WordPress Site Hacked? What to Do in the First Hour

Finding out your website has been hacked is stressful. The good news is that a hacked WordPress site can almost always be cleaned up and recovered. What matters is doing things in the right order, and not making the damage worse while you panic.

This guide covers the warning signs, what to do in the first hour, how to clean the site, how to deal with Google, and how to stop it happening again.

Signs your WordPress site may be hacked

• Visitors are redirected to spam, gambling, or pharmacy sites, often only on mobile or from Google
• Google shows "This site may be hacked" or your browser shows a red "Deceptive site ahead" warning
• You find admin users you did not create
• Search results show strange pages or foreign-language spam under your domain
• Your host suspended the account or sent a malware notice
• Your site is suddenly slow, or you cannot log in to your own dashboard
• Your emails are going to spam or bouncing

Some hacks are invisible to you and only show up for search engines or for visitors who arrive from Google. If something feels off, do not wait.

The first hour: what to do, in order

1. Do not delete everything. It feels like action, but you may destroy the evidence you need and your own content along with it.

2. Call or message your hosting provider. Many hosts can scan for malware, tell you which files changed, and restore recent backups. Some will already have suspended the site to protect other customers.

3. Take a backup of the site as it is right now. Yes, even though it is infected. You want a record of what was there, and a copy to work from if something goes wrong later. Label it clearly so it is never restored by accident.

4. Take the site offline if it is spreading harm. If visitors are being sent to malicious pages, put up a maintenance page or ask your host to suspend public access while you clean up.

5. Change every password, from a clean computer. That means every WordPress admin account, your hosting account, FTP or SFTP, your database password (then update it in wp-config.php), and the email address tied to the site. If your own computer might be infected, scan it first.

6. Log everyone out. Replace the security keys and salts in wp-config.php with fresh ones. This invalidates every existing login session, including the attacker's.

Finding what the attacker left behind

• Users: in the WordPress dashboard, open Users and delete any administrator you do not recognize
• Plugins and themes: look for anything you did not install, and anything abandoned or no longer updated. Our guide to spotting abandoned plugins shows how
• The uploads folder: there should be images and documents in wp-content/uploads, not PHP files. PHP files in there are almost always malicious
• Core files: if you are comfortable with the command line and WP-CLI is available, wp core verify-checksums compares WordPress core files against the official versions and lists anything modified
• Scheduled tasks and the .htaccess file: attackers often hide redirects and re-infection scripts there
• A malware scanner: your host's scanner, or a reputable security plugin, can help find files you would miss. No scanner is perfect, so treat a clean result as a good sign, not proof

Cleaning the site

The safest approach is a clean rebuild of the code with your content kept intact:

• Reinstall WordPress core from a fresh download so every core file is known to be clean
• Delete every plugin and theme and reinstall them from their original, trusted sources. Never reinstall from a copy that was on the infected site
• Remove anything you do not actively use
• Check the database for injected content, spam posts, and unknown users
• Or restore a backup from before the infection date, and then update everything immediately so the same weakness is not open again

The step people skip is the most important one: find out how they got in. If you only remove the damage, the same weakness lets them back in, and reinfection within days is very common. Outdated plugins, abandoned themes, weak or reused passwords, and pirated "nulled" themes are the usual culprits.

Dealing with Google

If Google flagged your site, open Google Search Console and look at Security issues and Manual actions. Once the site is truly clean, you can request a review there. Also remove any spam pages that got indexed and resubmit your sitemap. A site cleaned up quickly usually recovers, but the longer a warning stays up, the more traffic and trust it costs you.

How to keep it from happening again

• Keep WordPress core, plugins, and themes updated, ideally after testing on a copy of the site
• Delete plugins and themes you are not using. Inactive ones can still be exploited
• Use long, unique passwords and turn on two-factor authentication for every admin
• Give each person the lowest access level that lets them do their job
• Add define('DISALLOW_FILE_EDIT', true); to wp-config.php so the dashboard cannot be used to edit code
• Keep automatic backups stored somewhere other than the same server
• Run a firewall and malware monitoring, and review your plugin risk checklist regularly

Our small business maintenance checklist turns most of this into a routine you can follow.

Common questions

Q: How did my site get hacked?

Most WordPress hacks come through outdated or abandoned plugins and themes, weak or reused passwords, or pirated themes that came with hidden code. Rarely is it anything personal. Automated tools scan the internet for known weaknesses.

Q: Will I lose my Google rankings?

Often not for long. If the cleanup is thorough and any Google warning is removed quickly, rankings usually recover. The damage grows the longer a spam infection stays live.

Q: Is restoring a backup enough?

Only if the backup is from before the infection and you update everything straight away. A restore alone puts back the same vulnerable software, which is how people get hacked twice.

Q: Should I try to clean it myself?

You can for a simple case, but attackers often leave more than one way back in. If your business depends on the site, getting an experienced person to check the whole thing is worth it. See also our guide to emergency WordPress help.