How To Fix Hacked WordPress Site - Step by Step

[@wplearninglab]

If you enjoyed this video don't forget to the like it and subscribe! Then check out this playlist about WordPress security: kzbin.info/www/bejne/mInRdZSOi9l1ga8

[@theresioleefland1737]

hello i need ure help, im trying to build a simple webpage in wordpress with local sql where i can demonstrate it that i hack it with a sql injection and after that i configure the webpage and demonstrate that it cant be hacked anymore with the sql injection

[@RichardOrtizROCommunication]

Brother, this video showed me the way! I had to repair a hacked site from a client who came to me with a hacked site. Almost didn't want to take this project on. Tons of outdated plugins. But, your video was very clear and helped me tame this monster!

[@wplearninglab]

That's awesome Richard, I'm happy this video helped. Now you can add a new service to your offering :) Thanks for watching!

[@rhianwx]

I'm a web designer not dev and I'm always wary of diving into the back end stuff but this was so simple and helped me clean up my client's site without having to pay someone to do it for me. It was such a good tutorial. Thank you

[@wplearninglab]

That's great Rhian, I'm happy I could help!

[@GabrielJimenez-cn7cs]

You totally helped me save 3 websites that got hacked. I reinstalled the wordpress files and brought my sites back to life. I then checked elementor files by comparing it a downloaded version and found the files they hacked. Thanks alot! Great tutorial!

[@iamdann783]

The clearest tutorial I've ever seen. direct on point. Thanks, man.

[@wplearninglab]

You’re welcome Dan and thanks for watching!

[@abramarif1020]

I am really amazed after watch the video and now I got a fair idea regarding malware clearing. Thank you so much Sir

[@wplearninglab]

You’re welcome Arif, thanks for watching!

[@Kacper-kp2nj]

I am shocked that after a long battle I came across this video. I was surprised it was so simple. I tried cleaning the files myself, it kept overwriting my htaccess file and making copies in every folder. I even tried deleting all htaccess files via SSH and cleaning PHP files. Thank you for this video, very effective!

[@wplearninglab]

Years ago I fought the same battles you're describing. I figured there must be an easier way and this video was born :)

[@sabrinavandierendonck7861]

You’re my hero ! I had the same scam happening to me with my wordpress site being hosted on Bluehost and being hacked. I contacted bluehost via chat but directly ended up at siteVault and was asked to pay a whopping 700$ annual fee to fix the problem. Luckily I didn’t go into it and started googeling the problem and ended up with your youtube tutorials ! I managed to fix the problem all by myself and the hacker is no longer present (for the moment). But the fact that restoring the site when backed up is ‘farely’ easy is reassuring enough to me. Thank you once again and continue the good work ! Greetz.

[@Vhusi0003]

Out of the 10hours of videos I watched online, this quick 20min video saved me days and days of fixing my site, thank you thank you thank you

[@tetrafoot]

HI.. HELP PLEASE :) Im trying right now to fix a website. IN my public html folder I only had one suspicious file (the google thing which makes you the owner) there was two of them, and I deleted the suspect., also from the google search console. I don't have a quarantine after the public HTML, but after the TMP folder...... Is that hacked? Should I proceed with the fix in the video? Thanks in advance.

[@ArtistExplores]

Thank you! Thank you! THANK YOU! This helped me to fix a site I'm working on without paying someone else to fix it. Cannot thank you enough!

[@wplearninglab]

Awesome, I'm happy I could help! Thanks for watching!

[@blowinkk9396]

You videos are great! I have learned tons from them! Thank you for making them

[@wplearninglab]

Awesome, that's what I like to hear! That's the reason I make them. Thanks for watching :)

[@empowered_one]

Hi, I followed all of what you said to do and it works. But the thing is with mines it's just words, frames of the webpage but no pictures. Can you tell me what I've done wrong or should I walk back through the step?

[@deeweez5049]

Much appreciated sir! you successfully tough me how to recover my website! fantastic job!

[@DjSmoothNY]

This was a great video. I’ve learned so much watching how you repaired and recovered that site.

[@rinantech]

Very well explained 👍👍 Thanks for sharing this video. Hope this video will help me to find out the solution to my hacked websites

[@spaceyrolince19]

God Bless you safe my Sites, after i have Watch dozens of Videos only yours was help to me

[@filadelfiadisenoweb199]

You are a genius, you taught me how to solve my problem! Great video, totally recommended.

[@emilioelva8748]

nice videos sir btw is it still worked in 2022 or so on ? just curious if some days I would get the same problem.

[@christianosolink8697]

Hi, I'm new here and I was just wondering would you recommend wordfence for securing sites as I have been facing a lot of hacks lately and it is happening like time after time, over and over for the last 2 months. I already did some clean up and of course have the site back up, I even keep a clean file just to make sure if it happens again. Any type of help would be gladly appreciated. thanks for creating this video by the way.

[@Lana-uc4bl]

Thank you for the details video. It didn't resolve issue with hacked website, but i know what to do if I will have similar issue as in the video

[@panagiotisexplorer213]

Personally i did a back restore to the day before the error happened and it's all good now. I used updraft and I do backups for preventing these issues

[@haitotaandreas3965]

Best video on WP ever. Thank you a million

[@holisticmario5157]

I don't have a folder quarantined underneath the public html file. But I am getting rerouted

[@mikemulders]

Does this work vica versa different wordpress versions. I have no website to try with yet... You are good my man with WP!!

[@BYLB]

what if there's no quarantine folder under public_html?

[@ECVPhotography]

Hi I have a question for this Video in my File Manager I only have this folder "quarantine_clamavconnector" but inside I only have old websites that I haven't used in years. It doesn't contain any of the directories for my current sites. I manually backup my wordpress website manually every week or so just as a precaution but I was just wondering why the quarantine directory doesn't have my current sites. Could it be because of my Provider? If thats the case then the same thing could happen to other people depending on their providers. Hit me back.

[@Taten210]

Very good video!! do you think is better to download all the files and work locally on my computer? Or in case I work online, how can I do to set a page that says "working to improve the website" for all the users that visit the website while we are cleaning it? THANKS!

[@TyronneRatcliff]

I have a strange file called ".htaccess-". There is a dash after .htaccess. Does that look fishy?

[@SonuKhan-dt2pm]

Hi, lots of love from India... I have a question, please try answering it.... Actually my site was working properly but every day or other I got the warning about "files changed" and also about feed.php error. I followed what you have told in this video, I deleted feed.php file, but my site stopped working right after it... I do not understand why it stopped working.... Can you please suggest some possible reasons and actions to be taken on my part. Thank you in advance.

[@MADLOADERtube]

What a Great Great Tutorial. :)

[@wplearninglab]

Thanks and thanks for watching!

[@cynthiascott7744]

I'm not sure if my Facebook was hacked or not. But I get a log in sheet every time I try to go into another program. If I click on it without putting my data into it; it gives me an error message and I'm worried that my phone was hacked. It's a real nuisance. If you have any idea what this is I would love to hear from you.

[@3rdtwirl494]

hi thank you. maybe you can help. what if the domain is migrated elsewhere and not in the hosted file manager. when i open their file manager in the original host i cant even find the content files. im not yet sure they have been backed up but they have been on go daddy for 5 years its go to be somewhere

[@wplearninglab]

It sounds like maybe, the domain is just redirected to the new host, rather than migrated. So if you could direct the domain back to GoDaddy, the site may come back up. GoDaddy also has automated backups, maybe that's setup and backups could be there?

[@_cannachris]

Hey buddy thanks a lot for this great tutorial (: What I'm wondering is why you don't scan the database for malicious code - or is that irrelevant since malicious code cannot be executed from a SQL database in Wordpress?

[@gloryasun3216]

Hi, thank you for making this video, really helfpul! Unfortunately it doesn't work on me. I think that my site is hacked to redirect people to go to malicious sites. Can you tell me which one of your video that will work on my problem? Thank you for tour attention

[@JackedEcto]

I'm having the same problem. Did you find any solution?

[@gabrysmontiel2602]

Bjorn, thanks a lot for the guidance. After cleaning infected core files I still have an issue with a plug-in called Slider Revolution. Could you very briefly explain the process to replace the plug-in with a clean version? (I've got to do it over cpanel because I don't have access to wp panel yet. I guess I'll be able to access as soon as I fix that last issue)

[@lidiadelgado6190]

Thank you so much, that worked perfectly and it was very straightforward!!!

[@Electronzap]

I think I am going to start backing up my files more often lol. Learned a lot though, thanks! If you run into a roadblock for coming up with new video ideas, I think you could get some good mileage out of basic programming videos so that people recognize gibberish versus normal programming. I know just enough to understand what you were saying in the video but would have been lost completely if I hadn't studied programming the tiny bit that I have lol.

[@wplearninglab]

Backing up is always a good idea :) Good advice on the programming. I've been thinking about making a playlist for CSS basics, HTML basics and PHP/MySQL basics. They aren't core to WordPress, but at the same time they are...

[@ultrasoundfeminsider]

How do you do this on a Wordpress.com, where you don’t have access to a cpanel?

[@ziaahmad8738]

Thanks, Man. In my case, the files in wp-content were also affected. One plugin & index.php of my theme was also affected. The hacker had injected some sort of code in it. I replaced both of them with original files & boom. The site started running well & scans are now clean.

[@wplearninglab]

Hi Zia, good work! Now that your site is clean I recommend you start making regular backups so you can recover more easily. I have a few videos that may help. Let me know if you have any further questions :)

[@ziaahmad8738]

@@wplearninglab Thanks for responding. I have a question that I scanned my site with different plugins and all of them are showing clean scans. But still, some Japanese or Chinese Languages pages are being indexed in google with my domain. All of them leads to 404 Page. What should I do?

[@hungleba1622]

@@ziaahmad8738 Could you share me your solution? It's same my case.

[@BentOaksGarage]

So my index.php and .ftaccess were both hit, but they changed the permission to 0444 and I can not change it, delete it, replace it, nothing. What to do in this case? I'm logged in as the root user so I have absolute control.

[@surajbhavani1111]

Great buddy! This video saved us a lot of losses. Thank you so much, Buddy. Relly helpful video.

[@catchlightHQ]

Great video but the potential issue of the database being injected with a script is not addressed. It could be extremely simple for the same hackers to get back in if the database is not reviewed also. Will you do a video on this perhaps?

[@wplearninglab]

You're right. I'll do a followup video on that in the near future. Thanks for the suggestion :)

[@paulspinelli8574]

@@wplearninglab Hey, any news on the DB Injection video?

[@adityajejurkar]

Hello there, Facing some major issues on the sites as some malware files are getting injected wp-vcd.php("you might know"). Tried to remove every one of it still, the problem occurs after some duration. Too many redirections, scam popups are occurring on the site. Don't know what to do.

[@johnyjo9232]

Thank you so much for this help. I was hacked and thought that I would never manage to clean my website. But thanks to you it works know perfectly again. I will know watch the one to secure wordpress ;-)

[@BiswasdipTIGELA]

Excellent thank you

[@wplearninglab]

You’re welcome, thanks for watching!

[@ehtarifa]

This is just for Pros Thanks !!!

[@IsabellaSu-be4xg]

my site is back, all the content are there, but the theme is not there? could you plz tell me how to recover my theme through FTP Server, wp-content-theme? there are several themes in this folder, i don't even know which one is the one i used, i only used one theme, i don't know why there are 10 theme? thank you

[@soundclub837]

Thanks, Bro it helps me so much. Many Many thanks

[@RTectInfosys]

Heya...My WP Site Front end is working good.But backend dasboard gets open..but goes to page not found.htaccess and index file is changing time and agin..Please help

[@danielamurphy6005]

Very good video tutorial! it really worked! thank you for sharing it.

[@wplearninglab]

You're welcome Daniela, thanks for watching!

[@wallacelungu9836]

You saved my life. Thank you

[@13caban]

Thank you a lot! I followed all steps (most of them I already knew, but all together in one place is very nice), but I did not find anything. I have some linux processes running, but when I try to kill them they say the process does not exist. I am suspecting of a hosting with dirty hands.

[@wplearninglab]

Hi Oxlahun, Is your host owned by EIG or involved with SiteLock? Check out this video to see why those two could cause a problem: kzbin.info/www/bejne/mYqnho1rYs6MnLs

[@seanNetX]

I usually dont write much comments but I sincerely have to do this. I have a client website that I manage, but the website is hardly in use, hence I usually dont go there to update plugins. Matter of fact I had only 3 active plugins, wordfence, updraft and contact 7 forms. I felt I was save with just these three. Alas, I was very wrong. I realized recently that the website had been hacked. all pages including login to admin page just foces a strange page that displays some grundig TV's for sale. I had tried so many things, including contacting my webhost for help. My webhost pretty much told me I was on my own since the backups they have already contained the malware. My backups on updraft too seemed infected. I was on the matter for about 1 week and I was just about to give up and inform the client of the bad news, that we had lost the site. Until I saw this video, and it worked like a charm. Thank you very much for saving me so much embarrasment. I did a check on the database and I removed what seems like the injected code there. There was an admin profile added plus some other user metadata. I sincerely hope I have been able to remove all the hack traces since I checked table by table. Thank you again, apolgies for the long write up, I just had to appreciate your good effort and probably be of help to anyone going through similar circumstances. I have updated the few plugins,, hopefully this wouldnt happen again

[@alinaseri7951]

lovely. I took every note. tnx.

[@yogi_samrat]

Do you know how to figure out redirection link which is automatically redirect users on another suspicious website?

[@emanalqaisiea]

hello , my site is hacked and when i access the file manager i can't find the public file that has wp-admin , wp-content ...etc. and i have some file called : .bash_login , .bash_logout what is that ??

[@empowered_one]

What if there is no quarantine under HTML, is there another way that you can go about it?

[@kofiperry19]

same! did you figure this out?

[@netboy1102]

Thank you so much

[@wplearninglab]

You’re welcome, thanks for watching!

[@mustafaalqaragholy8159]

Great Help, clearing out the files and restoring did it

[@eponaskye4158]

Thank you so much!!! Great video

[@wplearninglab]

You’re welcome, thanks for watching!

[@MrFarazy25]

You saved my day Boss

[@wplearninglab]

That’s what I like to hear! I’m happy to help

[@TyronneRatcliff]

Great tutorial! My blog was a victim of Japanese SEO spam. I'm going to erase the malicious files I suspect are causing this. Wish me luck!

[@Murozvimukuru]

did u manage to fix this error

[@Securenaijatv]

thank you, this was very useful

[@pauloconnor5623]

Great video my brotha! Thank you very much! Very helpful!

[@wplearninglab]

You're welcome Paul, thanks for watching!

[@allenmaneya3439]

You are the best, it has worked

[@ChrisKosides]

8:36 Did you mistakenly delete the backup quarantined-bkp.zip file?

[@prakashsahw]

is this also working with siteground hosting please let me know

[@JasonXBeats]

What theme is that? Did it come with a menu login

[@stalkusdigital14]

Very helpful !! Thank you

[@wplearninglab]

You’re welcome, thanks for watching!

[@rosalierazonable2629]

Hi! We're facing this problem but on our subdomains, while the primary domain returned a 404, we reverted our php back to 7.3 and now the primary domain site is already accessible but our subdomain is still having the index of errors but no list of files are reflected only the index of/ error, the name, description, size and last modified. Do you think it is still applicable to this ?

[@wplearninglab]

HI Rosalie, Sorry for the delay. If you have just "Index of/" with no files listed, then all the files have been moved from that location or deleted. That's not usually something a hacker would do and replacing all the WP Core files probably wouldn't do much in this case since there is nothing there. If you put clean WP files back into your subdomains and connect them to the correct database and username then your content should come back. You would have to reinstall any plugins that aren't there any more though. I hope that helps :) Let me know if you have any further questions. Thanks for watching!

[@rosalierazonable2629]

@@wplearninglab Hi! I have already recovered the site days ago with just the exact process you just replied haha. Thank you so much for your channel.

[@marknasri1201]

thanks for the videoi was hoping to use a plugin or something to point the malicious files, which are infected. i know you are doing the virus through your own experience with the files. Even so, when you are done with removing the ones you know, still some malwares may not have been removed

[@mayankverma4484]

Thanks a tonne. Your video worked in principle for me. However, the malware also edited my database entries. So I had to manually restore them from PHPMyAdmin. Any idea how to secure such an attack in future??

[@wplearninglab]

Hey Mayank, That type of hack is called an SQL Injection. The number one way to prevent it is to keep your plugins, themes and WordPress core files up to date. The SQL Injection almost always happen in out-of-date plugins. I hope that helps, let me know if you have any further questions. Thanks for watching!

[@mayankverma4484]

@@wplearninglab Thanks a lot for replying. I will keep this in mind now. :)

[@wplearninglab]

No problem Mayank :)

[@dnice4all]

In my case, the virus is in wp-content and am just building the site with no backup yet. What will I do?

[@RemoteJuniorJobs]

Great video, thanks!

[@wplearninglab]

You're welcome, thanks for watching!

[@EvolvedApe]

I have a wordpress site thats redirecting. Nothing in DNS and cannot get into wp-admin.

[@routesroads7803]

I´m sorry by asking. I need to replace the index.php file. I down loaded a clean file form wordpress, and I have zip the single fine and up loaded to file manager y ipage. Now, I don't know how to unzipped it. can you help me! thanks

[@sebax7]

thanks man, you saved my life :)

[@jeffreyclair1466]

Thank you, worked perfectly!

[@wplearninglab]

You're welcome Jeffrey, I'm glad I could help. Thanks for watching and let me know if you have any questions 🙂

[@adaolisamba323]

Can this be done with a smartphone please? If yes , how?

[@wplearninglab]

Hi Adaolisa, I wouldn’t attempt this with a smart phone. But if you can an FTP program or you can use the tools in cPanel on your smart phone then you may be able to make it work.

[@AayushMaloo]

WOW!! Thanks a ton man!! Really helpful :)

[@beetleking]

website saved, thank you

[@SonnyBurnett2008]

Any tut of how to clean database garbage manually? Thx

[@KulaniNyoni]

This is a very great video. Thank you

[@lemanjamears5494]

This is amazing thank you so much!

[@erichtmusic]

this guy is the best !!!!

[@jrepaka]

thank you for the nice video, my friend's website is hacked, fix applied(sucuri) , after that the wordpress site is coming with home page and no menu bar.Just seeing static content (images). Any help is appreciated.

[@hackedrepair9529]

Do you still need help?

[@NIKULBOSS]

used all 5 solutions, still couldn't got solution. can you please help me.

[@TheBourneBlogger]

Hi Bjorn, Is it normal for a wordpress site to have multiple .htaccess files, espcially if the alternate file names are ".htaccessnowayjose", ".htaccess.bak" and ".htaccess-1540216526"? Also, any suggestions on what to do when your error log file reaches 60MB? Could this cause loading delays? Can the contents be deleted?

[@wplearninglab]

A site can only use one .htaccess file at a time. Any file that is not named exactly .htaccess is not used by the site and can be deleted or moved to somewhere else. I routinely create a backup for my .htaccess file before I make edits to it and then forget about the backup only to find it there months later and then I delete it. You can delete the contents of the error log without any issues. You can also download the error log to your computer first, so you have a backup of it. It should be just a simple text file. It may be a good idea to look through your error log to see what is causing it to grow so big. The list of errors should include what causes each error. If you fix the things that cause the errors your error log won't grow so big in the future. I hope that helps :) Let me know if you have any further questions. Thanks for watching!

[@TheBourneBlogger]

Thanks so much! I was able to delete the 3 extra .htaccess files as well as delete the error log file, the latter of which I learned will regenerate when more errors occur. The site is loading much faster now, so I'll try to figure out how to fix the error.

[@wplearninglab]

Good work! Sometimes speed up your site is as easy as freeing up some space in your hosting account. Fixing the recurring error is a good plan 👍

[@grow-helpingpeoplewithhair334]

Thank you, helped me big time!

[@VikasYadav-fe8bw]

A big thumbs up to you!!

[@wplearninglab]

Thanks Vikas and thanks for watching! Let me know if you have any questions :)

[@usamarafiquejatt3851]

excellent video

[@shaikkhaled4984]

you saved me thank you .... love u

[@ObertEngada]

Thank you, this saved me.

[@pietroizzi8102]

I have a problem called admin_sweet and I don't know how to solve it. Please advise

[@GardensforLife]

Great Video! Thank You for making it!

[@wplearninglab]

Thanks and thank you for watching it :) Let me know if you have any questions :)

[@कनिष्क-घ9थ]

Sir on Google my site title and description has changed and I'm facing some annoying popup . Can you tell how can I remove adware ?

[@hackedrepair9529]

It is hacked you need to fix your hhacked site

[@jinwoo517]

These parasite-like beings who hack your site first and ask for money. I almost paid SiteLock freaking 400 dollars. Seriously disgusted. Thank you for this tutorial.

[@farhansheikh3225]

what if phpmyadmin compromised?

[@raymytech]

Recommend an affordable hosting