Finding out your site has been hacked feels awful. Visitors are sent to strange pages, a browser warns people away from your address, or your host emails you about suspicious activity. Panic is normal. Mistakes made in panic, however, are the main reason cleanups fail and hacks come back.
This guide walks through what to do in the first hour, how to clean the site properly and what to change afterwards so it does not happen again. If the site is critical to your business and you are not comfortable with the steps, our malware cleaning service can do it for you.
Signs your site has been hacked
- Visitors are redirected to unfamiliar or spammy sites.
- Your site shows pages or links you did not create, often about pills, gambling or loans.
- A browser or search engine shows a warning that the site is unsafe or deceptive.
- You find administrator accounts you do not recognize.
- Your host suspended the site or reported unusual activity.
- The site suddenly became very slow or your emails are marked as spam.
- Files have changed that nobody on your team touched.
The first hour
1. Stay calm and avoid making things worse
Do not delete everything in a hurry and do not restore a random backup without thinking. You need to learn how the attacker got in, or they will return.
2. Take a backup of the current state
It sounds odd to back up a hacked site, but you want a copy of the evidence and of any good content. Label it clearly as infected and keep it away from your live server.
3. Put the site into maintenance mode, or block access
This protects visitors from harm and protects your reputation. Use a maintenance page, or ask your host to take the site offline temporarily.
4. Tell your host
Good hosts help with logs, scans and restoring from backups. Ask what they can see about when the attack happened and which files changed.
5. Change passwords right away
Change the passwords for your hosting account, your database, your file transfer accounts and every WordPress administrator. Use long, unique passwords from a password manager. Change them from a device you trust, since the attacker may have captured passwords from an infected computer.
Cleaning the site
6. Scan for malware
Use a reputable scanner to find infected files. Remember that scanners can miss things, especially hidden backdoors. Treat the result as a starting list, not a final answer.
7. Check for a clean backup
If you have a backup from before the hack, restoring it may be the cleanest route. Find the date the problem started in logs, then restore a backup from before it. After restoring, update everything immediately, or the same weakness will be used again.
8. Replace WordPress core, themes and plugins with fresh copies
Do not trust files on an infected site. Download fresh copies of WordPress core, your theme and each plugin from trusted sources, and replace the existing files. Keep your uploads and your configuration, and check them separately.
9. Inspect the uploads folder
The uploads folder should hold images and documents, not code files. Look for PHP files or odd names there. Attackers often hide scripts among images.
10. Check for backdoors
Attackers leave hidden access so they can return. Check for unknown files in the root folder, strange code in the configuration file, new scheduled tasks and unknown administrator accounts. Remove anything you cannot explain after you confirm it is not needed.
11. Review users and database content
Delete unknown users. Search your database for spam content or injected links in posts and options. This part often needs a developer, because cleaning the wrong row can break the site.
12. Remove unused plugins and themes
Delete anything inactive or abandoned. An outdated plugin is a common way in, and a clean-up is the right moment to shrink your attack surface.
Finding the cause
Cleaning without finding the cause is like mopping a floor while the tap is still running. Common causes include:
- An outdated or abandoned plugin or theme with a known flaw.
- A pirated plugin or theme with hidden code.
- A weak or reused password.
- An infected computer used to manage the site.
- Poor hosting with weak separation between accounts.
Check which software was out of date and look at access logs around the time the problem began. Fix the cause before you reopen the site.
Getting off warning lists
If search engines or browsers flagged your site, you must request a review after the site is clean. Use the site owner tools provided by the search engine. Explain what was found and what you did. Reviews can take a few days, and warnings usually disappear after approval.
Hardening afterwards
- Turn on automatic security updates where suitable.
- Add two-factor authentication to every admin account.
- Limit the number of administrators.
- Set up automatic backups stored away from your server.
- Add uptime and file change monitoring.
- Choose a security tool and configure it properly.
Our WordPress security checklist lists fifteen steps in priority order.
Mistakes that make cleanups fail
- Only deleting visible spam. The hidden backdoor stays, and the problem returns.
- Restoring a backup without updating. The same weakness is exploited again.
- Not changing passwords. The attacker still has access.
- Using the same password everywhere. One leak opens many doors.
- Skipping the review request. Warnings stay up longer than necessary.
When to get professional help
Call an expert if you sell products or collect personal data through the site, if the problem keeps coming back, if you cannot find a clean backup or if the hack involves your customers’ information. In some places, a data breach also has legal reporting requirements, so check the rules that apply to you.
How long it takes
A simple infection can be cleaned in hours. A deep compromise with hidden backdoors and database changes can take days. Rushing increases the chance of a repeat hack, so accept some patience in return for a clean result.
Prevention costs less
The steps that prevent a hack are the boring ones: updates, backups, strong passwords and monitoring. A monthly WordPress care plan covers them for a predictable cost, and that is usually much less than a cleanup and the lost trade during downtime.
Frequently asked questions
Will I lose my search rankings?
Short outages rarely cause lasting harm. Long-running spam injections and warning labels can. Clean the site fast and request a review.
Can I clean the site myself?
You can for a simple case, if you are careful and follow the steps above. For a store or a repeated hack, get help.
Should I rebuild from scratch?
Sometimes. If the site is small, rebuilding from clean content on a fresh install can be faster and safer than cleaning every file.
Does my host have to fix it?
Not usually. Some hosts offer cleanup, often at an extra cost. Ask what is included with your plan.
Next step
If your site is acting strangely right now, start with steps one to five and then decide whether to continue yourself. For a careful cleanup and a plan to stop it recurring, contact us or see our malware cleaning service.