You paid to clean the hacked site. Or maybe your developer “fixed it” in an afternoon. The weird redirect disappeared, the spam pages vanished, and everything looked normal again.
Then two weeks later? Same mess. Maybe worse.
That usually means the cleanup wasn’t really finished. It was cosmetic. The obvious junk got removed, but the reason the attacker got in – or stayed in – was still sitting there quietly.
And that’s the part that drives small business owners mad. You think you’ve dealt with it. You move on. Then the site gets hit again and now you’re paying twice for the same problem. Big mistake.
A cleanup can remove the symptoms and miss the actual infection
Here’s the thing. A lot of “cleanups” are just file deletions.
Someone finds the visible malware, removes a few bad files, maybe restores a backup, updates a plugin, and calls it done. That can make the site look clean from the outside. But attackers don’t usually leave one neat little infected file with a label on it saying hello, I am malware.
They leave options. Backdoors in theme files. Fake admin users. Sneaky scheduled tasks. Modified .htaccess rules. Malicious code hidden inside a plugin that still appears legit in WordPress. I’ve seen infections buried in places business owners would never think to check, like wp-config.php, uploads folders, and even database entries that reload spam content later.
If you only clean what you can see, you’re not fixing the breach. You’re tidying the room while the window is still broken.
If you’re already in that situation, proper site cleaning matters a lot more than a quick patch job.
The original way in is often still wide open
This is the big one.
Your site gets hacked through an outdated plugin. The malware is removed. But the plugin stays active, still vulnerable, still outdated, still basically an unlocked side door. So the attacker – or another bot scanning the web for the exact same hole – just walks back in.
And no, this doesn’t require some genius criminal personally targeting your bakery, law office, or local repair shop. Most of this stuff is automated. Bots scan thousands of WordPress sites every day looking for old versions of common plugins, weak logins, exposed files, or abandoned themes. If your site still has the same weakness, it’ll get found again. Fast.
If that sounds familiar, read Why Your WordPress Site Keeps Getting Hacked (And How to Stop It). It explains the pattern really well.
Common leftovers after a “successful” cleanup:
- an outdated plugin that caused the problem in the first place
- a nulled or pirated theme with hidden code
- an old admin account nobody uses but never deleted
- passwords that were never changed after the hack
- bad file permissions on the server
- hosting with weak isolation or poor security
Any one of those can be enough for a repeat infection. More than one? You’re basically inviting it back.
Backdoors are why reinfection feels “mysterious”
This is where people get fooled.
The visible malware is gone, updates are done, and still the site gets compromised again. So everyone assumes the new infection came from some new attack. Sometimes that’s true. Honestly though, often it’s an old backdoor that never got removed.
A backdoor is hidden access. A secret way back in. It might be a tiny bit of obfuscated PHP code buried in a normal-looking file, or a fake plugin that lets the attacker upload more malware later. Some are annoyingly clever. Some are laughably sloppy. Both work.
And because they’re hidden, your site can look fine for days or weeks before the attacker uses that access again. That’s why reinfection often feels random. It isn’t random. It’s delayed.
For small business sites, this happens a lot after somebody restores an old backup without checking it properly. The site comes back online, everyone breathes out, but the backup already contained the backdoor. So you’ve basically restored the hack along with the website. Not ideal.
Your passwords and admin users probably didn’t get enough attention
After a hack, changing one password isn’t enough. You need to think wider than that.
WordPress admin passwords, hosting panel, SFTP, database, email accounts connected to password resets – all of it. If the attacker grabbed credentials, or created a hidden admin account, they may not need the original vulnerability anymore.
I’ve seen sites cleaned perfectly at file level and then hacked again because there was still an admin user called “support-temp” or “seo-manager” that nobody recognized. That’s not rare. That’s Tuesday.
This is also why two-factor login protection helps more than people think. For a lot of small sites, it’s one of the easiest wins. And if you want to tighten that side of things, two-factor authentication is a simple place to start.
Also worth reading: Admin account mistakes that hand hackers the keys. Plenty of business owners spot themselves in that one.
The database gets ignored all the time
Files get most of the attention because they’re visible. The database doesn’t. But WordPress stores loads of important stuff there – settings, widget content, user accounts, scheduled tasks, plugin options, injected spam, redirect rules. So if a cleanup only checks files and skips the database, that’s a half-done job.
I’ve seen reinfections caused by database entries that recreate malicious code after a plugin is reactivated. Weird, annoying, very real.
And if spam SEO pages keep reappearing even after you delete them, database junk is high on the suspect list.
Cheap hosting and messy setups make cleanup harder
Sometimes the problem isn’t just WordPress itself.
If your hosting account contains three old sites, two test installs, one forgotten subdomain, and a pile of stale files from 2021, cleaning only the live site may not solve anything. Attackers can hide in another folder on the same account and reinfect the main site later. Shared hosting setups with poor separation can be rough like that.
Same goes for old staging sites left online. Or that “new version” your developer parked in a subfolder six months ago and forgot. Those forgotten installs are favorite hiding spots because nobody checks them.
So yes, your homepage may be clean. But your /oldsite/ folder might still be radioactive.
What to actually do after a cleanup
You need post-cleanup steps. Actual ones. Not wishful thinking.
- Update WordPress core, plugins, and themes right away
- Remove anything unused – inactive plugins, old themes, abandoned installs
- Change every relevant password, not just the WordPress one
- Check all admin users and delete anything suspicious
- Scan files and database for leftovers and backdoors
- Review server folders, subdomains, and staging copies
- Set up ongoing maintenance and monitoring so you’re not guessing next month
That last one matters more than people expect. A hacked site isn’t really a one-day problem. It’s usually a sign the site has been neglected for a while, or built in a messy way, or both.
If nobody is regularly updating, checking logs, reviewing users, and watching for weird file changes, you won’t spot the next problem until customers do. That’s a terrible way to run a business website.
A proper WordPress maintenance plan helps stop the cycle. Not glamorous. But very effective.
If your site keeps getting hacked, stop treating each hack like a seperate event
That’s the mindset shift.
Repeated infections usually aren’t seperate bad luck incidents. They’re connected. Same weak point, same hidden access, same forgotten account, same neglected plugin, same sloppy hosting setup. The first cleanup didn’t fail because hackers are magic. It failed because the root cause stayed behind.
So if your site has been “cleaned” and then compromised again, don’t just ask who can remove the malware fastest. Ask what was missed the first time. Ask how they checked for backdoors. Ask whether they reviewed the database. Ask whether every password was changed. Ask whether the vulnerable plugin or theme is gone for good.
Those questions matter.
Because a cleanup that doesn’t close the hole isn’t really a cleanup. It’s a pause button.