When your WordPress site gets hacked, you need to act fast.
Do these things first, or get in touch, and we’ll help you get these sorted:
- Change all passwords immediately
- Contact your hosting provider
- document everything for GDPR purposes
- Then either restore from a clean backup or methodically remove malicious code before strengthening security to prevent future attacks
Discovering your WordPress site has been hacked is one of those gut-punch moments that every site owner dreads. One minute everything seems fine, the next you’re staring at a defaced homepage, mysterious redirects, or worse – a Google warning telling visitors your site is dangerous.
I’ve cleaned up hundreds of hacked WordPress sites over the years, and the good news is that most can be recovered. The key is knowing what to do and doing it quickly. This guide walks you through the entire process, from confirming you’ve actually been hacked through to making sure it doesn’t happen again.
How to confirm your WordPress site has actually been hacked
Before you panic, let’s make sure you’re actually dealing with a hack rather than a plugin conflict or hosting issue. Here are the telltale signs:
- Unexpected redirects – your site sends visitors to dodgy pharmaceutical sites or gambling pages
- Strange admin users – accounts you didn’t create appearing in your WordPress dashboard
- Modified files – your theme files have been changed, often with encoded gibberish at the top
- Google warnings – visitors see “This site may be hacked” or “Deceptive site ahead” messages
- Hosting suspension – your provider has taken your site offline citing malware
- Spam content – pages or posts appearing that you didn’t create
- Slow performance – your site suddenly crawls because it’s being used for cryptocurrency mining or sending spam
If you’re seeing any of these, you’ve almost certainly been compromised. Time to act.
Immediate steps to contain the damage (the first 30 minutes)
The first half hour after discovering a hack is crucial. Here’s what you need to do right now:
1. Change all passwords immediately
Start with your WordPress admin password, then move to your hosting control panel, FTP accounts, database passwords, and any connected services. Use a password manager to generate strong, unique passwords for each.
2. Contact your hosting provider
Most decent hosts have dealt with hacked sites before. They can often tell you when the compromise happened, provide clean backups, and help isolate the infection. Some will even assist with cleanup.
3. Put your site in maintenance mode
This protects visitors from malware and stops Google from indexing compromised pages. A simple maintenance plugin or even renaming your index.php file temporarily will do the job.
4. Document everything
This matters more than you might think. If your site handles any customer data, you may have GDPR reporting obligations to the ICO. Screenshot the damage, note timestamps, and keep a log of everything you do.
5. Revoke all active sessions
Force all users to log out. If a hacker is currently logged into your dashboard, this boots them out immediately.
Identifying how the hackers got in
Understanding the entry point is essential – otherwise you’ll clean up the mess only for them to waltz back in through the same door.
In my experience fixing compromised sites, the most common vulnerabilities are:
- Outdated plugins – this is by far the biggest culprit. A single vulnerable plugin is often all it takes
- Weak passwords – especially on admin accounts with obvious usernames like “admin”
- Compromised themes – particularly “nulled” premium themes downloaded from dodgy sources
- Outdated WordPress core – running old versions with known security holes
- Insecure hosting – shared hosting where another site on the same server was compromised
- Compromised FTP credentials – often stolen from infected local computers
Check your server logs for unusual activity around the time the hack occurred. Look for unfamiliar IP addresses accessing your wp-admin or uploading files. Your hosting provider can often help with this.
Keeping your WordPress installation properly updated is the single most effective way to prevent most attacks in the first place.
Cleaning your WordPress installation: a methodical approach
If you’re tackling the cleanup yourself, here’s the systematic approach I use:
Step 1: Scan for malware
Use a security plugin like Wordfence or Sucuri to scan your files. These will identify modified core files, suspicious code, and known malware signatures.
Step 2: Replace WordPress core files
Download a fresh copy of WordPress from wordpress.org and replace all core files. Don’t touch wp-content or wp-config.php yet – just the core.
Step 3: Check wp-config.php
Open this file and look for any code that shouldn’t be there. Hackers love adding backdoors here. If you’re unsure what belongs, compare it against a fresh wp-config-sample.php file.
Step 4: Clean your themes
Replace all theme files with fresh copies. If you’re using a custom theme, you’ll need to check each file manually for injected code – look for base64_decode, eval, or long strings of encoded characters.
Step 5: Clean or replace plugins
Delete all plugins and reinstall them from the official WordPress repository. Any premium plugins should be downloaded fresh from the original vendor.
Step 6: Check your uploads folder
The wp-content/uploads directory shouldn’t contain any PHP files. If you find any, delete them – they’re almost certainly backdoors.
Step 7: Clean your database
Check your posts and pages for injected spam links. Look in wp_options for suspicious entries. Remove any admin users you didn’t create.
Restoring from backups vs manual cleanup: which approach to take
This is a decision you’ll need to make based on your specific situation.
Restore from backup if:
- You have a clean backup from before the hack occurred
- You know exactly when the compromise happened
- The backup was stored separately from your hosting (so it wasn’t also compromised)
- You haven’t made significant content changes since the backup date
Manual cleanup is better if:
- You don’t have reliable backups
- The hack happened weeks ago and you’ve added lots of content since
- You’re not certain your backups are clean
- The infection is isolated and relatively simple
If you do restore from backup, you still need to fix whatever vulnerability allowed the hack in the first place – otherwise history will repeat itself.
This is exactly the type of situation where having proper WordPress security measures already in place makes recovery far simpler.
Strengthening your site against future attacks
Once you’re clean, it’s time to lock things down properly:
- Enable two-factor authentication on all admin accounts
- Limit login attempts to prevent brute force attacks
- Change your database table prefix if it’s still the default wp_
- Install a security plugin for ongoing monitoring and firewall protection
- Set up automated backups stored off-site
- Review user accounts and remove anyone who doesn’t need access
- Keep everything updated – WordPress core, themes, and plugins
- Use SFTP instead of FTP for file transfers
- Consider a Web Application Firewall like Cloudflare or Sucuri
Regular maintenance isn’t glamorous, but it’s what separates sites that get hacked once from sites that get hacked repeatedly. A proper maintenance routine catches vulnerabilities before hackers do.
When to call in professional WordPress support
I’m going to be honest here – not every hack can be fixed by following a guide.
You should consider professional help if:
- The infection keeps coming back despite cleanup attempts
- You’re not comfortable editing PHP files or working with databases
- Your site handles sensitive customer data and you need proper documentation
- Google has blacklisted your site and you need help with the reconsideration process
- Your hosting provider has suspended your account
- You simply don’t have the time to spend hours on recovery
A professional can often identify and fix issues in an hour that might take someone less experienced an entire weekend – and still not get it right.
If you’re dealing with a hacked site right now and need immediate assistance, our WordPress hack fix service exists precisely for these situations.
What we’ve learned from recovering hacked client sites
After cleaning up more WordPress hacks than I care to count, a few patterns emerge:
Most hacks are opportunistic, not targeted. Automated bots scan millions of sites looking for known vulnerabilities. They don’t care who you are – they just want a server to abuse.
The vast majority could have been prevented. Keeping plugins updated, using strong passwords, and choosing decent hosting eliminates about 95% of attack vectors.
People underestimate how quickly things escalate. A small compromise can turn into a complete nightmare within days if left unchecked. The site gets used for spam, gets blacklisted by Google, hosting gets suspended, and suddenly recovery becomes much harder.
Prevention costs a fraction of recovery. A few hours of maintenance work per month costs far less than emergency hack cleanup – both in money and stress.
If you want to avoid ever reading a guide like this in a panic, consider investing in ongoing WordPress support that keeps your site secure and updated before problems occur.
Getting hacked is miserable, but it’s recoverable. Take a breath, follow the steps, and you’ll get through it.
