A hacked website is stressful: customers see spam or a warning, enquiries stop, and Google may flag the site. The good news is that most hacked WordPress sites can be cleaned and secured. Here is what to do, in order.
Signs your WordPress website has been hacked
- Visitors are redirected to another website, often a gambling, pharmacy or spam page, sometimes only on mobile.
- Google shows a warning, or Search Console reports a security issue.
- Strange pages or Japanese or Chinese keywords appear in Google results for your site.
- Admin users you do not recognise appear in WordPress.
- Your hosting company suspends the account or warns you about malware.
- The site suddenly becomes very slow, or your server sends spam email.
What to do first
- Do not delete everything in a panic. You may need the current files to find out how the attacker got in.
- Change your passwords for the hosting account, WordPress admin users, FTP or SFTP, and the database. Use new, unique passwords.
- Tell your hosting provider. Many hosts can confirm the infection, restore a backup or point to the infected files.
- Check Google Search Console under Security issues. It shows what Google found and, after the clean-up, lets you request a review.
- Find your most recent clean backup. Check the date: it must be from before the hack started.
How a clean-up works
- Restore or clean. If a clean backup exists, restoring it is usually fastest. Otherwise, infected files and database entries are cleaned by hand, and WordPress core files are replaced with fresh copies.
- Remove unknown admin users and anything the attacker added, such as hidden pages, scripts or scheduled tasks.
- Update everything: WordPress, every plugin and the theme. Remove plugins and themes you do not use.
- Close the gap. Find how the attacker got in (often an outdated plugin or a reused password) and fix it, or the site will be hacked again.
- Ask Google for a review in Search Console once the site is clean, so warnings are removed.
How to stop it from happening again
- Keep WordPress, plugins and theme updated every week.
- Keep off-site backups, and test that they restore.
- Use two-factor authentication and unique passwords for every admin.
- Only install plugins from reputable sources, and remove ones you do not use.
Our WordPress maintenance checklist covers the full routine.
Need help now?
If your website is hacked, down or showing errors, message us on WhatsApp. We review the site first and tell you what it needs and what it will cost before we start. After the repair, a maintenance plan keeps it from happening again.
Frequently asked questions
Why do WordPress websites get hacked?
Usually through a plugin or theme with a known security hole that was not updated, a weak or reused password, or a nulled (pirated) premium plugin. Small business sites are attacked by automated tools, not because someone chose them.
Will restoring a backup fix a hacked website?
Only if the backup is from before the hack, and only if you also fix how the attacker got in. Otherwise the same hole is used again, often within days.
How long does it take to clean a hacked website?
It depends on how badly the site is infected and whether a clean backup exists. We review the site first and give you the time and cost before starting.