Deleting the files you can see is the part everyone does, and on its own it fails: the way in is still open, and the site is reinfected within hours. The order below closes the door before it cleans the room.

1. Take it offline first

A compromised site is sending spam or serving malware to your visitors while you work. Stop that before anything else.

# a holding page that returns 503, so search engines come back later\n# rather than dropping your pages

2. Copy everything before you change it

Take a full copy - files and database - before deleting a single thing. It is evidence: it tells you how they got in, and without it you are guessing.

3. Find the way in

Almost always one of four. Look for the first appearance of a modified file in the access log around its timestamp.

  • An out-of-date plugin or theme - by far the most common.
  • A reused password - leaked somewhere else and tried here.
  • An upload directory that executes PHP - a file uploaded as an image and then run.
  • Stolen FTP or SSH credentials, often from an infected desktop.
find . -type f -mtime -7 -name "*.php" | head -50\ngrep -rl "eval(base64_decode" . | head

4. Clean from a known-good copy, not by editing

Replace the core, the plugins and the themes with fresh downloads. Keep only your own content and uploads, and inspect those - a PHP file in an uploads folder is never legitimate.

find wp-content/uploads -name "*.php" -o -name "*.phtml"

5. The step almost everyone skips

Change every credential the compromised server could see, and invalidate every session. If you skip this, the attacker walks back in with the password they already have.

  • Every CMS admin account.
  • The database user, and the config file that holds it.
  • FTP, SFTP and SSH keys.
  • API keys and payment credentials stored on the server.
  • WordPress: change the salts in wp-config.php - that logs everyone out, including them.

6. Then close the door

  1. Update everything — Core, plugins, themes, PHP.
  2. Remove what you do not use — An inactive plugin is still a file on disk that can be reached.
  3. Stop uploads executing — No PHP handler in the uploads directory.
  4. Two-factor on the panel and the CMS —
Ask your host for the access log for the day it started. The request that dropped the first file is in it, and it names the hole in one line.