WordPress is a powerful and flexible platform, but its popularity also makes it a common target for hackers. Websites can be compromised through outdated plugins or themes, weak admin passwords, poorly coded extensions, or unsecured hosting environments. Once infected, attackers may inject malware, redirect visitors, deface the site, or even gain full control of the server.
The good news is that most WordPress hacks are preventable. By keeping your site updated, using strong security practices, and installing a reliable security plugin, you can greatly reduce your risk. In this guide, we’ll walk you through the steps to perform a clean reinstallation of your WordPress site after a hack, and show you how to secure it properly to prevent future attacks.
Access the server via SSH - If you don't know how, you can follow this guide.
Go to the webroot directory of your website — in my case, it’s the public_html folder.
Create a database backup using the command below.
#wp db export bigscoots.sql
Move the database file bigscoots.sql and the wp-content folder to the tmp directory.
#mv bigscoots.sql wp-content/ ../tmp
Remove all files and folders inside the web root directory using the command below to prepare for downloading fresh WordPress core files.
#rm -rf*
Next, download the latest version of WordPress from wordpress.org using the command below.
#wp core download --force
Create a new database using cPanel → MySQL Database Wizard, and update its database details in the wp-config.php file.
Now remove the existing wp-content folder from public_html, then move the wp-content directory and bigscoots.sql file from the tmp directory back to public_html.
#rm -rf wp-content/
#cd ../tmp
#mv wp-content bigscoots.sql ../public_html/
Next, import the database using the WP-CLI command, and then move the dump file back to the tmp directory.
#wp db import bigscoots.sql
#mv bigscoots.sql ../tmp/
The next step is to review all installed plugins and download fresh copies to ensure they’re clean. You can check the installed plugins using the WP-CLI command below.
#wp plugin list
Now we need to reinstall all plugins one by one from WordPress. Let’s start with cookieadmin.
#wp plugin install cookieadmin --force
Please follow the same steps for all other plugins as you did for the previous one, and then test the website.
Finally, install a security plugin on your website, such as Wordfence or iThemes Security, to help protect it in the future.
Congratulations! You’ve successfully completed a clean reinstallation of your WordPress site after a hack.
If you have any questions, please don’t hesitate to contact our team via live chat.
For technical inquiries, please feel free to reach our support team by emailing support@bigscoots.com from your registered email or by submitting a support ticket.