WordPress Site Hacked? What to Do First, Step by Step

Finding your WordPress site hacked overnight is one of the worst surprises a business owner can get. Maybe a customer told you your site redirects to a casino page, maybe Google is showing a red warning, or maybe your host just suspended your account. I clean up hacked WordPress sites regularly, and the good news is that almost every one can be recovered. The bad news is that the first few decisions you make matter a lot.

In this guide I'll walk you through exactly what I do, in the order I do it, so you can either handle it yourself or know what to expect from whoever you hire.

WordPress site hacked? Signs to look for

Hacks are not always obvious. Attackers often hide their work so the site looks normal to you, the logged-in owner, while visitors and search engines see something else. Common signs include:

• Redirects: visitors, often only on mobile or only when arriving from Google, get sent to spam, pharmacy, casino or fake prize pages.
• Strange search results: searching "site:" plus your domain on Google shows pages you never created, often in Japanese or full of product keywords.
• Browser or Google warnings: "This site may be hacked" in search results, or a full red "Deceptive site ahead" screen in Chrome.
• New admin users you don't recognise in the Users screen.
• Host emails about malware, spam being sent from your account, or unusually high resource use.
• Unexplained changes: new plugins you didn't install, modified footer links, pop-ups, or a homepage that has been replaced entirely.
• A sudden traffic drop in Search Console or your analytics with no other explanation.

If you see one or more of these, treat it as a WordPress site hacked until proven otherwise, and work through the steps below.

Step 1: Stay calm and don't start deleting things

The instinct is to log in and start removing anything that looks odd. Resist it. Deleting random files can break the site, destroy evidence of how the attacker got in, and leave the real backdoor untouched. Hacked sites very often contain several backdoors, and the visible damage is rarely the whole story.

Instead, write down what you've noticed and when, including screenshots of any warnings. That timeline is useful later when you look through logs.

Step 2: Take a full backup of the hacked site

Yes, back up the infected site. Before any clean-up, I always take a complete copy of the files and the database. It means that if something goes wrong during cleaning, you can return to the starting point, and it preserves evidence for working out the entry point.

Most hosting control panels let you download a full backup. Keep it clearly labelled as infected and never restore it to a live server as-is.

If you have older backups, check their dates. A clean backup from before the hack can be a shortcut, but only if you know when the infection started and you're willing to lose any orders, posts or form entries made since then.

Step 3: Lock down every way in

Assume every password connected to the site is compromised. Change them, ideally from a different, trusted computer in case your own device is the source of the leak:

• All WordPress administrator accounts, and remove any admin users you don't recognise.
• Your hosting control panel account.
• FTP and SFTP accounts.
• The database password (which then needs updating in the wp-config.php file).
• Your domain registrar and the email account connected to it.

Also regenerate the WordPress security keys and salts in wp-config.php. This logs out everyone, including an attacker holding a stolen session.

If you have trouble getting into your hosting or domain accounts because someone else set them up, my post on what to do when your web developer disappears explains how to regain control.

Step 4: Tell your host and check the scope

Contact your hosting provider. Good hosts can tell you which files they flagged, whether other sites on the same account are affected, and sometimes share access logs. If you run several websites on one hosting account, check all of them: infections spread easily between sites that share an account.

This is also the point to decide whether to put the site into maintenance mode. If it is actively redirecting visitors to scams or serving malware, taking it offline briefly protects your customers and your reputation.

Step 5: Find and remove the malware

This is the technical heart of the job. My usual process looks like this:

Replace WordPress core files

WordPress core files should never be edited, so I replace them all with fresh copies of the same version from WordPress.org. This removes anything injected into core in one step.

Reinstall plugins and themes from clean sources

I delete every plugin and theme folder and reinstall them from the official directory or the developer's site. Any plugin or theme that came from a "nulled" or free-download site of a premium product gets removed permanently; these are one of the most common ways malware arrives.

Check the uploads folder

The uploads folder should contain images and documents, not PHP files. Any PHP file hiding in there is a strong warning sign and usually a backdoor.

Inspect the database

Many infections live in the database: injected scripts in posts, widgets or theme options, spam pages, or hidden admin users. I search for suspicious script tags, unfamiliar external domains and recently created users.

Check the files outside WordPress

Look at the .htaccess file, any files in the root of the hosting account, and scheduled tasks (cron jobs) in the control panel. Attackers like to add rules that redirect only mobile or search-engine visitors, and cron jobs that quietly reinfect the site after you clean it.

Security scanner plugins are useful for a first look, but they miss things, especially custom or heavily disguised code. Manual review is what makes the clean-up stick.

Step 6: Close the hole the attacker used

A clean-up without finding the entry point is a temporary fix. In my experience the usual reasons a WordPress site gets hacked are:

• Outdated plugins or themes with known vulnerabilities.
• Nulled premium plugins that shipped with malware built in.
• Weak or reused passwords, especially on admin and hosting accounts.
• Abandoned plugins that no longer receive security fixes.
• Shared hosting cross-contamination from another infected site on the same account.
• Old PHP versions that are no longer supported.

Access logs, file modification dates and the timeline you wrote down in step 1 usually point to the culprit. Once you know it, update, replace or remove whatever let the attacker in.

Step 7: Get Google warnings removed

If Google flagged your site, open Google Search Console and check the Security Issues report. Once you're confident the site is clean, request a review from that report and briefly explain what you fixed. Google's own guide to the Security Issues report explains the process.

Also check for spam pages the hackers created. Remove them so they return a "not found" or "gone" response, and use the Removals tool in Search Console if they're appearing in results. If you haven't set up Search Console yet, my guide on how to index your website on Google covers it.

Step 8: Harden the site so it stays clean

Once the site is clean and the entry point is fixed, I put a few protections in place:

• Two-factor authentication for every administrator.
• Only the users who need admin rights keep them; everyone else gets a lower role.
• Login attempt limits and a web application firewall.
• Correct file permissions, and file editing turned off inside the WordPress dashboard.
• Automatic, off-site backups kept for at least a few weeks, so you always have a clean version to go back to.
• Uptime and file-change monitoring so you hear about problems before your customers do.

WordPress publishes its own official hardening guide if you want to go further.

Should you fix a hacked WordPress site yourself or hire help?

If you're comfortable with a hosting control panel, file manager and database tools, and the infection is simple, you can follow the steps above yourself. Where I'd strongly suggest getting help:

• The site takes payments or stores customer data.
• It has been reinfected after a previous clean-up.
• Google or your host has already blacklisted or suspended it.
• You can't tell which files are legitimate and which aren't.

That's exactly the work I do with my WordPress malware removal service: full clean-up, fixing the entry point, getting warnings removed and hardening the site afterwards.

How to stop your WordPress site being hacked again

Most hacks I clean up come down to neglect rather than sophisticated attacks: plugins left unupdated for months, a forgotten admin account, no backups. Regular website maintenance covering updates, backups, security monitoring and uptime checks removes most of that risk. It costs far less in time and stress than recovering from a hack.

Frequently asked questions

Will I lose my content if my WordPress site is hacked?

Usually not. Most malware is added to your site rather than replacing your content, so careful cleaning keeps your pages, posts, products and orders. That's why taking a full backup before you start, and not deleting files at random, is so important.

Can I just restore an old backup?

Sometimes, but only if you're sure the backup predates the infection and you're willing to lose changes made since. Even then, you still need to change passwords and fix the original weakness, otherwise the attacker can get straight back in.

How long does it take Google to remove a hacked site warning?

After you request a review in Search Console, Google typically processes it within a few days, though it can take longer. The review only succeeds if the site is fully clean, so check thoroughly before you submit.

Is a security plugin enough to protect my site?

A good security plugin helps, but it isn't a replacement for keeping WordPress, plugins and themes updated, using strong passwords with two-factor login, and keeping off-site backups. Security works best in layers.

Why does my site keep getting hacked again after cleaning?

Repeat infections almost always mean a backdoor was missed or the original entry point was never fixed. Hidden PHP files in uploads, malicious cron jobs and leftover nulled plugins are the usual suspects.

If you've found your WordPress site hacked and you'd like it handled properly, get in touch and tell me what you're seeing. I'll take a look and explain the next steps.