How can you tell if your site has really been hacked?

Before reinstalling everything, identify the symptoms. A slow or misconfigured website can resemble an infected site. Here are the telltale signs:

  • Redirects to unknown websites, au clic, vos visiteurs atterrissent sur des pages de phishing ou de faux antivirus
  • Google Search Console displays "Deceptive site"", Google a détecté du contenu malveillant et blacklisté votre domaine
  • Your hosting provider has suspended the account, Infomaniak ou OVH envoient une alerte avec des noms de fichiers suspects
  • New administrator users have appeared. in WordPress without you having created them
  • Unknown PHP files are lying around in wp-content/uploads/, wp-includes/ or at the root
  • The HTML source contains hidden links. to third-party sites (at the bottom of the page, in display:none style tags)
""In April 2026, 21 MogaCode customer sites were infected overnight via nullified plugins. Patrick Rary diagnosed and cleaned everything up in less than 12 hours. The attack vector: a unique backdoor encoded in each hacked plugin.""

Etape 1, Isoler et diagnostiquer

Do not touch anything until you have a clear picture of the infection. Acting blindly risks concealing traces and leaving active backdoors.

1
Put the site into maintenance mode, activez un plugin de maintenance ou ajoutez un .htaccess pour bloquer l'accès public pendant le nettoyage.
2
Export a complete dump, même infecté, gardez une copie. On ne supprime rien sans backup.
3
Run a scan with Wordfence or MalCare, ces plugins comparent vos fichiers core WordPress avec les originaux officiels et signalent chaque différence.
4
Search for recently modified files, via SSH : find . -name "*.php" -newer wp-config.php -not -path "*/uploads/*""

Etape 2, Nettoyage DIY (si vous avez les accès SSH)

Remove malicious files

Backdoors are often hidden in files with innocuous names: wp-includes/class-wp-clean.php, wp-content/uploads/2025/cache.php or PHP files in wp-content/uploads (uploads should never contain PHP).

find wp-content/uploads -name "*.php" -delete find wp-includes -name "*.php" | xargs grep -l "eval(base64_decode" | xargs rm grep -r "cAT3VWynuiL7CRgr" . --include="*.php" -l

Reinstall the core files

Never trust the core files of an infected site. Download a fresh WordPress installation and replace all core files (everything except wp-content/ and wp-config.php).

Change all passwords

  • WordPress password for each administrator
  • Database password (in wp-config.php)
  • FTP/SFTP password for the hosting
  • Les security keys WordPress (AUTH_KEY, SECURE_AUTH_KEY, etc.), regénérez-les sur api.wordpress.org/secret-key/1.1/salt/

When should you call a professional?

If you encounter any of these issues, don't waste any more time trying to clean it yourself:

  • The infection recurs after cleaning (persistent backdoor or compromised admin account)
  • Google has blacklisted your domain (partial or total deindexing)
  • You do not have SSH access or the file permissions have been changed.
  • You have an e-commerce website with customer data (GDPR risk)
  • Your hosting provider refuses to reactivate the account without validation.

Is your website infected?

MogaCode prend en charge le nettoyage complet, le hardening et la mise en place d'une surveillance active. Intervention rapide, généralement sous 24h.

Request an intervention

Etape 3, Durcissement post-nettoyage

A cleaned but unhardened site will be reinfected. That's a certainty. Here are the essential measures:

Secure wp-config.php

# In .htaccess, block direct access to wp-config.php order allow,deny deny from all # Move wp-config.php one level above the web root. # WordPress will find it automatically.

File permissions are correct.

find . -type d -exec chmod 755 {} \; find . -type f -exec chmod 644 {} \; chmod 600 wp-config.php

Enable two-factor authentication

The "WP 2FA" or "Google Authenticator" plugin for WordPress adds a TOTP (Token of Validation) to the login page. This is the most effective measure against brute-force attacks on /wp-admin.

Implementing a WAF

A Web Application Firewall (Wordfence Premium, Cloudflare WAF) blocks attacks before they even reach WordPress. On our Infomaniak servers, we systematically activate Wordfence with a geo-blocking rule targeting countries with high automated scanning activity.

Never use useless plugins

This is the most painful lesson. In April 2026, 21 of our clients' websites were infected overnight via pirated versions of Elementor Pro, Ultimate Elementor, and RevSlider. These plugins all contained the same signature: cAT3VWynuiL7CRgr. A clean, discreet backdoor, already in place for weeks before activation.

WordPress Hardening Checklist

  • Mise à jour WordPress, themes et plugins, sans exception
  • Removal of inactive themes and plugins
  • Limitation of login attempts (Limit Login Attempts)
  • 2FA authentication on all admin accounts
  • Weekly automatic security scan (Wordfence)
  • Automatic daily off-server backups
  • HTTPS enabled with HSTS
  • HTTP security headers (X-Frame-Options, CSP, X-Content-Type-Options)
  • Hiding the WordPress version (in the meta tags and RSS feed)
  • Disable xmlrpc.php if not used
P

Patrick Rary

Fondateur MogaCode, Expert judiciaire informaticien, 30 ans d'experience IT. A nettoye plus de 80 sites WordPress infectes depuis 2020.