TL;DR
Most WordPress compromises begin with an outdated or abandoned plugin. The fix is not a single tool. It is a monthly routine: inventory what is installed, remove what is unused, update what remains, and keep an offline backup you have actually tested.
Why plugins are the entry point
The WordPress core is maintained by a large team and updates quietly. Plugins are written by thousands of separate authors, and some of them stop maintaining their code entirely. When a vulnerability is published for a plugin, automated scanners start probing every site that runs it within hours.
The risk is not only old plugins. A plugin that has not been updated in two years may still work, which is exactly why it stays installed on a live site long after the author walked away.
Warning signs worth acting on
- A plugin with no update in over twelve months that still touches logins, uploads or payments
- Any plugin that has been removed from the WordPress repository but is still running
- Administrator accounts nobody recognises, or a user count that grew without a hire
- New files in the uploads directory, or scheduled tasks you did not create
- Search results showing pages you never published, usually pharmaceutical or casino spam
A monthly routine that holds
Take an inventory first. List every plugin, its last update date and who owns it. Anything nobody can explain gets removed, not disabled. Disabled plugins still sit on disk and still count as code you are not watching.
Then update in a staging copy before production, keep automatic core updates on for minor releases, and remove file editing from the dashboard by setting DISALLOW_FILE_EDIT. Add a web application firewall in front of the site so known exploit requests are blocked before they reach WordPress.
Backups only count if a restore has been tested. Keep an off site copy and run a restore into a throwaway environment at least once a quarter.
If the site is already compromised
Do not start by deleting files you do not recognise. Take a full snapshot first, because it is the only evidence you will have. Rotate every password and every API key, including database, hosting, payment and email credentials.
Then rebuild from a known clean copy of core, theme and plugins, and reinstall from your own repository rather than from whatever is currently on the server. Recheck the database for injected rows and scheduled tasks before pointing traffic back at it.