WordPress site hacked? Recovery steps - and how to make it the last time

Discovering your website has been hacked is a horrible moment, but it is a recoverable one, and panicking is the one thing that makes it worse. This guide walks through what to do, calmly and in order: confirm the problem, contain it, clean the site, lock the attacker out, get back into search engines' good books, and - the part most guides skip - make sure it does not happen again. Work through it step by step. If at any point you feel out of your depth, that is a perfectly reasonable moment to bring in professional help rather than risk making things worse.

First, confirm it is actually a hack

Before anything drastic, make sure what you are seeing is really a compromise and not a plugin conflict or a hosting problem. Common signs of a genuine hack include: your site defaced or showing content you did not put there; visitors redirected to unfamiliar or spammy sites; a browser or search-engine warning that the site is unsafe; your host suspending the account for malware; unfamiliar administrator accounts appearing; new files or pages you did not create; a sudden flood of spam pages in search results for your domain; or being locked out of your own admin. One or more of these together points to a compromise rather than a glitch.

Step 1: Do not panic-delete

The instinct to start deleting things immediately is understandable and usually a mistake. Deleting files at random can destroy the evidence of how the attacker got in - which you need in order to close that door - and can break the site further. Just as importantly, do not delete your backups. A calm, methodical cleanup beats a frantic one every time, and the first move is to preserve the situation, not to lash out at it.

Step 2: Take the site offline

Contain the damage by taking the site offline or into maintenance mode. This protects your visitors from malware or scam redirects, stops your domain being used to spread the attack, and often satisfies your host and search engines that you are responding. It also stops an attacker who still has access from doing more harm while you work. A short, honest "down for maintenance" state is far better than leaving a compromised site serving customers.

Step 3: Preserve a copy of the infected state

Before you clean anything, take a full backup of the site as it is now - infected and all. This sounds counter-intuitive, but that snapshot is your forensic record: it lets you (or a professional) work out how the breach happened, and it is a safety net if the cleanup goes wrong. Store it separately and clearly labelled as compromised so it is never restored by accident.

Step 4: Scan to understand the infection

Now find out what you are dealing with. Your hosting provider often has malware scanning tools and logs that can identify infected files and the point of entry - start there, and contact their support, as they deal with this constantly. Reputable security scanners and WordPress security plugins can also identify malicious code and modified core files. The goal at this stage is a clear picture: which files are infected, which accounts are involved, and how the attacker most likely got in.

Step 5: Restore from a known-clean backup (if you have one)

If you have a backup from before the infection and you are confident it predates the compromise, restoring it is the fastest clean route - it replaces the whole infected site with a known-good version. Two cautions: make sure the backup genuinely predates the breach (attackers sometimes lurk for a while before acting), and understand that restoring an old backup loses any legitimate changes made since. Even after a clean restore, you must still close the hole that let the attacker in, or you will simply be reinfected - which means completing the hardening steps below regardless.

Step 6: If there is no clean backup, clean thoroughly

Without a clean backup, cleaning is more involved and is often the point to call a professional. In outline: reinstall the WordPress core from a fresh official copy to replace any tampered core files; delete your plugins and themes and reinstall them from fresh official downloads rather than trusting the existing files; inspect the uploads folder and the database for injected code, malicious scripts and unfamiliar administrator users; and remove anything that does not belong. This is painstaking work where missing a single backdoor means the attacker walks straight back in, which is why professional cleanup is worth it if you are unsure.

Step 7: Rotate every credential

Assume every password associated with the site is now known to the attacker, because it may well be. Change all of them: your WordPress administrator passwords, your hosting control panel, your FTP or SFTP accounts, and your database password. Regenerate WordPress's secret keys and salts so any stolen login sessions are invalidated. Change the password on the email account tied to the site too, since that is often the key to everything else. Delete any administrator accounts you do not recognise, and review the ones you do.

Step 8: Update everything and remove the excess

With the site clean and locked, bring everything fully up to date: WordPress core, every theme and every plugin. Then reduce your future risk by deleting anything you do not actively use - deactivated plugins, spare themes, unused accounts. The vulnerability that let the attacker in was very likely an out-of-date or abandoned plugin, so this step is not housekeeping, it is closing the door you just found open.

Step 9: Get back into search engines' good books

If your site was flagged or removed by a search engine, cleaning it is only half the job - you also have to tell the search engine it is safe again. In your search console account, look for the security-issues section, confirm you have resolved the problem, and request a review. It can take a little time for the warning to be lifted and for rankings to recover, so do this as soon as the site is genuinely clean. Our guide to why WordPress sites get hacked explains why the search damage happens and why it lingers.

Step 10: Harden against a repeat

A site that has been hacked once will be probed again, so finish by hardening it. Turn on two-factor authentication for every administrator, use strong and unique passwords, and limit login attempts. Consider a reputable web application firewall to filter malicious traffic. Keep plugins to a minimum and only from trusted sources. Set up automatic backups stored off the server, and test that you can restore them. And put some monitoring in place so that if something does go wrong again, you find out quickly rather than from an angry customer.

Tell your host straight away

Your hosting provider is one of your best allies in a compromise, so contact them early. They deal with hacked sites constantly, they can see server-level logs you cannot, they often have malware scanning and cleanup tools, and they may already have flagged the problem. On shared hosting a compromise can also affect neighbouring sites, so your host has every reason to help you resolve it quickly. A short support ticket explaining what you have found is often the fastest route to understanding the entry point.

Work out what data may have been exposed

A hack is not only a technical problem; it can be a data problem with legal weight. If your site holds customer information - accounts, orders, enquiry details - consider what an attacker could have reached. Under data-protection rules such as the GDPR, a breach of personal data can carry obligations to inform the people affected and, in some cases, the authorities, within strict timeframes. This is a point at which professional and, if needed, legal advice is wise. Do not quietly clean up and move on if personal data may have been taken; understand your obligations first.

Cleaning the database

Malware does not only live in files. Attackers frequently inject content and code into the database: spam links or scripts added to your posts and pages, malicious entries in the options table, and extra administrator users created so they can log back in. After dealing with the files, review the database for content you did not create and for user accounts you do not recognise, and remove them. If you are not comfortable working in the database directly, this is another good reason to involve someone who is - missed database malware is a common cause of a site looking clean but behaving otherwise.

Check redirects and server configuration files

A very common tampering is the injected redirect: a rule quietly added to a server configuration file that sends your visitors, or just visitors arriving from search engines, off to a spam or scam site. Because you often type your address directly, you may not even see it while your customers do. Check your server configuration and any redirect rules for entries you did not add, and restore them to a known-good state as part of the clean-up.

Scan your own computer and change email passwords

Sometimes the website was not the way in - your own computer was. Malware on a device you use to log in can steal your saved passwords and hand an attacker the keys directly. As part of recovery, run a reputable malware scan on the computers you use to manage the site, and change the password on the email account tied to the website, since control of that email often means control of everything else through password resets. A clean site accessed from a compromised laptop will simply be compromised again.

Bring the site back carefully, then watch it

When you are confident the site is clean, hardened and fully updated, bring it back online - but keep a close eye on it for a while. Watch for any sign of reinfection: unexpected files reappearing, strange redirects, new admin users, or a fresh warning from your host or a search engine. The days immediately after recovery are when a missed backdoor reveals itself, so vigilance now saves another full clean-up later.

How long recovery takes

A straightforward case where you have a clean backup can be resolved in a few hours: restore, harden, request a search-engine review, done. A harder case with no clean backup, a stubborn reinfection, or possible data exposure can take days and may need professional help. Getting search warnings lifted and rankings restored can take a further week or two on top. The lesson most owners draw from the timeline is how much cheaper prevention would have been than the cure.

From now on, keep a clean backup

Whatever else you change, leave this incident with one habit locked in: reliable, automatic backups stored off the server, tested so you know a restore actually works. The single thing that turns a hack from a disaster into an inconvenience is a recent, clean backup you trust. If this episode gives you nothing else, let it give you that.

A quick triage checklist

If you want the whole recovery at a glance, here is the order in one place:

• Confirm it is really a hack, not a glitch.
• Do not panic-delete; preserve evidence and backups.
• Take the site offline to protect visitors.
• Back up the infected state for forensics.
• Tell your host and scan to find the entry point.
• Restore a clean backup, or clean core, plugins, uploads and database thoroughly.
• Rotate every credential and remove unknown admin users.
• Update everything and delete what you do not use.
• Request a review to clear any search-engine warning.
• Harden, monitor, and keep a tested clean backup from now on.

Common mistakes during recovery

A few errors turn a recoverable hack into a drawn-out ordeal. Cleaning the files but forgetting the database leaves injected content and hidden admin users in place. Restoring a backup without closing the entry point invites immediate reinfection. Missing a single backdoor means the attacker strolls back in. Forgetting to rotate the email password leaves the master key in the attacker's hands. And bringing the site back live before it is genuinely clean re-exposes your visitors. Slow and thorough beats fast and partial every time.

What to tell your customers

Honesty is usually the right policy. If customers may have seen a warning, been redirected, or received spam appearing to come from you, a brief, calm message explaining that you had a security incident, have resolved it, and take their data seriously does more for trust than silence. If personal data may have been exposed, you may be legally required to inform those affected - which is another reason to establish early exactly what was reachable. Handled openly, an incident need not cost you a customer's confidence.

Prevention is far cheaper than recovery

Having been through a recovery once, most owners never want to repeat it - and the way to be sure is to remove the conditions that caused it. That means fewer plugins, disciplined updates, real backups and proper hardening, kept up indefinitely. For many small businesses the more durable answer is to stop carrying that responsibility personally: managed hosting where security is handled, or a platform where there are no plugins to secure at all. The cheapest hack to recover from is the one that never happens.

Keeping calm is half the battle

It is worth saying plainly: a hacked website is stressful, but it is rarely a catastrophe if you respond methodically. Sites are recovered from far worse than yours every single day. The mistakes that turn a bad day into a bad month are almost all born of panic - deleting the wrong things, skipping steps, rushing the site back online before it is clean. Slow down, work through the steps in order, and bring in help when you need it, and the odds are strongly in your favour.

The one habit that changes everything

If you do nothing else differently after this, make it backups. A recent, clean, tested backup stored away from the site is the difference between a hack that costs you an afternoon and one that costs you thousands. It will not stop a compromise, but it turns recovery from a forensic rebuild into a restore-and-harden. Set automatic backups up today, and actually test a restore, so that the next incident - if there is one - is an inconvenience rather than a crisis.

When to call a professional

There is no shame in bringing in help, and some situations call for it plainly: if you have no clean backup and are not confident cleaning core files and the database by hand; if the site keeps getting reinfected after you clean it, which means a backdoor is still present; if sensitive customer data may have been exposed, which can carry legal obligations; or if the site is critical to your income and every hour down matters. A professional cleanup costs money, but a half-finished cleanup that leaves a backdoor in place costs more.

Why it happened - and how to make it the last time

Once you are through the emergency, it is worth asking why you were in it. On WordPress the answer is almost always a plugin: an out-of-date, abandoned or vulnerable add-on that gave an attacker a way in. Our companion article, why WordPress sites keep getting hacked, explains the pattern in full. The uncomfortable truth is that keeping a plugin-heavy WordPress site secure is ongoing work, and a site that was hacked once can be hacked again if that work lapses. That is why, for many small businesses, the most durable answer is not just to clean this incident but to remove the category of risk - by moving to managed WordPress hosting where security is handled, or to a platform where there are no plugins to secure in the first place.

Frequently asked questions

Can I fix a hacked WordPress site myself? Often yes, if you have a clean backup to restore and then harden. Without a clean backup, cleaning core files and the database by hand is fiddly and error-prone, and professional help is sensible.

Will restoring a backup fix it for good? Only if you also close the hole that let the attacker in. Restore, then update and harden, or you risk being reinfected.

How do I know the site is fully clean? A reputable scan showing no malware, no unfamiliar admin users, up-to-date software, and no reinfection over time. If in doubt, have a professional verify it.

Will I lose my Google ranking? A flagged site can lose visibility temporarily. Clean it, request a review in your search console, and rankings generally recover over a few weeks.

How do I stop it happening again? Minimise plugins, update rigorously, use two-factor authentication and backups - or move to a platform where security is not your responsibility.

Should I rebuild rather than clean? Sometimes. If the site was old, fragile or full of abandoned plugins, a clean rebuild on a maintained platform can be quicker, cheaper and safer than cleaning and hardening the existing one - and it leaves you on a platform where this whole category of problem is no longer yours to manage.

This article is general guidance, not a substitute for professional incident response where sensitive data or legal obligations are involved.

A calmer alternative to running WordPress yourself

If the upkeep, the security worry or the cost of running WordPress has worn thin, a managed platform is worth a look. On the CMS Pros Platform, security, updates and backups are handled for you, your content and rankings come across intact, and the site stays genuinely yours to export at any time. See how a move works on our WordPress migration guide, or request a free migration audit and we will tell you honestly whether moving makes sense for your site.