Short answer: if your WordPress site has been hacked, don't delete it and don't pay anyone who emails offering to fix it. In the first hour: change every password (WordPress, hosting, email and FTP), tell your hosting company, check Google Search Console for security warnings, and keep a copy of the site as it is. Then get it cleaned properly, by someone who will also find and close the hole they got in through, or it will happen again.
Hacked sites usually show it in one of a few ways. Visitors from Google get redirected to spam. Strange pages appear in search results under your name. Chrome shows a red "deceptive site ahead" warning. Or your host simply switches the site off. Whichever it is, the next hour matters.
A hack isn't the end of the website. Rushing the fix is how it becomes a much bigger problem.
Do these first
- Don't delete anything. You'll want the site as it is to find out what happened. Deleting files can also break things that are still working.
- Change your passwords. WordPress admin first, then your hosting account, FTP or SFTP, your database if you can, and the email account linked to the site. Use new, long passwords you haven't used anywhere else.
- Check who has admin access. In WordPress, go to Users and look for administrator accounts nobody recognises. Note them down before you remove them.
- Tell your host. Many hosts will scan the site, and some will restore a clean backup. They need to know anyway.
- Open Google Search Console. The Security Issues report shows whether Google has flagged the site and which pages are affected.
- Make a copy. Take a full backup of the files and database as they are now, and store it somewhere other than the server.
Things not to do
- Don't reply to emails offering a fix. Scammers watch for hacked sites and send these.
- Don't just restore an old backup and walk away. If the hole they got in through is still open, they'll be back.
- Don't install five security plugins at once. They clash, slow the site and rarely remove what's already there.
How it probably happened
Almost every WordPress hack we see comes down to one of three things: an out-of-date plugin or theme with a known security hole, a plugin someone stopped using but never removed, or a weak or reused password. It's very rarely WordPress itself. It's usually that nobody has been looking after it, which is why we wrote how to tell if your WordPress site is actually being looked after.
Getting it cleaned properly
A proper clean-up removes the malicious files and database entries, finds and fixes the way in, resets every password and key, updates everything, and asks Google to review the site so the warnings come off. It should also include some monitoring afterwards, because if anything was missed, it shows up within days.
| Step | Why it matters |
|---|---|
| Clean files and database | Hacks hide in both. Cleaning one leaves the other. |
| Close the way in | Otherwise it happens again, often within weeks. |
| Reset and update | Old passwords and old plugins are the usual route back in. |
| Google review | Warnings stay until Google re-checks the site. |
| Monitoring | Catches anything that was missed before customers do. |
Our hacked site clean-up is a fixed £495, including 30 days of monitoring. Most sites are back to normal within two working days. If you'd like it looked after properly from then on, WordPress care plans start at £95 a month.
Keep reading: Website security: the short list that matters · Free WordPress site checker
