\/blog\/#organization","name":"Guardian Gaze Blog","url":"https:\/\/www.guardiangaze.com\/blog\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.guardiangaze.com\/blog\/#\/schema\/logo\/image\/","url":"https:\/\/www.guardiangaze.com\/blog\/wp-content\/uploads\/2026\/05\/Screenshot-at-May-20-21-05-16.png","contentUrl":"https:\/\/www.guardiangaze.com\/blog\/wp-content\/uploads\/2026\/05\/Screenshot-at-May-20-21-05-16.png","width":268,"height":193,"caption":"Guardian Gaze Blog"},"image":{"@id":"https:\/\/www.guardiangaze.com\/blog\/#\/schema\/logo\/image\/"}},{"@type":"Person","@id":"https:\/\/www.guardiangaze.com\/blog\/#\/schema\/person\/d9ce71728e9ff02ac5cd486b0d3c23ea","name":"gazeblogadmin","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/secure.gravatar.com\/avatar\/160aa129c0d33d97f8c9a11e24f68d53ea797f00ebb88e4ed61faa2090a25085?s=96&d=mm&r=g","url":"https:\/\/secure.gravatar.com\/avatar\/160aa129c0d33d97f8c9a11e24f68d53ea797f00ebb88e4ed61faa2090a25085?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/160aa129c0d33d97f8c9a11e24f68d53ea797f00ebb88e4ed61faa2090a25085?s=96&d=mm&r=g","caption":"gazeblogadmin"},"sameAs":["https:\/\/wp.guardiangaze.com\/blog"],"url":"https:\/\/www.guardiangaze.com\/blog\/author\/gazeblogadmin\/"}]}},"_links":{"self":[{"href":"https:\/\/www.guardiangaze.com\/blog\/wp-json\/wp\/v2\/posts\/211","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.guardiangaze.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.guardiangaze.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.guardiangaze.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.guardiangaze.com\/blog\/wp-json\/wp\/v2\/comments?post=211"}],"version-history":[{"count":21,"href":"https:\/\/www.guardiangaze.com\/blog\/wp-json\/wp\/v2\/posts\/211\/revisions"}],"predecessor-version":[{"id":236,"href":"https:\/\/www.guardiangaze.com\/blog\/wp-json\/wp\/v2\/posts\/211\/revisions\/236"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.guardiangaze.com\/blog\/wp-json\/wp\/v2\/media\/235"}],"wp:attachment":[{"href":"https:\/\/www.guardiangaze.com\/blog\/wp-json\/wp\/v2\/media?parent=211"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.guardiangaze.com\/blog\/wp-json\/wp\/v2\/categories?post=211"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.guardiangaze.com\/blog\/wp-json\/wp\/v2\/tags?post=211"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}