By RyskenUpdated 3 min read
Finding out your WordPress website has been hacked is stressful, and the instinct is to start deleting things immediately. Resist it. A methodical response protects your visitors, preserves the evidence you need to understand what happened, and makes it far less likely the attacker simply walks back in. This guide walks through the process we recommend.
Signs your WordPress site may be hacked
- Visitors are redirected to unfamiliar or spammy websites, often only from search results or on mobile.
- Google, your browser or your host shows a malware or deceptive-site warning.
- Pages, links or products you did not create appear, sometimes only visible to search engines.
- Administrator accounts you do not recognise, or you are suddenly locked out.
- Your hosting provider suspends the site or reports unusual resource use or outbound email.
- Core, plugin or theme files have changed unexpectedly.
Step 1: Contain the damage
Put the site into maintenance mode, or restrict access at the host or firewall, so visitors are not exposed while you work. If the site handles payments or personal data, tell the relevant people early; delays make things worse.
Step 2: Take a full backup (yes, of the infected site)
Copy the files and database exactly as they are. This is your evidence: it lets you work out how the attacker got in and lets a specialist analyse the infection. Store it somewhere offline and do not restore it onto a live site.
Step 3: Lock the attacker out
Change passwords for WordPress administrators, hosting, SFTP/SSH, the database and any connected services, and rotate the keys and salts in wp-config.php. Remove administrator users you do not recognise and reset all remaining sessions. Do this from a clean device.
Step 4: Identify what was changed
Compare WordPress core files against the official release, review recently modified files, and look at plugins and themes you do not recognise. Check the database for injected content, and check scheduled tasks and the uploads folder, where PHP files should not normally exist. Attackers often leave several backdoors, so finding one file is rarely the end of the job.
Step 5: Remove the malware properly
Replace WordPress core, plugins and themes with fresh copies from trusted sources rather than editing infected files by hand. Remove malicious code from custom files and the database, and delete abandoned plugins and themes entirely. If you are unsure what is safe to delete, this is the point to bring in an expert; our WordPress malware cleanup service covers exactly this stage.
Step 6: Find and fix the entry point
Most compromises come through a vulnerable plugin or theme, stolen or weak credentials, or an insecure hosting configuration. If you do not close that door, cleaning is temporary. Update everything, remove what you do not use, and review the vulnerabilities that were present. A vulnerability remediation engagement turns that list into verified fixes.
Step 7: Restore search and visitor trust
If Google flagged the site, request a review in Search Console once it is genuinely clean. Remove spam pages from the index, resubmit the sitemap, and check that the site is no longer on blocklists. Be honest with customers if their data may have been affected.
Step 8: Harden and monitor
Apply least privilege to users, enforce strong authentication, restrict file permissions, keep automatic updates sensible, and schedule off-site backups. Our hardening checklist lists the controls that matter most, and WordPress hardening can apply them for you.
When to call a professional
Bring in a specialist if the site is re-infected after cleaning, holds customer or payment data, is business critical, or you cannot explain how the attacker got in. A good clean-up ends with a written summary of what was found, what was removed, how the attacker entered and what has changed to prevent a repeat. If that is what you need, get in touch.
