Discovering a hacked WordPress site is unsettling, and the instinct is often to panic and start deleting things or restoring a backup immediately. That instinct, while understandable, can make the situation worse by destroying evidence of how the attacker got in, which means the same vulnerability is still open when the site comes back. This guide covers eight steps in the order that actually resolves a compromise properly, rather than just papering over it.
Signs of a hacked WordPress site
Compromises show up in different ways: unexpected redirects sending visitors to unrelated sites, new pages full of unfamiliar content appearing in search results, unfamiliar administrator accounts, a hosting provider's warning about malicious activity, or a direct notice from Google Search Console. Some compromises are far quieter, sitting hidden for months while doing nothing more visible than sending spam email from the server. Not seeing an obvious symptom does not mean a site is clean, which is one reason periodic scanning matters even for sites that seem fine.
Step 1: Contain the damage
The first move is putting the site into maintenance mode or taking it offline temporarily, which stops the compromise from spreading further or continuing to harm visitors while it is being investigated. This is not the same as deleting anything; it simply stops public access while the next steps happen. If the site is on shared hosting, contact the host immediately, since a compromise can sometimes affect other sites on the same server and the host needs to know regardless.
Step 2: Take a snapshot before changing anything
Before cleaning anything up, make a full copy of the site exactly as it currently is, files and database both. This preserves evidence of how the attacker got in and what they changed, which is valuable both for actually finding the entry point and, if needed, for any investigation afterwards. Deleting suspicious files immediately, without this snapshot, is one of the more common mistakes, since it destroys the clues needed to prevent the same thing happening again.
Step 3: Change every credential
Change passwords for every account with access to the site: WordPress admin users, the hosting account, the database, FTP or SFTP access, and email accounts connected to the domain. If the attacker gained any of these credentials, leaving even one unchanged gives them a way back in after the rest of the clean-up is done. This step is not optional and should happen early, even before the full clean-up is complete.
Step 4: Restore from a clean backup, or clean manually
If a backup exists from clearly before the compromise, restoring it is usually the fastest route to a clean site, provided the entry point is then found and closed so the same backup does not simply get compromised again. Without a clean backup, manual cleaning is necessary: comparing core WordPress, theme and plugin files against known-clean originals, and removing anything added or modified that should not be there. This is genuinely detailed work, and it is where professional help earns its cost for a site of real value.
Step 5: Find the way in
Cleaning the visible symptoms without finding how the attacker actually got in leaves the door open for a repeat compromise. Common entry points include an outdated plugin with a known vulnerability, a weak or reused password, or an insecure file upload feature. Reviewing server access logs from around the time the compromise likely started often reveals exactly which request or file access pattern was the actual entry point, information that is invaluable for making sure it is properly closed.
Step 6: Remove backdoors and hidden users
A sophisticated compromise often leaves more than the obvious visible damage: a hidden administrator account, a disguised file that lets the attacker back in even after the original vulnerability is patched, or a scheduled task quietly re-adding malicious code on a timer. Checking the full user list, scanning for unfamiliar files in unusual locations, and reviewing scheduled tasks are all part of making sure the clean-up is actually complete, not just cosmetically clean on the surface.
Step 7: Deal with Google's warnings
If Google has flagged the site with a security warning, that warning stays in place until you request a review through Search Console after confirming the site is genuinely clean. Google's guidance on handling a hacked site covers what the review process expects to see. Requesting a review before the site is actually clean usually results in a failed review and a longer wait before the warning can be lifted, so this step should come after steps 1 through 6 are genuinely complete.
Step 8: Monitor afterwards
A clean-up is not the end of the process. Set up ongoing monitoring, a security scanner running on a schedule, uptime monitoring, and file change alerts, so that if anything unusual reappears it is caught quickly rather than discovered months later in the same state that started this whole process. This is also the point to apply the wider hardening practices that prevent a repeat compromise in the first place.
What to tell customers, if the compromise affected them
If a hacked WordPress site involved a shop or any form collecting personal data, and there is a genuine possibility that data was accessed, this needs honest, timely communication to affected customers and, depending on jurisdiction, may carry a legal reporting obligation. Deciding this requires understanding exactly what the attacker accessed, which is another reason step 5, finding the actual entry point and scope, matters so much: without that clarity, it is impossible to know honestly what needs disclosing and to whom.
What law enforcement or reporting involvement looks like
For most small business compromises, formal reporting to law enforcement is not typically pursued, since the practical value is often limited relative to the effort involved, though this varies by jurisdiction and by the severity and nature of the compromise. Where customer financial or personal data was genuinely accessed, consulting with a lawyer familiar with data protection obligations in your specific region is worth doing alongside the technical clean-up, since the legal and technical responses to a hacked WordPress site often need to happen in parallel rather than one strictly after the other.
Working with a host during a compromise
Hosts vary considerably in how much support they offer during a compromise: some provide direct clean-up assistance, others simply confirm the account is suspended pending action from the site owner. Contacting the host early, even before the full clean-up plan is settled, is worth doing regardless, since they may already have logs, malware scanning tools, or specific knowledge about how other sites on similar setups have been compromised recently, all of which can meaningfully speed up steps 2 and 5.
When to consider a fresh reinstall instead
For a very old or heavily customised site with an unclear history, sometimes the fastest genuinely safe path is a fresh WordPress installation with clean copies of the theme and plugins from trusted sources, migrating only the actual content, rather than attempting to clean an installation whose full history nobody can confidently account for. This is more work upfront but removes any lingering doubt about hidden backdoors in old, uninspected files, which can be worth the extra effort for a site of real value.
Keeping a record for next time
Once a hacked WordPress site is cleaned and confirmed secure, writing a short record of what happened, the entry point, the date range of the compromise, and exactly what was done to close it, is worth the extra half hour. This record is valuable both for anyone maintaining the site afterwards and, if a similar issue ever appears again, for immediately recognising the pattern rather than starting the diagnosis completely from scratch.
What happens if the same vulnerability gets exploited again
Occasionally a site gets compromised a second time shortly after a clean-up, which almost always means the actual entry point from step 5 was not correctly identified or closed the first time. If this happens, it is worth treating the second compromise as a signal to go back through step 5 more thoroughly, possibly with professional help, rather than simply repeating the same clean-up process and hoping for a different result.
Tools that speed up detection
A reputable security plugin that scans files against known-good checksums and flags unexpected changes catches many compromises faster than manual inspection alone, particularly for a site owner without deep technical expertise. These tools are not perfect and can occasionally miss a well-hidden backdoor, but running one continuously, rather than only after suspecting a problem, moves detection from "whenever someone notices something is wrong" to a matter of days or hours after a compromise actually begins.
Checking for reinfection sources beyond WordPress itself
Occasionally the actual source of a compromise sits outside WordPress entirely: a compromised computer used to access the site, a stolen password reused from another breached service, or a compromised FTP client storing credentials insecurely. Changing WordPress and hosting passwords while the underlying device or password manager remains compromised simply invites the same attacker back in through the same route. Running a security check on any device used to manage the site is a step worth including alongside step 3, not treated as a separate, optional concern.
The emotional side of dealing with a hacked WordPress site
It is worth acknowledging directly that discovering a hacked WordPress site is stressful, particularly for a business owner without a technical background who suddenly has to make decisions about server access, file integrity and Google warnings under time pressure. Working through the eight steps above in order, rather than reacting to each new discovery individually, is partly a technical discipline and partly a way of keeping a stressful situation manageable, since a clear process leaves less room for panic-driven decisions that make things worse.
Preventing a repeat hacked WordPress site
Everything in this guide addresses the aftermath. Preventing the next one comes down to the same fundamentals covered in our guide on hardening WordPress against real attacks: keeping everything updated, using strong unique passwords with two-step login, and maintaining tested backups so that if the worst does happen again, containing and cleaning it is far faster and less costly than it was this time.
A note on staging sites and test environments
It is worth checking whether any staging or test copies of the site exist, since these are sometimes overlooked during a clean-up despite running the same vulnerable software as the production site. A forgotten staging environment, left with an old plugin version and no monitoring, can become the actual entry point even when the main production site appears to be the one showing symptoms, so any known copies of the site deserve the same scrutiny as the live one during steps 4 through 6.
Getting help with a hacked WordPress site
A compromised site with real business value, particularly one handling customer data or payments, is usually worth professional cleaning, since missing a hidden backdoor or a subtle piece of injected code means the problem is not actually solved. Our WordPress development service includes hacked-site cleanup handled with exactly this eight-step discipline. Get in touch if you are dealing with a compromised site right now.