Finding out your website has been hacked is stressful, but most hacked WordPress sites can be cleaned and secured. Work through these steps in order. If you’re not comfortable with any of them, this guide also tells you what to ask a developer or your host to do.
Signs your site has been hacked
- Visitors are redirected to spam, gambling, or pharmacy sites
- Google shows “This site may be hacked” or Chrome shows a red warning page
- Unknown administrator accounts appear in Users
- Your host suspends the account or reports malware
- Strange pages show up in Google search results for your domain
- The site suddenly becomes very slow or sends spam email
Step 1: Contain the damage
Tell your host. Many have security teams that can help, and they may need to know before your account is suspended. If customers could be harmed, for example on an online store, put the site into maintenance mode.
Step 2: Take a backup of the hacked site
It sounds backwards, but keep a copy of the site as it is now. It helps you find out how the attacker got in, and protects you if a cleanup step goes wrong.
Step 3: Scan the site
- Run a free external scan with Sucuri SiteCheck to see what visitors and Google see.
- Install a security plugin such as Wordfence and run a full scan. It compares your WordPress, plugin, and theme files with the official versions and flags changes.
Step 4: Change every password
Assume every password connected to the site is compromised:
- Hosting control panel
- SFTP/FTP and SSH accounts
- The database user (then update
wp-config.phpto match) - Every WordPress administrator
Also replace the security keys in wp-config.php with new ones from the WordPress secret key generator. This logs everyone out, including the attacker.
Step 5: Restore a clean backup, or clean the site
If you have a backup from before the hack, restoring it is the fastest fix. You still need to finish the remaining steps, or the attacker can use the same weakness again.
Without a clean backup:
- Reinstall WordPress from Dashboard → Updates → Re-install version.
- Delete every plugin and theme, then reinstall fresh copies from WordPress.org or the developer. Remove anything you don’t use, and never use “nulled” (pirated) premium plugins.
- Look for PHP files in
wp-content/uploads, which should contain only media. - Check
.htaccessandwp-config.phpfor code you don’t recognize. - Delete unknown administrator accounts.
- Scan again until the results are clean.
Step 6: Get Google’s warning removed
In Google Search Console, open Security issues. Once the site is clean, click Request review and briefly explain what you fixed. Reviews usually take a few days.
Step 7: Close the door
- Keep WordPress, plugins, and themes updated. See how to update WordPress safely.
- Turn on two-factor authentication for every administrator.
- Give people the lowest role they need, rather than making everyone an administrator.
- Set up daily remote backups so the next problem is a quick restore.
- Follow a monthly security checklist.
Catch the next one early
The longer a hack goes unnoticed, the more it costs. The Repork dashboard is designed to bring your security scans, backups, and uptime together so a problem stands out the day it appears.
