Website has been hacked and they have injected javascript into every single post, page and product (woocommerce) - Editing every page manually would take for ever, we have over 3000 posts.

Is there a simple find and replace we could use to remove this javascript?

1 Answer 1


Do you have SSH access? WP-CLI via search-replace.

$ wp search-replace '<script>bad javascript code</script>' '' --precise

By default, this only searches for tables registered in $wpdb. To overwrite this behaviour, you can use either the --all-tables or --all-tables-with-prefix flag. (Or pass table names to the command manually.)

Alternative: Easiest would be to download a dump, search/replace in that file and finally import again.

  1. Download complete db backup
  2. search & replace with your favourite text editor, replacing <script>bad javascript code</script> through an empty string
  3. Delete tables
  4. Upload your edited backup
  • Yes, I think that would be the quickest, although DB pretty large so could cause problems when trying to open it. Will give it a shot. Thank you.
    – Rob
    Sep 21, 2017 at 14:08
  • Depending on your OS, there are solutions for this
    – kero
    Sep 21, 2017 at 14:09
  • 1
    Not that wp search-replace only searches in tables registered to the $wpdb object. If a plugin creates a table that isn't registered there, it won't get searched.
    – Flimm
    May 7, 2021 at 17:27

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.