My WordPress site got hacked: how to clean it and stop it happening again

Signs your WordPress site has been hacked

• Visitors are redirected to spam, gambling or fake-prize sites, sometimes only on mobile or only when arriving from Google.
• Google shows "This site may be hacked" in results, or browsers show a red warning page.
• Search results show pages you never created, often in other languages or for pharmaceuticals.
• New admin users you don't recognise.
• Your host suspends the account or warns about malware or spam emails.
• Strange files in the hosting account, or code you didn't add at the top of theme files.

Some hacks hide from logged-in admins, so check the site in a private window, on your phone and by clicking through from a Google search.

The first hour

1. Don't panic-delete

Deleting files at random can destroy the evidence of how the attacker got in, and break the site further.

2. Take a backup of the hacked site

Copy all files and the database as they are now. It sounds odd, but you'll need it to investigate, and to recover any content added since your last clean backup.

3. Put the site in maintenance mode or take it offline

If visitors are being redirected to harmful sites, protect them. Your host can help.

4. Change every password

WordPress admins, hosting control panel, FTP or SFTP, the database, email accounts linked to the site, and the domain registrar. Do it from a computer you trust, and turn on two-factor authentication while you're there.

Cleaning the site

5. Find out how they got in

The most common entry points:

• An outdated plugin or theme with a known vulnerability.
• A "nulled" (pirated) premium plugin or theme with malware built in.
• A weak or reused admin password.
• Another hacked site in the same hosting account.
• Stolen FTP or hosting credentials.

Your hosting access logs, the list of recently modified files and the list of plugins with known vulnerabilities usually point to the answer.

6. Replace core files, plugins and themes with clean copies

Re-install WordPress core files from the official source. Delete and re-install every plugin and theme from the official repository or the vendor, not from your hacked files. Delete anything you don't need.

7. Hunt for leftovers

Attackers leave back doors so they can return. Look in the uploads folder for PHP files (there normally shouldn't be any), check wp-config.php and .htaccess for added code, search the database for injected scripts and spam links, and remove admin users you don't recognise. A security scanner helps, but manual checks catch what scanners miss.

8. Restore from a clean backup if you have one

If you have a backup from before the hack and you know how they got in, restoring it and then fixing the entry point can be faster than cleaning. Update everything immediately after restoring.

9. Update, harden and monitor

Update WordPress, every plugin and theme, and PHP. Then apply the basics from our 15-point website security checklist: two-factor logins, limited login attempts, off-server backups and monitoring.

Getting Google's warning removed

If Google flagged the site, open Search Console and check Security issues. It lists what Google found and example URLs. Once the site is clean, click Request review and describe what you fixed and how you closed the entry point. Google's guide to hacked and malware-infected sites explains the process. Reviews for malware warnings are often quick; spam hacks can take longer.

Also remove spam pages the hack created: make sure they return a 404 or 410 so they drop out of Google over time.

Stopping it happening again

• Never install nulled plugins or themes.
• Keep plugins few, maintained and updated.
• Use unique passwords, a password manager and two-factor authentication.
• Keep automatic backups off the server, and test a restore.
• Separate important sites into their own hosting accounts.
• Watch for changes: file monitoring, uptime checks and Search Console alerts.

Questions after a hack

Will my host clean it for me?

Some hosts offer cleaning, often as a paid service. Others only suspend the account until you fix it. Ask what they cover.

Has my customers' data been stolen?

It depends on the hack. If the site stores personal data or takes payments, treat it seriously, investigate what was accessed and take advice on your legal obligations in your country.

Why does the hack keep coming back?

Because a back door remains, or the original entry point is still open. Cleaning without finding the cause rarely lasts.