WordPress Site Hacked? What to Do, Step by Step

If your WordPress site is hacked, act in this order: take the site offline or into maintenance mode, change every password, restore a clean backup if you have one, or scan and remove the malicious files, then update WordPress, themes and plugins. Afterwards, find how the attacker got in so it cannot happen again.

If you searched “WordPress site hacked what to do” a few minutes ago, start with the first-steps list below and come back to the rest once the site is contained.

How do you know your site is hacked?

A hacked WordPress site usually shows itself through redirects, warnings, strange content or accounts you did not create. Some hacks are silent, so a clean-looking homepage does not prove the site is fine.

Slowness alone is not proof of a hack. If that is your only symptom, see why your website is slow first.

What should you do first?

First contain the damage: take the site out of public view, lock the attacker out and save a copy of the evidence. Do these before you delete anything.

1. Write down what you saw and when. Take screenshots of warnings, redirects and unknown users. You will need them later.
2. Take the site offline or into maintenance mode. If you cannot log in, ask your host to do it. This protects visitors and limits harm to your reputation.
3. Contact your hosting company. Tell them the site is compromised. Many hosts can scan the account, show which files are infected and tell you when it began.
4. Change every password. Hosting account, WordPress admins, database, FTP or SFTP, and any email on the domain. Use a new, unique password for each.
5. Back up the hacked site as it is. Download files and database and label the copy as infected. It keeps your content safe and shows how the attacker got in.
6. Remove users you do not recognize and reduce any account that does not need admin rights.
7. Pause ads and email campaigns that send people to the site until it is clean.
8. Scan your own computer for malware. Stolen passwords often come from an infected laptop, and new passwords will be stolen again.

If you run Google Ads, pausing matters for a second reason: ads pointing to a compromised site can be disapproved, and clearing that takes time after the site is fixed.

How do you clean a hacked site?

You clean a hacked site by replacing every file that can be replaced with a fresh copy, then inspecting what is unique to your site. Deleting the one file a scanner flagged is rarely enough, because attackers leave more than one way back in.

1. Scan the site. Use your host’s malware scanner and a security plugin such as Wordfence or Sucuri to list infected and changed files.
2. Replace WordPress core. Re-install the current version from Dashboard > Updates, or upload a fresh copy from wordpress.org over the wp-admin and wp-includes folders.
3. Re-install every plugin and theme from its original source. Delete the old folders first so nothing extra survives.
4. Delete what you do not use. Inactive plugins and themes are still files an attacker can reach.
5. Check the files you cannot replace. Look at wp-config.php, .htaccess and your theme’s custom files for code you did not write. Look in the uploads folder for PHP files, which do not belong there.
6. Check the database. Look for unknown admin users, and for scripts or links injected into posts, pages and settings such as the site address.
7. Check scheduled tasks on the server and in WordPress for jobs you did not create.
8. Change the security keys in wp-config.php. This logs out every user, including the attacker.
9. Update everything to the current version: WordPress, plugins, themes and the PHP version on the server.
10. Scan again, then check the site while logged out, on a phone, and from a Google search result.

If any step above is unfamiliar, hand the cleanup to a WordPress developer or your host’s security team. A half-cleaned site is often reinfected, because a backdoor that was missed still works.

When should you restore from backup?

Restore from backup when you have a copy taken before the hack began and you can afford to lose what changed since. It is quicker than cleaning by hand, but it brings back the same weakness the attacker used.

Three cautions. Hacks often sit unnoticed for weeks, so the most recent backup may not be clean; scan the restored site before reopening it. An online store or booking site should export recent orders and customers before restoring. And a restore without updates and new passwords only resets the clock.

How do you get off Google’s warning list?

You remove Google’s warning by cleaning the site and then asking Google to review it in Search Console. The warning does not clear on its own schedule; you have to request the review.

1. Open Google Search Console for the site. If you have never set it up, add and verify the site now.
2. Open the Security Issues report. It lists what Google found and gives example pages.
3. Fix every issue listed, using the examples to confirm they are gone.
4. Select “Request review” and describe plainly what was wrong and what you did to fix it.
5. Check the Manual Actions report as well, in case spam content led to a separate penalty.
6. Wait for the result. Reviews are not instant and can take from days to weeks depending on the type of problem.

Ask for the review only when the site is fully clean. A request that fails slows the next one. Also ask your host to lift any suspension, and if a security company or browser has blocked the site, use its own removal form.

How do you secure a WordPress site afterwards?

You secure a WordPress site by closing the way the attacker got in, then keeping software current, logins strong and backups off the server. Start by finding the entry point, because securing everything except the actual hole changes nothing.

Your host’s access logs and the dates on the infected files usually point to it. The common causes are an outdated plugin or theme, a pirated (“nulled”) plugin or theme, a weak or reused password, or another infected site on the same hosting account.

Then work through how to secure a WordPress site for the long term:

☐ WordPress, plugins and themes are updated on a schedule, with someone responsible for it.

☐ Unused plugins and themes are deleted, not just deactivated.

☐ Plugins and themes come only from wordpress.org or the original developer.

☐ Every admin has a unique, strong password and two-factor login.

☐ Only people who need admin rights have them. Old staff and old agencies are removed.

☐ Login attempts are limited.

☐ Automatic backups run daily and are stored away from the web server.

☐ A restore from backup has been tested at least once.

☐ A security plugin or firewall is active and its alerts go to a monitored inbox.

☐ Hosting keeps each site separate and runs a supported PHP version.

☐ The site uses HTTPS and SFTP, never plain FTP.

☐ File editing from the WordPress dashboard is turned off.

What to prioritize depends on the site. An online store should put backups, two-factor login and payment plugin updates first, because customer and order data is at stake. A lead-generation site for a contractor, clinic or law firm should watch form plugins and redirects, since a hacked form or a redirect quietly kills inquiries. A membership or course site should review user roles regularly.

Most of this list is routine maintenance. How much website maintenance costs explains what a care plan should include and what you can do yourself.

If you are not sure whether your site is clean, or how exposed it is, JuvioX offers a free audit. Ongoing care is part of our website and landing page service, month to month with no lock-in.