A hacked WordPress site is stressful, but a calm, ordered response limits the damage. Recent large-scale attacks have shown that outdated plugins and core are still the main entry points. This guide follows the order we use when cleaning compromised sites.
Signs your site may be hacked
- Administrator accounts you did not create
- Spam pages, hidden links or posts in other languages
- Redirects to unknown sites, often only on mobile or from search results
- Browser or Google Search warnings
- New PHP files in uploads or unknown must-use plugins
Step 1: Contain
Take a full backup of files and database first, even of the infected state; it is evidence. Then restrict access: put the site in maintenance mode if needed, change hosting and WordPress passwords and block suspicious IPs at the firewall.
Step 2: Find the entry point
Check server logs around the time the first change appeared, list recently modified files, and compare plugin and theme versions with known vulnerabilities. Verify core files against official checksums.
Step 3: Clean files
- Replace WordPress core with a clean copy of the same version.
- Reinstall plugins and themes from trusted sources.
- Remove PHP files from uploads and unknown files in
mu-plugins.
Step 4: Clean the database
- Remove rogue administrator accounts and review all users.
- Search posts, options and widgets for injected scripts and spam links.
- Check for suspicious scheduled tasks (cron events).
Step 5: Rotate secrets
Regenerate WordPress salts and keys, change the database password and revoke or regenerate third-party API keys stored in the site.
Step 6: Update and harden
- Update core, plugins and themes; remove what you do not use.
- Enable a web application firewall and login protection. See firewall protection.
- Disable file editing from the dashboard and limit administrator accounts.
- Keep automatic, off-site backups.
Step 7: Recover search visibility
Request a review in Google Search Console if warnings were shown, remove spam URLs, submit the updated sitemap and monitor indexing. Our technical SEO service covers this clean-up.
Prevention costs far less than recovery. Follow our WordPress maintenance checklist or let WP Care handle updates, monitoring and backups. If your site is compromised now, contact us.
Frequently asked questions
How do I know if my WordPress site is hacked?
Common signs are unknown administrator accounts, spam pages or links, redirects to other sites, new files you did not upload, security warnings in browsers or search results, and sudden traffic drops.
Is restoring a backup enough?
Not on its own. If the vulnerability that allowed the attack is still there, the site can be compromised again. Find and close the entry point, update everything and rotate passwords and keys.
Should I change all passwords after a hack?
Yes. Change WordPress, hosting, database, FTP/SFTP and email passwords, regenerate the WordPress security keys and revoke API tokens that may have been exposed.