Don’t Panic — But Act Quickly
Finding out your website has been hacked is stressful. Maybe visitors are being redirected to spam sites. Maybe Google is showing a warning. Maybe your host sent an email saying your account has been suspended.
The good news: most hacked WordPress sites can be cleaned up and secured. The key is to act quickly and in the right order, so you don’t make the problem worse or lose evidence of how it happened.
Here’s the plan I follow when a client’s website has been compromised.
Step 1: Confirm What You’re Seeing
Not every strange behavior is a hack. Before changing anything, take note of what’s happening:
- Is the site redirecting to unfamiliar websites?
- Are there pages, posts, or admin users you didn’t create?
- Is Google, your browser, or your host showing a security warning?
- Are customers reporting strange emails or pop-ups?
Take screenshots and write down when you first noticed the issue. That information helps with cleanup.
Step 2: Lock Down Access
Change the passwords for everything connected to the website:
- WordPress admin accounts
- Your hosting account
- SFTP/SSH and database users
- Your domain registrar
Remove any admin users you don’t recognize, and turn on two-factor authentication wherever it’s available. If you share logins with a former developer or vendor, now is the time to replace those with individual accounts.
Step 3: Contact Your Host
Your hosting provider can often tell you what changed and when, and many managed WordPress hosts have security teams and malware scanning built in. They may also have clean backups from before the hack.
Ask them for:
- Recent backups and their dates
- Access or error logs around the time the problem started
- Any malware scan results they have
Step 4: Clean It Up (Carefully)
Restoring a backup can be the fastest fix — but only if the backup is from before the infection and you also close the hole that let attackers in. Otherwise, the site often gets reinfected within days.
A proper cleanup usually includes:
- Scanning WordPress core, theme, and plugin files for modified or injected code
- Replacing core files with fresh copies
- Removing unknown files and suspicious scheduled tasks
- Checking the database for injected scripts and spam content
- Updating or removing outdated plugins and themes
This is where it helps to have someone who knows WordPress well. Malware is often hidden in places that look normal at first glance.
Step 5: Find Out How It Happened
Most WordPress hacks come from a handful of causes:
- An outdated or abandoned plugin with a known vulnerability
- A weak or reused password
- Nulled (pirated) premium themes or plugins
- Old, forgotten admin accounts
Fixing the symptom without fixing the cause is how sites end up hacked again a month later.
Step 6: Clean Up Your Search Results
If Google flagged your site or indexed spam pages, request a review in Google Search Console once the site is clean. Remove spam URLs, check that your sitemap only lists real pages, and keep an eye on your search results over the following weeks.
How to Keep It From Happening Again
Prevention is far less expensive than cleanup. The most effective habits are simple:
- Keep WordPress, plugins, and themes updated — and test updates before applying them
- Remove plugins you don’t use
- Use strong, unique passwords and two-factor authentication
- Keep regular, off-site backups
- Monitor your site for changes and downtime
That’s exactly what a WordPress maintenance plan is for. Updates are tested, security is monitored, and backups are there when you need them.
Final Thoughts
A hacked website feels like an emergency because it is one — but it’s also fixable. Move quickly, lock down access, work with your host, and make sure the cause gets fixed along with the symptoms.
If your WordPress site has been hacked or is behaving strangely, get in touch. I can help clean it up, find out what happened, and put a plan in place to keep it secure.
