WordPress site hacked? Stay calm and work in this order: take the site offline or into maintenance mode, back it up as it is, change every password, scan and clean the files, update everything, then harden the site so it does not happen again. Most hacked WordPress sites are caught through outdated plugins, weak passwords or nulled (pirated) themes, so the fix is usually a clean-up plus better habits. This checklist covers the first hour and what follows.
The first hour in six lines
- Put the site in maintenance mode so visitors are not exposed.
- Take a full backup of the hacked state (for evidence and recovery).
- Change passwords for hosting, WordPress admin, database, FTP and email.
- Contact your host: they may have logs or a clean backup.
- Scan and remove malware, bad users and unknown files.
- Update everything and close the hole that let them in.
Signs your WordPress site is hacked
- Visitors are redirected to spam or unfamiliar sites.
- Strange pages or links appear (often pharmacy, casino or loan spam).
- Google shows a warning, or search results show odd titles for your pages.
- You cannot log in, or you see admin users you did not create.
- Your host suspends the account or reports high resource use.
- Files you do not recognise appear in your uploads or plugin folders.
Step 1: contain the damage (first 10 minutes)
- Enable maintenance mode, or ask your host to temporarily block public access.
- Do not delete everything in a panic. You need the evidence to find the cause.
- Check whether your host offers a malware scan or a recent clean backup.
Step 2: change every password
Change the passwords for your WordPress admin accounts, hosting control panel, FTP or SFTP, database and the email linked to admin. Use long, unique passwords from a password manager. Remove users you do not recognise.
Step 3: back up, then choose restore or clean
Save a copy of the site as it is now. Then decide:
| Option | When it fits | Watch out for |
|---|---|---|
| Restore a clean backup | You have a backup from before the hack | The same vulnerability is still there; update before going live |
| Clean the existing site | No clean backup exists | Hidden backdoors; needs careful file and database review |
Step 4: clean the site
- Reinstall WordPress core files from a fresh copy from wordpress.org.
- Delete and reinstall plugins and themes from their official sources. Never reuse pirated (“nulled”) plugins.
- Look in the uploads folder for PHP files; legitimate uploads are images and documents.
- Check the wp-config.php and .htaccess files for code you did not add.
- Review the database for injected links or scripts in posts and options.
- Remove unknown admin users and scheduled tasks.
Step 5: tell Google and your visitors if needed
If Google flagged your site, open Search Console, go to Security Issues and request a review after cleaning. If customer data may have been exposed, tell the people affected and follow the rules that apply to your business.
Step 6: harden the site so it does not repeat
- Keep WordPress, plugins and themes updated, and delete the ones you do not use.
- Use strong passwords and two-factor authentication for admin accounts.
- Limit login attempts and use a reputable security plugin or firewall.
- Take automatic backups and store a copy off the server.
- Only install plugins and themes from trusted sources.
Our WordPress security checklist lists twelve steps in detail, and our maintenance and support service handles updates, backups and monitoring for you.
When to get professional help
Call a specialist if the site keeps getting re-infected, if it holds customer or payment data, or if you are not comfortable editing files and the database. A repeat infection usually means a backdoor was missed.
Frequently asked questions
How did my WordPress site get hacked?
Common causes are outdated plugins or themes, weak or reused passwords, nulled themes and plugins, and compromised hosting accounts.
Should I delete the hacked site and start again?
Not at first. Take a backup, then clean or restore. A full rebuild is a last resort and still needs the cause fixed.
Will hacking hurt my Google rankings?
It can if spam pages are indexed or Google flags the site. Cleaning quickly and requesting a review in Search Console reduces the impact.
How can I prevent it from happening again?
Update everything, use strong passwords and two-factor login, remove unused plugins, keep backups and monitor the site.
Is a security plugin enough?
It helps, but it is not a substitute for updates, backups and good access habits.
Need help right now?
Contact ExpertsGrow and tell us what you see, or read about our WordPress maintenance and support. Planning a new site? See our website packages.
