How to Clean Up and Secure My Hacked WordPress Blogs?

Start by checking your `/wp-content/uploads/` and `/wp-content/themes/` directories for any strange PHP files, especially those with recent timestamps. You can access this through your hosting file manager or SSH. Don't forget to look at your `.htaccess` file; hackers often mess with that to create redirects. It's crucial to clean up any malicious entries before going further.

First off, block those spam URLs with your `.htaccess` file or consider using a service like Cloudflare since those URLs often follow a pattern that makes them easy to identify. You might also want to revert to a clean backup, but be aware that these hacks can lay dormant, so it may not be as simple as it seems. Also, reset all admin passwords and ensure there are no leftover unauthorized accounts. If you're familiar with WP-CLI, you can reinstall plugins and themes quickly.

To get rid of the spam, zip your website folder and export your SQL database. Create a virtual machine on your PC and unpack the files. Use VS Code to search for any malicious code snippets or anomalies like hidden iframes. Check your `wp_posts` for suspicious posts in Japanese or unusual scripts. Don't forget to use Google Search Console to disavow those nasty URLs. Make sure to update your PHP version and ensure all your plugins are current—outdated ones are often an easy entry for hackers!