Why your WordPress site keeps getting hacked (and how to stop it)

Few things are more demoralising than cleaning a hacked WordPress site, breathing out, and finding it reinfected a few days later. It feels like the attacker is personally targeting you. Almost always, they are not. Repeated reinfection is a near-certain sign of one thing: the clean-up removed the symptom but left the cause behind.

You cleaned the output, not the infection

When a site is compromised, the thing you notice — the spam pages, the redirect, the injected popup — is the output. Underneath it are two things that actually keep the site infected: the entry point the attacker used to get in, and one or more backdoors they planted to get back in whenever they like. Delete the visible spam and the backdoor simply regenerates it. Patch nothing and the entry point lets a fresh attacker walk in again. The hack “comes back” because it never really left.

Where the persistence hides

Backdoors are designed to survive a casual clean-up. The usual hiding places:

• Added files with innocent-looking names dropped into wp-content/uploads, plugin folders, or the theme — often a single line that lets the attacker run any code they send.
• Injected snippets buried inside otherwise-legitimate core or plugin files, so the file looks like it belongs.
• Hidden admin users, or a normal-looking account quietly given administrator rights.
• Malicious scheduled tasks (WordPress cron jobs) that re-download the malware on a timer, so deleting the files fixes nothing.
• A second vulnerable plugin you never patched, giving a completely separate way back in.
• Stolen credentials — if an FTP or database password leaked, the attacker doesn’t need a backdoor at all.

Why your scanner keeps missing it

Many malware scanners work by matching files against a list of known-bad signatures. That is fine for commodity malware, but backdoors are frequently custom, obfuscated, or just a few characters tucked into a real file — nothing for a signature to match. This is why a site can scan “clean” and reinfect anyway. The reliable way to find this class of threat is file integrity monitoring: comparing every core, plugin, and theme file against a known-good baseline so that anything added or altered stands out, whether or not a scanner has seen it before.

How to actually break the cycle

Stopping reinfection means closing every path at once, in a single clean-up:

1. Remove every backdoor, not just the visible payload — use an integrity check to find the added and modified files.
2. Close the entry point: update or remove the vulnerable plugin that let them in.
3. Rotate every credential and your wp-config.php keys and salts, in case a password leaked.
4. Check scheduled tasks and the user list for anything that regenerates the infection.
5. Put a firewall in front of the site so the same attack is blocked before it reaches your plugins next time — and keep integrity monitoring on so you’d know within hours if anything changed.

If you’ve already cleaned this site more than once, that is the clearest signal the backdoor is still there. A done-for-you cleanup from DefendMyWP finds and removes every backdoor, closes the entry point, and leaves the firewall and integrity scanner running so it stays clean — with a year of the plugin included. See hacked WordPress site cleanup, or read what to do the moment you find a hack.