This question already has an answer here:

My wordpress blog has been hacked. Any page that I got to it shows the page html that hacker put in some where. I am not wordpress expert but it looks like hacker put the code somewhere (in database or file system). Can someone point out where should I look at to remove that hacker code?

marked as duplicate by Michael Hampton, Zoredache, Stefan Lasiewski, MadHatter, mfinni Apr 2 '13 at 18:33

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.


Best place to start is with docs and resources from WordPress itself.

Work your way through these resources and follow all instructions to completely clean your site or you may be hacked again. See FAQ: My site was hacked « WordPress Codex and How to completely clean your hacked wordpress installation and How to find a backdoor in a hacked WordPress and Hardening WordPress « WordPress Codex.

Change all passwords. Scan your own PC. Use http://sitecheck.sucuri.net/ before and after.

Tell your web host you got hacked; and consider changing to a more secure host: Recommended WordPress Web Hosting

Not the answer you're looking for? Browse other questions tagged or ask your own question.