Hacked WordPress site? What to do now, and how recovery works
If your site is redirecting visitors, showing spam in Google or was just suspended by your host: don't panic and don't start deleting files. The checklist below is what we'd tell you first. If you'd rather hand it over, we investigate, clean, review access and stabilize the site.
Hacked-site recovery starts from $199. The price depends on site size, plugin count, hosting setup and the site's current condition.
Signs your WordPress site has been hacked
No single sign proves a compromise, but each of these is worth checking straight away.
Redirects and popups
Visitors land on other sites, often only on mobile or when they arrive from Google. You may never see it while logged in.
Spam pages in Google
Casino, pharmacy or Japanese keyword pages appear for your domain, or your titles are replaced.
Browser or Google warnings
A red "Deceptive site ahead" screen, or a "this site may be hacked" label in search results.
Administrators you don't know
New users in the admin list, or your own login suddenly stops working.
Your host raised the alarm
Account suspended, a malware warning email, or CPU and traffic spikes you can't explain.
Files nobody added
PHP files in wp-content/uploads, or core, theme and plugin files with recent changes you didn't make.
Odd scheduled tasks and database content
Unknown cron events, unfamiliar options, or script tags inside posts and widgets.
It keeps coming back
A cleanup that doesn't last points to a backdoor or an open vulnerability.
The first 30 minutes
Order matters. The goal is to stop the damage, keep the evidence and lock the doors without destroying the trail that shows how the attacker got in. A printable version is in the emergency checklist.
Copy everything before you change anything
Download a full copy of the files and the database. It's your evidence. DON'T DELETE ANYTHING YET.
Protect your visitors
If the site redirects to scams or serves malicious downloads, put it in maintenance mode or ask your host to take it offline for now. A short outage is cheaper than infecting your customers.
Change credentials from a clean computer
WordPress administrators, hosting panel, SFTP/SSH, database and the email accounts tied to the site. If your own computer is infected the new passwords can be stolen too.
Log everyone out
Replace the security keys and salts in
wp-config.php. This invalidates every existing login session, including any the attacker is using.Look at who has admin access
Check Users, then Administrators, and note accounts you don't recognise. Note them before deleting; they are part of the picture. See unknown admin user in WordPress.
Ask your host for logs
Access and error logs for the past few weeks, plus whether their scanner flagged specific files. Logs show when and how the attacker came in.
Check what Google sees
Search
site:yourdomain.comfor pages you didn't create, and open Search Console's Security issues report if you have it.Don't just restore last week's backup
A backup can contain the same backdoor and the same vulnerable plugin. See why restoring a backup may not fix a hacked site.
How a hacked-site recovery works
We investigate the compromise, remove the malicious content, review access and stabilize the site so you can move forward safely.
- InvestigateFiles, database, users and available logs reviewed to find what's infected and how it got in.
- RemoveMalicious code, spam injections, backdoors and rogue admin users.
- Review accessAdministrators, credentials and keys, so what the attacker already has stops working.
- StabilizeVerify the site is clean, close the entry point and report in writing.
Where malware usually hides
- PHP files in
wp-content/uploads, inmu-plugins, or posing as plugins - WordPress core files that differ from the official release
- Injected code in theme files such as
functions.phpandheader.php - Conditional redirect rules in
.htaccess, the "only redirects mobile visitors from Google" trick - Spam links and scripts written into posts and the
wp_optionstable - Scheduled tasks that quietly reinstall the infection
- Administrator accounts added by the attacker
Pages for the most common situations
Emergency cleanup
Pricing varies with site size, plugin count, hosting setup and current condition. Tell us what you're seeing and we'll come back with next steps for your site.
Included
- Malware and suspicious code review
- Cleanup of common infection traces
- Admin access review
- Post-cleanup recommendations
Make it stay clean
- Keep WordPress core, plugins and themes updated, and delete the ones you don't use
- Replace abandoned plugins with maintained ones
- Turn on two-factor authentication for every administrator
- Give people only the user role they actually need
- Keep backups off the server, and check that they actually restore
Full detail: how to secure WordPress after malware removal. Prefer not to manage it yourself? Managed WordPress security covers update oversight, regular security checks and backup verification from $79/mo. The most complete resource is the complete hacked-site recovery guide.
Hacked WordPress site FAQ
Should I take the site offline?
If it redirects to scams, serves malicious downloads or is sending spam, yes, at least briefly. Maintenance mode or a host-side suspension of public access protects your visitors while the cleanup is done.
Can I just restore a backup?
A restore can be a useful starting point, but the backup may contain the same backdoor and the same vulnerable plugin. Clean, update and close the way in as well, or you'll be back where you started.
What if my host already suspended the site?
Hosts usually want proof that the site is clean before reinstating it. See recovering a WordPress website suspended for malware.
Will the warning in Google or my browser go away?
Once the site is clean you request a review, and the warning is lifted after the review passes. See flagged and blacklisted sites.
How do I know the cleanup worked?
We re-check the site afterwards and report in writing, including anything still outside the site's control. We can't promise it never happens again.
Tell us about your site
Send a short message: your website, what you're seeing, and who hosts it. We'll get back to you with next steps.