WordPress Site Hacked? What to Do First, Step by Step

Your site redirects visitors to spam, Google shows a “This site may be hacked” warning, your host suspended the account, or strange admin users appeared. Finding out your WordPress site has been hacked is stressful. Acting in the right order limits the damage and stops the attacker coming back.

This guide covers what to do in the first hour, how to clean the site, and how to keep it clean.

Do not delete the site or restore a random backup yet. If the backup was taken after the infection, the malware comes straight back. Contain the problem first.

Signs your WordPress site has been hacked

Visitors, especially from Google or on mobile, are redirected to spam, pharmacy, or casino sites.
Google Search Console or Chrome shows a security or “deceptive site” warning.
Your host suspended the account or emailed about malware or spam sending.
Unknown admin users, plugins, or files appear.
Search results for your site show Japanese or spammy titles you did not write.
The site becomes very slow or your server sends large amounts of email.

Step 1: Take a snapshot before you change anything

Download a full copy of the files and an export of the database as they are now. It sounds odd to back up a hacked site, but this copy helps you find out how the attacker got in, and it protects you if a cleanup step goes wrong. Store it offline and do not restore it.

Step 2: Lock the attacker out

Change these passwords, from a computer you trust:

All WordPress administrator accounts. Delete any admin users you do not recognize.
Your hosting control panel and SFTP/FTP accounts.
The database password (then update it in wp-config.php).
Your domain registrar and email accounts if they share passwords.

Then generate new security keys: replace the AUTH_KEY to NONCE_SALT lines in wp-config.php with fresh values from https://api.wordpress.org/secret-key/1.1/salt/. This logs out every session, including the attacker’s.

Step 3: Scan to find what is infected

Run a server-side scan if your host provides one.
Install a security scanner such as Wordfence or Sucuri Security and run a full scan. These compare core files against the official versions and flag known malware.
Check for recently modified files in wp-content, especially PHP files inside uploads, which should normally contain only images and documents.
Look at .htaccess files for redirect rules you did not add.

Step 4: Clean the infection

Replace WordPress core: re-upload fresh wp-admin and wp-includes folders and root files from the same WordPress version.
Reinstall plugins and themes from clean sources: delete each plugin and theme folder and install a fresh copy from WordPress.org or the vendor. Remove anything you do not use, and anything “nulled” (pirated premium plugins are a very common infection source).
Remove injected code: check wp-config.php, theme functions.php, and .htaccess for obfuscated code such as long eval(base64_decode(...)) strings.
Clean the database: look for spam links or scripts injected into posts, widgets, and the wp_options table, and for unknown admin users.
Delete PHP files from uploads: legitimate sites rarely need any .php file inside wp-content/uploads.

Rescan when you finish. One missed backdoor file is enough for the attacker to return within days.

Step 5: Find and close the way in

Cleaning without closing the entry point is the most common reason sites get reinfected. Typical entry points:

An outdated plugin or theme with a known vulnerability
A weak or reused admin password, or an old user account that was never removed
Nulled premium plugins or themes
Another infected site on the same hosting account
Exposed or reused FTP and hosting credentials

Update everything, remove unused plugins, themes, and user accounts, and turn on two-factor authentication for admin users.

Step 6: Remove warnings and tell Google

In Google Search Console, open Security & Manual Actions → Security issues, confirm the issues are fixed, and click Request review.
If your host suspended the site, reply to their notice with what you cleaned and ask them to rescan.
If spam pages were indexed, return a 404 or 410 for those URLs so Google drops them.

Step 7: Harden the site so it stays clean

Keep WordPress, plugins, and themes updated, ideally weekly.
Use strong unique passwords and two-factor authentication.
Add define( 'DISALLOW_FILE_EDIT', true ); to wp-config.php to disable the built-in code editor.
Run daily off-site backups so you can restore a clean copy quickly.
Use a firewall at the host, plugin, or CDN level, and monitor uptime and file changes.

Need it cleaned properly? Our Malware Removal service removes malware and backdoors, checks for injected code and rogue users, and hardens the site afterwards. Prices start at $49, confirmed after an initial review before any work begins. Request malware removal.

Frequently asked questions

Can I just restore a backup?

Only if you know the backup is from before the infection, and only after you change passwords and close the entry point. Otherwise the attacker gets back in the same way.

Why is the site only hacked for Google or mobile visitors?

Many infections hide from logged-in administrators and desktop visitors so the owner does not notice. Test from a private window, on mobile data, and by clicking your site in Google results.

How long does Google take to remove the warning?

After you request a review in Search Console, reviews usually take from a day to a few days. The warning stays until Google confirms the site is clean.