Finding out your website has been hacked is stressful, especially when customers are visiting it. Take a breath. Hacked WordPress sites are common, and most can be cleaned and recovered. What you do in the first hour decides how much damage is done.
Need urgent help right now? Message us on WhatsApp or contact our team, and we’ll look at your site straight away.
If you want to handle it yourself first, follow the steps below in order.
Signs your WordPress site has been hacked
Hacks aren’t always obvious. Look for these warning signs:
- Your site redirects visitors to spam, gambling, or adult websites
- A browser or Google warning says your site is dangerous or “may be hacked”
- Your homepage has been changed or defaced
- Unknown admin users have appeared in your WordPress dashboard
- Strange pages, links, or text appear on your site or in Google results
- Your hosting company has suspended your account
- Your site is suddenly slow, or traffic has dropped sharply
- You can’t log in, or your password no longer works
- Customers report spam emails coming from your domain
If you see even one of these, treat it as a hack until proven otherwise.
What to do in the first hour
The first hour is about containing the damage. Cleaning comes after.
Step 1: Stay calm and write down what you see
Take screenshots of any warnings, redirects, or strange pages, and note when you first noticed the problem. Don’t start deleting files yet. Deleting in a panic can destroy the evidence needed to find out how the attacker got in.
Step 2: Contact your hosting provider
Tell your host straight away. Many can scan your account, check server logs, restore a recent backup, and tell you whether other sites on the same account are affected. If they’ve suspended your site, ask exactly what they found.
Step 3: Protect your visitors
If your site is sending people to spam or malware, put it into maintenance mode, or ask your host to take it offline until it’s clean. A hacked site that harms visitors damages your reputation far more than a short outage.
Step 4: Back up the hacked site as it is
Take a full copy of your files and database and store it away from your server. This copy is for recovering your content and for investigation. Don’t restore it as your “clean” site.
Step 5: Change every password and security key
Use a device you trust to change passwords for your WordPress admin accounts, hosting, SFTP or FTP, database and any email accounts connected to the site. Then replace the security keys in your wp-config.php file, which logs out everyone currently signed in, including the attacker.
Step 6: Check your users
In the WordPress dashboard, go to Users and filter by Administrator. Delete any account you don’t recognise, and reset the passwords for everyone else. Hackers often add a hidden admin so they can come back.
After the first hour: clean the site
Once the damage is contained, you can work on getting rid of the infection.
Scan the whole site
Use a reputable security plugin or online scanner, such as Wordfence or Sucuri SiteCheck, to look for known malware. Scanners find many infections but not all of them, so a clean scan isn’t proof your site is safe.
Restore a clean backup, or clean the site by hand
There are two routes:
- Restore from a clean backup: choose a backup from before the hack began, restore it, then update everything and change all passwords immediately. If you skip the updates, the same weakness lets the attacker back in.
- Clean it manually: reinstall WordPress core files, plugins, and themes fresh from official sources, then check the uploads folder for PHP files that shouldn’t be there. Also check .htaccess, wp-config.php, and any hidden admin users or scheduled tasks. Hackers leave backdoors, and missing one means the site is reinfected.
A good website backup strategy is what makes the first route possible, which is why it comes up again in the prevention checklist below.
Update everything and remove what you don’t use
Update WordPress, every plugin, and every theme. Delete anything you aren’t using, because inactive plugins can still be exploited. Replace any “nulled” (pirated) premium plugin or theme with a genuine licence, as these often contain hidden malware.
Fix the damage in Google
A hack doesn’t just hurt your site. It can hurt your search presence, and many owners find the site is not showing on Google the way it used to.
- Check Search Console. Open the Security Issues report in Google Search Console to see which pages Google thinks are hacked.
- Remove spam pages. Delete injected pages so they return a 404 or 410 error, and update your sitemap.
- Fix the cause first. If Google’s warning says your site “may be hacked”, it won’t clear until you’ve fixed the problem. If the weakness remains, you’ll just be reinfected.
- Request a review. When the whole site is clean and secure, ask Google to review it from the Security Issues report. Reviews for sites hacked with spam can take up to several weeks.
- Watch your traffic. Check your indexed pages and rankings over the following weeks. If rankings don’t return, you may need a recovery plan, and our SEO team can help.
UK data breach rules: do you need to tell the ICO?
If your site collects personal data, such as contact form enquiries, customer accounts or orders, a hack may count as a personal data breach under UK GDPR.
You must work out whether the breach is likely to put people at risk. If it is, you have to report it to the ICO without undue delay and, where feasible, within 72 hours of becoming aware of it. The clock starts when you find out, not when the hack happened. If the risk to individuals is high, you may also need to tell the people affected.
Not every incident has to be reported, but you should keep a record of what happened either way. This isn’t legal advice, so if you’re unsure, ask your data protection adviser or check the ICO’s guidance.
How to stop it happening again
Most WordPress hacks come from a short list of causes: outdated plugins and themes, weak or reused passwords, nulled software and poor hosting. Use this WordPress security checklist to close the gaps:
- Follow WordPress plugin updates best practice: update core, plugins, and themes regularly, and test updates on a staging copy for important sites
- Delete plugins and themes you don’t use
- Use strong, unique passwords and a password manager
- Turn on two-factor authentication for every admin account
- Limit login attempts and consider a web application firewall
- Give each user the lowest access level they need
- Keep daily backups stored away from your server, and test that you can restore them
- Choose quality hosting with built-in security
- Install an SSL certificate
- Schedule regular malware scans and uptime monitoring
If you’d rather not manage this yourself, a website maintenance service in the UK handles updates, backups and monitoring for you. We cover this as part of our web development work.
When to call a professional
You can handle some clean-ups yourself, but it’s time to call in an expert when:
- You’ve cleaned the site, and it keeps getting reinfected
- You can’t find where the malware is hiding
- Your site is blacklisted or marked as dangerous by Google or browsers
- Customer data may have been exposed
- You can’t log in at all
- You’d rather get back to running your business than hunting for backdoors
Our WordPress malware removal work includes finding the cause, not just the symptoms. We scan the site, remove the infection, close the weakness that let the attacker in, and help clear any Google warnings. For urgent cases, we can respond as a website developer emergency, so you’re not left waiting.
FAQs
Can I fix a hacked WordPress site myself?
Sometimes. A simple infection can be cleaned with a scan, a clean backup, and updates. But hidden backdoors are easy to miss, and a half-cleaned site is often hacked again within days. If you aren’t confident, get help.
Will being hacked hurt my Google rankings?
It can. Spam pages, malicious redirects, and security warnings can all lead to lost traffic or pages being removed from search. Rankings usually recover once the site is clean and Google has reviewed it, but spam hacks can take weeks to clear.
Should I restore a backup after being hacked?
Only if the backup is from before the hack started. Restore it, then update everything and change all passwords straight away. Restoring an infected backup, or leaving the original weakness open, just brings the problem back.
How did my WordPress site get hacked?
The most common causes are outdated plugins and themes, weak or reused passwords, pirated plugins and themes, and insecure hosting. Finding the exact entry point usually needs a look at your server logs and files.
Do I have to tell my customers?
It depends on whether personal data was involved and how risky the breach is for the people affected. If it’s likely to put them at high risk, you may need to tell them directly. See the ICO section above and get advice if you’re unsure.
Is your WordPress site hacked right now?
Don’t wait while the damage spreads. Claim your Free Growth Audit or message us for urgent help, and we’ll tell you what’s wrong and what to fix first. Message us on WhatsApp or contact our team today.
