WordPress Hacked on Hostinger — Step by Step Fix (2026)

Your WordPress site on Hostinger has been hacked. You might be seeing a suspended account, spam content appearing on your pages, visitors being redirected to unknown sites, or a warning in Google Search Console. Whatever the symptom, the process for identifying and removing the infection is the same.

This is the complete step by step guide — from identifying what happened to getting your account reinstated and making sure it does not happen again. If you need hands-on malware removal or wordpress emergency support while you work through it, WPOPS can take over. For the wider context of why your host won't fix the infection for you, see that guide first.

Step 1 — Identify What Type of Attack You Are Dealing With

Different attacks require slightly different approaches. Before starting the cleanup, identify what you are actually dealing with.

• Spam redirect hack — visitors arriving from Google or on mobile devices are redirected to spam, pharmaceutical, or adult content pages. You may not see the redirect yourself because it only triggers for specific traffic sources. Check your site by searching your domain on Google and clicking the result, or use a mobile device on cellular data rather than your home network.

• Japanese SEO spam hack — your Google search results show Japanese characters in the page titles and descriptions. This is a common automated attack that injects spam content into your WordPress database and creates thousands of fake pages to manipulate search rankings.

• Phishing hack — attackers have created fake login pages (bank, PayPal, email providers) inside your hosting account. You may not notice until Google Safe Browsing or your host's scanner flags it.

• Suspended account — Hostinger has detected malware and suspended the account before you noticed the symptoms yourself. The site is down and you received a suspension email.

• Malware warnings — Google Chrome or antivirus software is showing warnings when visitors try to access your site. Google Search Console has flagged the site for malware or deceptive content.

• Backdoor infection — the site appears normal but attackers have left hidden files that give them ongoing access. This is often discovered during a routine scan rather than from visible symptoms.

Step 2 — Confirm Your Access Level

Before starting any cleanup, confirm what you can still access.

Log into hpanel.hostinger.com. If your account is suspended, check whether Site Tools and File Manager are still accessible. Hostinger typically keeps these open even on suspended accounts to allow cleanup.

If hPanel access is completely locked, email abuse@hostinger.com to request temporary access. Include your domain name and account email. The same recovery path applies when Hostinger suspended the account for malware — and the process is similar if SiteGround did the same on another host.

Also check: can you still access your WordPress admin dashboard at yourdomain.com/wp-admin? If the site is suspended, this will not load. If the site is still online with malware, the admin dashboard may still be accessible.

Step 3 — Take a Full Backup Before Touching Anything

This is not optional. Before making any changes, download a complete backup.

In hPanel go to Backups — Full Backup — Download. If this option is unavailable due to the suspension, connect via SFTP and download your entire public_html folder manually.

Also export your database directly from phpMyAdmin: click your WordPress database in the left panel, then Export — Quick — Go.

Save both the files and the database export before proceeding.

Step 4 — Scan for Malware

You need to scan both the file system and the database. Most attacks leave traces in both locations.

File system scan — connect via SFTP and look for PHP files in wp-content/uploads (there should be none), recently modified files in unexpected locations, and files with names that do not match any plugin or theme you installed. Look for files named with random strings like a7f3d2.php or with names that mimic WordPress core files like wp-class-post.php.

If you can still access the WordPress admin dashboard, install Wordfence (free) and run a full scan. Wordfence compares your WordPress core files, plugins, and themes against their official versions and flags any modifications.

For database injections — log into phpMyAdmin, select your WordPress database, and click Search. Search the wp_posts table for eval(, base64_decode(, iframe, and document.write. Search wp_options for any values containing external URLs you do not recognise in SEO-related option names (common targets: home, siteurl, blogname, various SEO plugin options).

Step 5 — Remove All Malware

Delete every malicious file found. Do not edit infected files to remove injected code — download fresh copies from the official WordPress repository or plugin/theme developer and replace the files entirely.

For infected WordPress core files — download a fresh copy of the same WordPress version at wordpress.org/download/releases and replace the infected files. Do not replace wp-content (your themes, plugins, and uploads are here) or wp-config.php.

For infected plugin files — download the clean version from wordpress.org/plugins and replace the plugin folder entirely via SFTP.

For infected theme files — same process. Replace from the official theme source.

For database injections — use phpMyAdmin to run SQL queries to remove injected content. For the Japanese SEO hack specifically, you may need to search for and delete thousands of injected posts — this can be done with a targeted SQL DELETE query rather than manually.

For backdoor files — delete any PHP files found in wp-content/uploads, and any files with random-string names anywhere in your install.

Step 6 — Change All Credentials

After removing the malware, change every password and credential associated with the site.

• WordPress admin password — go to Users in your WordPress dashboard and update the password for every admin account. Delete any admin accounts you do not recognise.

• Database password — generate a new password in hPanel under Databases — MySQL Databases, then update the DB_PASSWORD line in wp-config.php to match.

• WordPress security keys — generate new keys at api.wordpress.org/secret-key/1.1/salt/ and replace the existing keys in wp-config.php. This invalidates all existing login sessions, logging out any attacker who may still have an active session.

• Hostinger account password — change at hpanel.hostinger.com under Profile — Security.

• FTP/SFTP password — change in hPanel under Files — FTP Accounts.

Step 7 — Update Everything and Remove Unused Plugins

Before contacting Hostinger's abuse team, update WordPress core, all plugins, and all themes to their latest versions.

Also do the following:

• Remove any plugins you are not actively using — deactivated plugins are still exploitable

• Remove any nulled or pirated themes or plugins entirely — these are frequently pre-infected with backdoors

• Check for and remove any plugins that have not been updated in over 12 months and have known vulnerabilities

• Verify you recognise every admin user account and delete any you did not create

Step 8 — Harden the Installation

Before going back online, close the doors the attacker used.

• Install a firewall — Wordfence (free) or Cloudflare blocks known malicious IP ranges and brute-force login attempts.

• Set correct file permissions — folders should be 755, files should be 644, wp-config.php should be 600. Set these in hPanel File Manager or via SFTP.

• Limit login attempts — Wordfence or Login LockDown prevents brute-force password attacks.

• Disable PHP execution in uploads — add a .htaccess file to wp-content/uploads containing "deny from all" for PHP execution. This prevents attackers from uploading and executing PHP backdoors even if they regain access.

• Enable two-factor authentication — on your WordPress admin account and your Hostinger hPanel account.

Step 9 — Contact Hostinger's Abuse Team

Keep it concise: "I have removed all malicious files and database injections, updated WordPress core and all plugins, changed all credentials, and hardened the installation. Please review the account for reinstatement."

Hostinger's abuse team typically responds within a few hours and reinstates clean accounts within 24 hours.

• Your Hostinger account email and domain name

• A summary of what was found and removed

• Confirmation that all software is updated and credentials changed

• A request for account review and reinstatement

Step 10 — Submit a Google Review Request if Needed

If Google flagged your site in Search Console, submit a review request once the site is clean.

In Google Search Console go to Security Issues — Request a Review. Describe what was found and removed. Google typically removes malware warnings within 24-72 hours of a confirmed clean site review.

If your domain was blacklisted by Google Safe Browsing, the warning in browsers will clear automatically once Google re-crawls and confirms the site is clean after the review.

How to Prevent This From Happening Again

If your site has been hacked on Hostinger, the vulnerability that allowed the attack is almost always an outdated plugin. Attackers scan millions of WordPress sites automatically, looking for sites running vulnerable plugin versions. When they find one, the exploit is automated.

Three things prevent this from recurring:

Staged plugin updates — every plugin update is applied to a staging copy first and tested before going live. If an update is buggy or triggers a conflict, it is caught on staging. If a plugin has a known vulnerability, it is patched before attackers can exploit it on your live site.

Daily off-site backups — stored separately from your Hostinger account. If the worst happens, restore to a clean point in minutes rather than spending hours on a manual cleanup.

Continuous security monitoring — active scanning that catches infections early, before they trigger a hosting suspension or Google blacklisting.

Every care plan and WPOPS care plans include all three from $49/month, plus ongoing wordpress maintenance so prevention is not a one-off project. One hacked site costs more in time and stress than a year of prevention.

Frequently Asked Questions

How do I know if my WordPress site on Hostinger has been hacked?

Common signs include: visitors being redirected to spam or adult content pages (especially from Google or mobile); Japanese characters appearing in your Google search results; Hostinger suspending your account for malware; Google Search Console showing security issues or manual actions; antivirus warnings when visitors try to access your site; or admin accounts you do not recognise in WordPress Users.

Will Hostinger fix my hacked WordPress site?

No. Hostinger manages hosting infrastructure, not WordPress applications. They will suspend your account when they detect malware to protect other customers, keep hPanel access open for cleanup, and reinstate the account once you confirm it is clean — but the actual malware removal is your responsibility.

How long does it take to clean a hacked WordPress site on Hostinger?

A straightforward infection — infected plugin files and no database injections — can be cleaned in 2-3 hours. Complex infections with multiple backdoors, database injections, or infections spread across multiple sites on the same account take longer. Hostinger account reinstatement typically takes 24 hours after submitting a cleanup confirmation to abuse@hostinger.com.

What is the Japanese SEO spam hack?

The Japanese SEO spam hack injects thousands of spam pages with Japanese content into your WordPress site to manipulate search rankings for pharmaceutical and other spam keywords. It appears in your Google search results as Japanese characters in page titles. It typically involves both file injections and database injections and requires a full scan of both to clean completely.

Can I prevent my Hostinger WordPress site from getting hacked again?

Yes. Keep all plugins and themes updated — ideally tested on staging before going live. Install a WordPress firewall. Set up daily off-site backups. Remove unused plugins entirely. Enable two-factor authentication on both WordPress and your Hostinger account. These measures eliminate the vast majority of attack vectors.

My Hostinger site keeps getting hacked even after cleaning — why?

The most common cause is a missed backdoor file, usually in wp-content/uploads or disguised as a theme file. The second most common cause is an unpatched vulnerability — the same plugin that allowed the first infection is still outdated. A proper cleanup requires replacing all infected files with clean versions from official sources, not editing them, and verifying no PHP files exist in the uploads folder.

By Manny — Founder, WPOPS