WordPress Site Hacked: What to Do First

You’ve found something wrong — strange redirects, spam content injected into pages, a defaced homepage, or a warning from Google Search Console. Before anything else: don’t panic-delete things, and don’t assume the worst. Most WordPress hacks are automated, opportunistic, and fixable without losing your site permanently. What matters is doing things in the right order.

Step 1: Take the site offline or restrict access, don’t leave it exposed

If your host offers “maintenance mode” or you can quickly restrict access via a password, do that first — this stops the compromise from spreading further or continuing to serve malicious content to visitors and search engines while you work.

Step 2: Change every password, immediately

WordPress admin password, hosting account password, database password, FTP password, and the password on the email account tied to your WordPress admin. If an attacker has admin access, changing only the WordPress password while leaving hosting or FTP credentials untouched doesn’t actually lock them out.

Step 3: Figure out what was actually compromised

Not every “hack” is the same severity. Common patterns:

• SEO spam injection — pages full of unrelated spam content or links, often only visible to search engines, not human visitors browsing normally
• Malicious redirects — visitors get sent to a different site entirely, often only on mobile or only from search results
• Defacement — the homepage is visibly replaced with something else
• A backdoor — malicious code hidden in a theme or plugin file that lets the attacker back in even after you “clean” the visible symptoms

The backdoor case is the important one: if you only remove the visible spam content without finding how the attacker got in, they can simply re-inject it days later. This is the step most DIY cleanups miss.

Step 4: Check for the actual entry point

Common entry points, roughly in order of likelihood:

• An outdated plugin or theme with a known, published vulnerability
• A weak or reused admin password
• A nulled/pirated premium plugin or theme (these frequently ship with backdoors built in deliberately)
• Compromised hosting account credentials, unrelated to WordPress itself

Update everything to the latest version as part of the cleanup — but updating alone doesn’t remove malicious code that’s already been planted; it just closes the door it came through.

Step 5: Restore from a clean backup, if you have one from before the compromise

If you have a backup from a date you’re confident predates the hack, restoring it is often faster and more reliable than manually hunting through every file for injected code. If you don’t have a clean backup, manual cleanup or a security plugin’s malware scanner becomes necessary instead.

Step 6: Ask Google to review your site, if it was flagged

If Search Console shows a security warning or your site is flagged in search results, submit a review request through Search Console once you’ve confirmed the site is actually clean — not before, since a failed review resets the clock.

Should you tell your customers?

If the hack involved any form that collects personal information — checkout, account registration, a contact form storing sensitive details — you need to seriously consider whether customer data was actually exposed, not just whether the site was defaced visibly. A hack that only injected spam links is different from one that had access to a database containing customer emails or order details. When in doubt, err toward disclosure; discovering later that you knew and said nothing is far worse for trust than an early, honest heads-up.

Why “just restore a backup” isn’t always the full fix

Restoring a backup rolls your files and database back to an earlier point, but if the entry point that let the attacker in — an outdated plugin, a weak password — is still present, restoring a backup only delays the same hack happening again. Treat backup restoration as step one of the cleanup, not the entire cleanup. The entry point still needs to be found and closed.

How to know if you’ve actually been hacked, versus a different kind of problem

Not everything that looks alarming is a hack. A sudden traffic drop can be a Google algorithm update or an analytics tracking bug rather than a compromise. A slow site is far more often a performance problem than malware. Genuine signs of an actual hack are more specific: unfamiliar admin user accounts you didn’t create, content on your site you didn’t write, outbound links to unrelated sites embedded in your pages, or a security scanner flagging known malware signatures in your files. If you’re not seeing any of those specific signs, it’s worth ruling out simpler explanations before assuming the worst.

What actually prevents this from happening again

Nearly every hack we’ve cleaned up traces back to the same handful of causes: outdated plugins, weak passwords, or no one checking on the site for months at a time. None of that requires a security expert to prevent — it requires someone actually keeping the software current and watching for problems, which is exactly what our monthly subscription is built around. If you’re dealing with an active hack right now, though, our $149 fix service covers cleanup and finding the entry point, typically within 24 hours.