Me hackearon WordPress — cómo limpiarlo de forma segura

1. Confirma que realmente está comprometido

Signs of a hack include: unexpected admin accounts, spam pages appearing on your site, your host or Google Search Console flagging malware, visitors getting redirected elsewhere, or your site suddenly sending spam email. Start with a escaneo gratis to check for outdated, vulnerable software and exposed files — the entry points attackers use most often.

2. No borres archivos a mano primero

It's tempting to start deleting anything that looks suspicious. The problem: without a backup taken first, you can't undo a mistake, and malware often hides copies of itself in more than one place — including outside the WordPress folder entirely, in other directories on the same hosting account, where a manual cleanup won't think to look. Miss one copy and the site gets reinfected within days.

3. Haz un backup antes de tocar nada

Whatever cleanup method you use, take a full backup first — of files and database — before making any change. That backup is your undo button if a fix breaks something or misses part of the infection.

4. Cómo funciona la reparación con IA de WP Clinic

Once the free plugin is installed and connected, a deep scan checks your entire hosting account (not just the WordPress install) for malware signatures, webshells, PHP files planted in your uploads folder, injected content and suspicious admin accounts. If it finds something, the repair flow is:

1. Primero se toma un backup externo, antes de tocar cualquier archivo.
2. La IA analiza el código malicioso y genera un parche puntual — no se ejecuta en tu servidor ni obtiene acceso de shell; el parche se genera y se aplica mediante código auditado.
3. Se aplica el parche y luego una verificación de salud confirma que el sitio sigue cargando y funcionando.
4. Si la verificación de salud falla, el sitio se restaura automáticamente al backup previo a la reparación — sin necesidad de intervención manual.

Large infections are cleaned in batches against a repair budget, so a heavily compromised site can be repaired in more than one pass rather than timing out.

5. Cambia tus contraseñas

After a confirmed compromise, rotate your WordPress admin password, hosting/FTP password and any API keys or application passwords that could have been exposed. If the malware had file-level access, assume anything readable on disk (including wp-config.php) may have been read.

6. Previene el próximo ataque

Most WordPress infections come in through an outdated plugin or theme with a known vulnerability, a weak admin password, or a nulled (pirated) plugin with a backdoor built in. Keep everything updated, use unique strong passwords, avoid nulled plugins entirely, and turn on ongoing monitoring so new vulnerabilities are caught before they're exploited — see the lista de verificación de seguridad for the full list.