You paid for a cleanup, or did it yourself over a long weekend. The spam pages vanished, the scanner came back green, and for a week or two everything looked normal. Then the redirect returned, or a new admin account appeared, or the host sent another warning. A second infection is more discouraging than the first, because it feels as though the earlier work counted for nothing.
It usually counted for something. What a repeat infection tells you is that one piece of the original compromise survived: a way back in that nobody closed. Our hacked site repair and urgent help page covers the wider picture. This page is about one specific job, which is breaking a reinfection cycle on a WordPress site.
Why a cleaned site gets hacked again
Attackers rarely break into a WordPress site, do one thing and leave. The automated tools that exploit weak plugins tend to drop several footholds at once, so that losing one costs them nothing. When a site keeps getting reinfected, the cause is almost always on a short list.
A foothold that was missed
A small PHP file in the uploads folder. A few lines appended to a legitimate plugin file. A “must-use” plugin that never shows in the normal plugin list, or a function tucked inside the theme. Any one of these lets the attacker rewrite the files you just cleaned. How these are hunted down is explained on our backdoor removal page, so we will not repeat it here.
The original hole is still open
If the attacker came in through an outdated plugin with a known vulnerability, removing the malware without updating or replacing that plugin leaves the same door in place. Bots scan for vulnerable versions all the time, so the site gets found again. Plugins that are no longer maintained are a common version of this problem, and our post on dealing with an abandoned plugin sets out the options.
Credentials that still work
Changing the WordPress admin password is not the same as locking the attacker out. A stolen FTP or SFTP password, a hosting panel login, a database user, or a forgotten second administrator can all survive a cleanup. So can logged-in sessions, unless the security keys and salts in the configuration file are replaced so that existing login cookies stop working.
Something that rebuilds the infection on a schedule
Some malware stores its payload in the database and writes it back to disk when triggered. Other strains register a scheduled task, either through WordPress’s own cron system or as a server cron job in the hosting panel, that downloads fresh copies at intervals. Clean the files but leave the trigger, and the infection reappears like clockwork.
A neighbour on the same hosting account
On many shared hosting plans, every site in one account runs as the same system user. An old test install, a forgotten client demo or an abandoned blog in a subfolder can be infected, and from there it can write into your main site. Cleaning only the main site achieves little while the neighbour stays dirty. We describe this pattern in how one hacked site spreads to others on the same account.
The infection came back with a backup
Restoring a backup feels like a clean slate. But if the backup was taken after the compromise began, it brings the malware along with it, and even a genuinely clean backup puts the vulnerable plugin version back. Our guide on when restoring a backup is enough after a hack walks through how to judge that.
Pirated themes or plugins
A “nulled” premium plugin downloaded from a sharing site often carries hidden code of its own. Every time it is reinstalled or updated from the same source, the backdoor returns with it. The reasons are covered in why free copies of premium plugins carry malware.
How we approach a site that keeps getting reinfected
A repeat infection calls for a different mindset from a first cleanup. The question is not only what is bad on the site today. It is what has survived every earlier attempt, and why. That changes the order of the work.
First, we want the history. When did it first happen, what was done each time, who did it, and what came back afterwards. A pattern such as “it returns every Monday” or “it comes back the day after I log in from the office PC” points at very different causes. If you can tell us which plugin versions were in place, and whether the host ran its own scans, even better.
Second, we look at the whole hosting account rather than just the folder the main site lives in. Every installation, every subdomain, every leftover zip file and staging copy. Anything that is not needed, we recommend removing once you agree.
Third, we treat every credential as compromised and plan the order of changes, so the attacker cannot simply notice one password change and fall back on another login. Scheduled tasks inside WordPress and in the hosting panel are listed and checked one at a time.
Fourth, we replace rather than repair wherever we can. WordPress core, and any plugins and themes available from their official sources, are swapped for fresh copies instead of being edited line by line. Custom code that exists only on your site is read by a person, not just passed through a scanner.
Last, we want proof that the cycle is broken, not a single green scan. That means watching for file changes and new user accounts after the cleanup, so that if something stirs, it is caught early. Keeping that watch going over months is what ongoing security maintenance exists for.
Where the main need is a thorough cleanup in the first place, our WordPress malware removal service describes that work. The reinfection work described here sits on top of it.
Before anyone touches it again
If the site has just been reinfected, a few things will help whoever cleans it next, including us.
- Hold off on another quick cleanup. Each round of deleting files destroys some of the evidence about what is regenerating them.
- Write down the timeline. Dates of each infection, each cleanup and what you noticed. Rough dates are fine.
- List every person and tool with access. Former developers, a marketing contractor, a backup service, an uptime monitor. Each one holds a set of credentials.
- Check the computers used to log in. Malware on a PC that saves FTP passwords in an old client program can leak them again after every change. A proper antivirus scan of those machines is worth the time.
- Keep the host informed. If the hosting company has already flagged the account, let them know a deeper cleanup is planned, so the account is less likely to be suspended halfway through without notice.
How you will know it has stopped
There is no single moment when a site is declared safe forever. What you can see is evidence building up over time. No new files appear where they should not. No unknown accounts turn up. The configuration does not change on its own. The scanner and the host stay quiet, and Google’s reports show nothing new.
If anything does reappear after our work, the fact that file changes were being watched means it can be traced to its source rather than leading to a fourth round of guessing. That is the real difference between a cleanup and a fix: the second one leaves you able to see what happens next.
We will also tell you plainly if we think the site’s setup makes further reinfection likely. A site that depends on a plugin with no maintained replacement, or a hosting account shared with sites nobody is willing to clean, may need a decision from you rather than more cleanup from us. Sometimes the honest recommendation is to retire an old install, move a site to its own account, or replace a feature with something that is still supported.
A note on blame
Owners in this situation often feel that the previous person did a bad job. Sometimes that is true. More often, the earlier cleanup removed what it could see and nobody had the time or brief to look at the whole account, the scheduled tasks, or the office computers. We are not interested in pointing fingers. We are interested in finding the one thing that was missed, because that is what stops the cycle.
Getting this looked at
If your site has been hacked more than once, send us the address and a short note of what keeps returning. On WhatsApp, the quickest way to be seen is to begin your first message with the word HACKED. Before anything is changed, the site is backed up; then you get a straight account of what we found and a realistic start point, with updates as the work moves along. If you also want to know exactly how the attacker got in the first time, a written hack investigation can run alongside the cleanup.