Knowledgebase

WordPress is the most widely used Content Management System (CMS) globally, powering over 33% of all websites. However, its popularity also makes it a frequent target for hackers and malicious actors seeking to exploit websites for various purposes.

Some of the common tactics used include:

• Distributing cracked themes and plugins online: Only the attackers know what changes they’ve made to these files. By installing such themes or plugins, you unknowingly give them access to your website.

• Brute-forcing weak login credentials: Attackers often try to log into WordPress sites using simple or commonly used passwords.

• Exploiting known vulnerabilities in outdated themes, plugins, or server configurations. At Nairahost, we stay informed about emerging security threats and implement multiple layers of protection — including premium-level safeguards — to minimize server vulnerabilities.

If your website becomes compromised, follow these steps to clean it up:

1. Back up your website.

2. Remove all files except the wp-config.php file and the wp-content folder.

3. Download a fresh copy of WordPress from wordpress.org and upload it.

4. Update WordPress, themes, and plugins from the dashboard.

Below, we’ll go over each step in detail.

1. Back up the website
Create a full backup of your WordPress site by using a plugin like UpdraftPlus or by manually downloading your website files and database through cPanel. This ensures you can restore your site if anything goes wrong during cleanup.

2. Remove all files except wp-config.php and the wp-content folder
a. Log in to your cPanel, open File Manager

b. Go to the directory where your WordPress is installed — for example, wp.rawle-engineering.xyz.

c. Delete all files and folders except wp-content and wp-config.php. (Refer to the video below for guidance.)

Note: Keep the wp-content folder because it contains your themes, plugins, and uploaded files. The wp-config.php file must also be retained, as it holds your database connection details.

3. Next, Download the latest version of WordPress from wordpress.org/download.

a. Upload the downloaded WordPress zip file to your cPanel using File Manager, then extract its contents into your WordPress installation directory.

b. After extraction, a new folder named wordpress will appear. Open this folder and delete the wp-content folder inside it. Then, move all the remaining files from the wordpress folder into your main WordPress installation directory. (Refer to the video below for visual guidance.)

c. Finally, create a new file named .htaccess in your WordPress installation directory and add the following code to it:

RewriteEngine On
RewriteCond %{HTTPS} off
RewriteRule ^(.*)$ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]


# BEGIN WordPress

RewriteEngine On
RewriteBase /
RewriteRule ^index\.php$ - [L]
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule . /index.php [L]

# END WordPress

4. Update WordPress, themes, and plugins from the dashboard
Once you’ve completed the cleanup and restored your site files, log in to your WordPress admin dashboard.

First, update WordPress to the latest version, then update all your themes and plugins to ensure you’re running the most secure and stable versions.

After updates are complete, go to the Plugins section and re-enable your plugins. You may need to reconfigure their settings to ensure everything works properly after the clean installation. This step restores your website’s functionality and helps prevent future security issues.