WordPress Site Hacked? What to Do First

The short answer

If your WordPress site has been hacked, do not delete anything yet. Write down what you can see, take a copy of the site as it is, change every password and secret key that touches it, scan it, replace the WordPress core folders with clean files of the same version, and only then ask Google to review the site.

That order comes from WordPress.org's own guidance, My site was hacked, and the reasons for each step are below. You can check what your site is doing to visitors right now with the redirect checker and the HTTP header checker. If you would rather hand the cleanup to someone, our website fixes and maintenance service includes WordPress cleanup at a fixed price per fix.

Is it really hacked?

Not every problem is a hack, and the steps differ. WordPress.org lists the clear signs, which it calls indicators of compromise:

• The site is blacklisted by Google, Bing or another search engine.
• Your host has disabled the site.
• The site has been flagged for distributing malware.
• Visitors say their antivirus is flagging it.
• You are told your site is being used to attack other sites.
• Something happened that nobody authorised, such as a new user account.
• You can see the damage when you open the site.

Two quick checks help you tell. First, trace the address with the redirect checker. It follows each hop and shows the status codes, so a home page that bounces somewhere you do not recognise is visible at once. It fetches the address directly, so a redirect that only fires for people arriving from a search result or from a phone may not show up. That is one reason to also open your site from a Google result on your phone. Second, look at the headers the server returns with the HTTP header checker. It will not find malware, but it records what the server sent at that moment, which is useful evidence for step 1.

Then open the Security issues report in Google Search Console. Google says it covers hacked content, malware and social engineering, and hacked content means content placed on your site without your permission because of security vulnerabilities. If the report lists issues, you have your answer, and a list of sample URLs to start from.

The order that works

1. Document what you see

Before you touch anything, write down what leads you to think you are hacked, what time you noticed it and in which time zone, and what changed recently: a new plugin, a theme edit, a new user. WordPress.org calls this the baseline of an incident report, and it is useful whether you fix the site yourself or hand it to a professional. Take screenshots. Note which host and which plan you are on.

2. Take a snapshot, even of the infected site

You hopefully have a clean backup. Regardless, WordPress.org recommends taking one more snapshot of the environment before you start cleaning, because even an infected copy is something to reference if a cleaning step goes wrong. Copy the files and export the database, and keep the copy off the server. This is also the moment to ask your host what its backup policy is.

3. Lock access

Attackers keep coming back through the door they used, so close it before you clean. Per WordPress.org:

• Change every access point, not only the WordPress login: SFTP or FTP, the hosting control panel, the database, and every user with access to the environment, administrators first. Use long, unique passwords from a password manager.
• Delete accounts you do not recognise in the Users list.
• Replace the secret keys and salts in wp-config.php with a fresh set from the WordPress key generator. This logs out everyone who is currently signed in, including any attacker holding a session.
• Scan your own computer. WordPress.org points out that the source of an attack often starts on the site owner's machine, where malware can capture FTP and wp-admin logins. If one antivirus finds nothing, try another.
• Consider two-factor authentication for administrators.

4. Scan, and ask your host

Use more than one kind of scanner. WordPress.org names remote scanners such as VirusTotal and Sucuri SiteCheck, and plugin scanners such as Wordfence, Sucuri and Quttera, and notes that no single solution is best, but together they improve your odds. Our website health checker is not a malware scanner, but it will show whether the basics (SSL, DNS, redirects and headers) look as they should.

Also tell your host. On shared hosting the hack may have affected more than your site, and the host can confirm whether you have a hack or a loss of service. WordPress.org flags one more consequence: sites abused to send spam can get their IP addresses blocklisted, which hurts your real email. If your business mail suddenly lands in spam, see how to check a DMARC record and fix a DMARC fail for the authentication side of that problem.

5. Find it and remove it

This is the hard part, and the method depends on the symptoms. The principle is to replace what you can replace and inspect what you cannot.

• Replace /wp-admin and /wp-includes. WordPress.org says you can replace these directories safely. Use the same WordPress version your site runs, because an older or newer one is likely to break it. Do the replacement by SFTP, by dragging the folders over, and not with the reinstall button in the dashboard. WordPress.org's reason is that those installers often only overwrite existing files, while hacks often introduce new ones.
• Review wp-content carefully. It holds your themes, plugins and uploads, which are the files that are not identical on every site. Reinstall plugins and themes from their official sources, and delete any you do not use. The uploads folder holds media, so a PHP file inside it deserves suspicion.
• Check .htaccess. WordPress.org calls it one of the files most often modified for malicious purposes, whatever the type of infection. There can be copies in several directories.
• Inspect the files that load on every request: index.php, header.php, footer.php and the theme's functions.php. If one is modified, it can affect every page.
• Check the database users as well as the files, since a new administrator can survive a file cleanup.

If you use version control, compare against a known-good commit. If you do not, a clean copy of your theme and plugins from their vendors gives you something to compare against.

6. Update, change the passwords again, then ask Google

Once the site is clean, update WordPress, plugins and themes to the latest versions, because older versions are more prone to attack. Change the passwords again. WordPress.org is explicit that this is a second change, after you are sure the site is clean: a password changed while an attacker still had access can be captured again. Consider changing the database user and its password too, and update wp-config.php to match.

Then look at the Security issues report. Google says fixing the issue on some pages will not earn a partial return to search results, so fix every listed issue on every page, then choose Request Review, explaining what was wrong, what you changed and what the result was. Reviews can take several days or weeks, according to Google, and you should not resubmit while one is pending.

If you cannot log in

Attackers often hijack administrator accounts. WordPress.org's way back is to reset the password through the standard process. If that fails, use phpMyAdmin or Adminer, which many hosts provide, to open the wp_users table directly. If you do not want to deal with password hashes, change the administrator's email address in that table, go back to the login screen, choose Forgot Password and wait for the email.

Make it harder next time

WordPress.org's hardening guide is the short list:

• Keep WordPress, plugins and themes updated, and use automatic updates where you can.
• Use strong, unique passwords and enable two-step authentication.
• Back up regularly, and test that you can restore.
• Restrict file permissions: directories 755 and files 644, with write access for the web server only where needed.
• Disable the theme and plugin file editor by adding define( 'DISALLOW_FILE_EDIT', true ); to wp-config.php. The guide notes this will not stop an attacker who can upload files, but it may stop some attacks.
• Delete unused plugins and themes.
• Require HTTPS for administration.

Then check the headers your site sends with the security headers checker, and read our security headers checklist for what each one does.

A backup is not a fix by itself. Restoring last month's copy removes the infection and keeps the hole it came through, so work out how the attacker got in. WordPress.org calls this forensics, and admits it is often hard for site owners without the logs. Your host's access logs and the dates in your incident notes are the place to start.

When to hand it over

Do it yourself if you have a clean backup, SFTP access and a quiet afternoon. Hand it over when:

• the site takes payments or holds customer data;
• the infection comes back after a cleanup;
• you cannot tell which files are yours;
• Google or your host has flagged the site and you need it back for business reasons;
• the access you need belongs to a former developer (read getting your website back from a previous developer first).

Our website fixes and maintenance service covers WordPress cleanup and updates, with a fixed price for each fix and a re-run of the checks afterwards. We cannot promise how long Google will take to lift a warning, because that part is Google's, but we can tell you what is wrong and what it takes to fix it. Send us the symptoms and we will say what we would check first.

Frequently asked questions

How do I know if my WordPress site is hacked?

Look for the signs WordPress.org lists: a blocklist warning from a search engine, your host disabling the site, a malware flag, antivirus warnings from visitors, accounts you did not create, or visible damage. Search Console's Security issues report will list hacked content that Google has found.

What do I do first if my WordPress site is hacked?

Document what you see, take a snapshot of the site as it is, change every password and the secret keys, then scan. Do not delete files or restore a backup before you have a copy.

Why is my WordPress site redirecting to another site?

A redirect to a site you do not recognise is a common sign of a compromise, often in .htaccess, a theme file or the database. Trace it with a redirect checker, and inspect .htaccess and the files that load on every page.

I cannot log in to my hacked WordPress site. What can I do?

Try the normal password reset. If that fails, use phpMyAdmin or Adminer from your host to change the administrator's email in the wp_users table, then use Forgot Password.

Should I restore from a backup?

A clean backup is a useful starting point, but it does not close the hole the attacker used. Restore, then update everything, change every credential and find the way in.

How long does Google take to review a cleaned site?

Google says most reviews take several days or weeks. You receive an email when the request is received and another when the review is complete. Do not resubmit while it is pending.

Does Google remove a hacked website from search?

It can flag it or show warnings, and Google says a partial fix does not earn a partial return to search results. Fix every issue on every page, then request a review.