WordPress Site Slow or Hacked? Speed Optimization & Malware Removal Guide

"My website is slow" is one of the most common messages we receive — and about one time in five, the site isn't just slow. It's infected, and the malware is spending your server's resources on someone else's business. So before optimizing anything, it pays to answer one question first: is this a performance problem, or a security problem?

Quick answer: if your site is slow and shows any other odd behaviour — strange redirects, unknown admin users, warnings in Google — treat it as hacked and clean it first (steps below). If it's purely slow, the fix is a short list applied in order: better hosting, full-page caching, optimized images, and a current PHP 8. Optimizing an infected site is polishing a leaking boat.

1. Signs Your WordPress Site Has Been Hacked

Malware tries to stay invisible — its job is to use your site quietly. But it always leaves fingerprints. Take any of these seriously:

• Redirects you didn't create — visitors (often only on mobile, or only from Google) land on pharmacy, casino or "your device is infected" pages.
• Google turns against you — "This site may be hacked" under your listing, spam pages ranking under your domain, or a red warning screen in browsers.
• Users you never made — a new administrator account is the classic backdoor.
• Files changed on dates you didn't work — especially new PHP files in wp-content/uploads, a folder that should contain only media.
• The site slows to a crawl — spam-sending and crypto-mining scripts burn CPU around the clock.
• You're locked out — attackers change admin passwords to keep the site to themselves. (Recovery steps are in our login guide.)

2. Malware Removal, Step by Step

1. Back up the infected site. It sounds backwards, but you want a copy — it's evidence of what happened and insurance against the cleanup going wrong.
2. Scan everything. A reputable scanner flags known malware signatures in files and the database. Treat the scan as a map, not the full territory — new malware evades signatures.
3. Replace, don't clean. Delete WordPress core files and reinstall the same version from wordpress.org. Do the same for every plugin and theme from official sources. Fresh files can't be infected files.
4. Hunt the leftovers. Anything that isn't core, a known plugin, a known theme, or your media needs a reason to exist. PHP files in uploads, files with scrambled names, and code beginning with eval(base64_decode( are all malware until proven innocent.
5. Clean the database. Injected <script> tags in posts, rogue admin users, and strange scheduled tasks all live in the database, where file replacement can't reach.
6. Change every credential. WordPress passwords, database password, FTP, hosting panel — assume the attacker read them all. Then update WordPress, every plugin and every theme, because an outdated one was probably the door.
7. Tell Google you're clean. If Search Console flagged the hack, request a review once the cleanup is done — the warning doesn't disappear on its own.

Honest note: step 4 and 5 are where do-it-yourself cleanups fail. Miss one backdoor file and the site is reinfected within days. If the site matters, this is the one job worth handing to professionals — see our manual malware removal service, where we guarantee the cleanup.

3. Speed Optimization That Actually Works

Once the site is clean (or was never infected), speed comes from four levers. Pull them in this order — each one matters more than everything below it:

1. Hosting. No plugin can fix a crowded shared server. A site that stays slow after every optimization is telling you it needs dedicated resources — this is exactly why we run clients on managed VPS hosting.
2. Full-page caching. A cached page is served in milliseconds without running PHP at all. One well-configured cache plugin (or server-level caching like LiteSpeed) typically transforms load times overnight.
3. Images. The heaviest thing on most pages. Compress them, serve modern formats like WebP or AVIF, and lazy-load everything below the first screen.
4. PHP 8. Simply moving from PHP 7.4 to a current PHP 8 makes every uncached page meaningfully faster — one setting in your hosting panel, tested on staging first.

After the big four: keep only plugins you use (each adds weight), enable Redis object caching for WooCommerce stores, and put a CDN in front for a global audience. Measure before and after with PageSpeed Insights so improvements are facts, not feelings — or let our speed optimization service do the full stack for you, reports included.

4. Cache-Related Issues: When Caching Fights Back

Caching is the best speed tool and the most common source of "my site is broken but only sometimes" reports. The classic symptoms: you update a page and the live site shows the old version; logged-in users see someone else's content; forms and carts behave strangely. The rule that untangles all of it — caches stack in layers, and every layer must be cleared: the plugin cache, the server cache (LiteSpeed, Varnish, NGINX), the CDN (Cloudflare), and finally your own browser. And dynamic pages — cart, checkout, login, account — must be excluded from page caching entirely, which is the root of half the store problems in our WooCommerce guide.

5. Security Hardening: Staying Clean

Cleanup without hardening is an invitation to do it all again. The essentials are unglamorous and effective:

• Update weekly — outdated plugins are how the vast majority of WordPress sites get hacked.
• Two-factor authentication on every admin account, and no account named "admin".
• Fewer plugins, better plugins — abandoned plugins never get security patches. Replace them.
• Real backups — automatic, daily, stored off the server, and test-restored at least once.
• A firewall and file monitoring — so the next attempt is blocked, and if anything changes, you know the same day.

Hacked Site? That's an Emergency — Treat It Like One.

Every hour an infected site stays online, it damages your Google reputation and your visitors' trust. Malware removal and speed optimization are core WordPressFix services: we clean the infection, close the hole that let it in, harden the site, and make it faster than it was before the hack.

Open the HELLO FIX live chat in the bottom-left corner — hacked sites and down sites jump our queue. Or email hello@wordpressfix.org with your URL and what you're seeing.

Speed & Security FAQs

Keep Reading

• Fix WordPress errors: 500, database, fatal & memory errors
• Fix WooCommerce cart, checkout & shop page problems
• Find and fix plugin & theme conflicts (including Elementor)
• Locked out of WordPress admin? Fix login & permission issues
• Hacked? Manual malware removal & security monitoring service
• WordPress speed optimization service — before/after reports
• WordPress migration & backup — zero-downtime host or domain moves
• The complete website repair & WordPress fix guide