WordPress Site Hacked? A Step-by-Step Recovery Plan

01Signs your site has been hacked

Some signs are obvious. Others are designed to stay hidden from you while visitors and search engines see them.

• Redirects to unrelated sites, sometimes only on mobile or only for visitors arriving from Google.
• Browser or search warnings such as "Deceptive site ahead" or "This site may be hacked".
• Unknown administrator accounts in Users.
• Spam pages or links you did not write, often visible in a site:yourdomain.com search as pages about pharmaceuticals, loans or foreign-language products.
• Your host suspends the account or emails about malware or outgoing spam.
• Unfamiliar files or plugins, or core files with recent modification dates.
• A sudden drop in search traffic or new entries in Search Console's Security issues report.

Not every odd behaviour is a hack. A plugin conflict or a failed update can break a site too. But unknown admin users, injected spam and redirects you did not configure should be treated as a compromise until shown otherwise.

02The first hour: contain it

1. Contact your hosting provider. Tell them what you see. They can check server logs, may be able to say when it started, and can tell you whether other sites on the account are affected. Some hosts offer clean-up help.
2. Limit access to the site. If visitors are being redirected or served malware, put the site into maintenance mode or ask the host to restrict access temporarily. A short planned outage is better than infecting your visitors.
3. Scan your own computer. If malware on your device captured your passwords, changing them from that device hands over the new ones.
4. Change passwords from a clean device: hosting account, FTP or SFTP, database, every WordPress administrator, and the email account tied to them. Our guide to securing your online accounts covers doing this properly.
5. Take a full copy of the site as it is now, files and database, and label it clearly as infected. You may need it to recover content, and it is evidence of what was changed.
6. Write down what you know: when you first noticed, what you saw, recent changes such as a new plugin or a shared login.

03Recovery step tracker

Tick each step when it is done. The tracker shows your progress and which step comes next, so you can stop and resume without losing your place.

04Restore a backup or clean by hand?

Two points apply to both routes. First, hacks often sit unnoticed for weeks, so last night's backup may be infected. Look for one that predates the first suspicious file or user. Second, a restored site has the same weakness the attacker used. Restoring without updating and changing passwords invites the same attack again, sometimes within hours.

05How to clean a hacked WordPress site

Work on a copy where you can. If you must work on the live site, keep it in maintenance mode.

Step 1: Scan to get a map

Run a scan with a reputable WordPress security plugin or your host's malware scanner. Treat the result as a starting list. Scanners find known patterns and can miss new or well-hidden code.

Step 2: Replace WordPress core

Download a fresh copy of your WordPress version from WordPress.org. Replace the wp-admin and wp-includes folders entirely, and the core files in the root folder. Do not overwrite wp-config.php or the wp-content folder. If your dashboard is usable, Dashboard → Updates → Re-install does the same job for core files.

Step 3: Replace plugins and themes

Delete each plugin and theme folder and install a fresh copy from the official source. Do not reuse the copies from the infected site. Anything you are not using, delete and do not put back. Custom themes need a file-by-file comparison against a clean copy from your developer or version control.

Step 4: Inspect what cannot be replaced

• wp-config.php: compare it with the sample file. Look for unfamiliar code, especially long encoded strings or lines that include other files.
• .htaccess: look for redirect rules you did not add. A default WordPress .htaccess is only a few lines.
• wp-content/uploads: this folder should contain media. PHP files here are almost always malicious.
• Must-use plugins and drop-ins: check wp-content/mu-plugins and files such as object-cache.php in wp-content. They load automatically and are a favourite hiding place.
• The root folder: look for files that are not part of WordPress, particularly ones with random-looking names.

Step 5: Check the database

• Users: delete administrators you do not recognise, and check that real accounts have the correct email address.
• Posts and pages: search for injected scripts, hidden links and spam posts.
• Settings: confirm the site URL and home URL are correct, and review widgets and any header or footer code fields.
• Scheduled tasks: unfamiliar scheduled events can reinstall malware after you remove it.

Step 6: Reset the security keys

Generate new authentication keys and salts using the WordPress.org secret-key generator and replace the old ones in wp-config.php. This logs out every session, including any the attacker still holds.

06After the clean-up

1. Update everything: WordPress core, every plugin, every theme, and the PHP version if your host offers a newer supported one.
2. Change the passwords again now that the site is clean, including the database password.
3. Turn on two-factor authentication for all administrators.
4. Clear every cache, including the server and CDN caches, so old infected pages are not still being served. Our WordPress caching guide lists the layers to purge.
5. Rescan, and scan again in a few days. If malware returns, a backdoor was missed.
6. Take a fresh backup of the clean site and store it away from the server.
7. Request a review. If Search Console's Security issues report listed the site, use the Request review button there and describe what you fixed. Warnings are removed after Google confirms the site is clean; the time this takes varies.
8. Check you are not on blocklists. If the site sent spam, your domain's email may be affected. Your host can advise.

07How they probably got in

Cleaning without finding the entry point leaves the door open. The usual routes:

• An outdated plugin or theme with a known vulnerability. This is the most frequently reported cause in WordPress security research.
• A stolen or weak password for WordPress, hosting or FTP, often reused from another breached service or captured by a phishing email. See how to spot phishing emails.
• Nulled software. Pirated premium themes and plugins very often contain a backdoor.
• Another site on the same hosting account that was compromised first.
• Malware on a computer used to log in.
• A neglected server on an unmanaged VPS. If hosting is part of the problem, our guide on how to choose WordPress hosting explains the trade-offs.

Ask your host for access logs around the time the first malicious file appeared. They often show which file was requested just before, which points to the vulnerable component.

08Common mistakes and when to get help

Common mistakes

• Deleting the visible symptom only. Removing a spam page or one bad file leaves the backdoor that created it.
• Restoring a backup and stopping there.
• Changing passwords from an infected computer.
• Leaving unused plugins and themes installed. Deactivated code can still be exploited.
• Requesting a Google review before the site is truly clean. A failed review can slow down the next one.
• Keeping no clean backup afterwards.

When to pay for professional help

• The infection returns after you clean it.
• The site takes payments or stores personal data.
• You have no backup and are not comfortable editing files and the database.
• Every hour of downtime costs you money.

Reputable malware-removal services exist, and some hosts include one. Check what is covered, whether re-infection is included, and never give access to someone who contacted you first with an unsolicited offer.

09FAQs

How do I know for sure my WordPress site is hacked?

Unknown administrator accounts, files you did not add, injected redirects or spam content, and warnings from your host or in Search Console's Security issues report are reliable signs. A malware scan and a look at recently modified files will usually confirm it.

Can I fix a hacked WordPress site myself?

Often, yes, if you can use a file manager or SFTP and follow steps carefully. Simple infections on small sites are manageable. Get help for shops, sites holding personal data, or infections that come back.

Will reinstalling WordPress remove the hack?

Reinstalling core replaces infected core files but leaves wp-content, wp-config.php and the database untouched, and malware frequently lives there. It is one step of the clean-up, not the whole of it.

How long does Google take to remove a hacked site warning?

After you request a review, Google checks the site and removes the warning if it finds it clean. The time varies by the type of issue, from around a day to longer, so make sure the clean-up is complete before asking.

Will a hack damage my search rankings permanently?

Usually not. Traffic often drops while warnings are shown or spam pages are indexed, and tends to recover after the site is cleaned and reviewed. How quickly depends on how long the hack lasted and how much spam was created.

10Conclusion

When a WordPress site is hacked, order matters more than speed. Contain it, keep a copy, choose between restoring and cleaning, replace what can be replaced, inspect what cannot, and then close the entry point with updates, new passwords and two-factor login. Finish with a clean backup stored somewhere else, so that if there is a next time, recovery takes minutes.

References

• WordPress documentation: FAQ, my site was hacked
• WordPress documentation: hardening WordPress
• Search Console Help: Security issues report
• WordPress.org secret-key generator