WordPress site hacked? What to do in the first hour
Your site sends visitors to strange pages or you cannot log in? Here is what to do, in order, which passwords to change and how to stop the next attack.
If your WordPress site was hacked, deleting the plugin that looks guilty will not fix it. This article shows how to recognise a break-in, what to do in the first hour and in what order, and what to change so it does not happen again.
Signs your WordPress site was hacked
Many hacks are invisible when you visit your own site. The attacker's code hides from logged-in administrators and targets new visitors, usually on a phone or arriving from Google.
The most common signs:
- visitors land on pages with ads, gambling or scams,
- Google shows pages in a foreign language that you never wrote,
- you find administrator accounts you do not recognise,
- your usual password no longer gets you into the dashboard,
- your host suspends the account or warns that the site is sending spam,
- the browser shows a red warning before the site loads.
If a customer says they ended up on a strange page, believe them, even if the site looks normal to you.
What to do in the first hour
The goal of the first hour is to stop the damage, not to clean everything. Deleting files at random destroys the traces that show how the attacker got in.
- Put the site behind a maintenance page, or ask your host to take it offline.
- Tell your hosting company. Many run scans and can say which files changed and when.
- Make a copy of the site as it is now, files and database. You need it for the investigation.
- From a clean computer, change passwords in this order: hosting account, WordPress dashboard, FTP, database, email addresses on the domain.
- Remove any administrator account you do not recognise.
The official WordPress guide for hacked sites also recommends changing every password and checking user accounts before the clean-up.
Why deleting one plugin is not enough
Attackers usually leave more than one way back in. A file hidden in the uploads folder or a line added to the active theme can restore the deleted code within hours.
A proper clean-up means reinstalling WordPress, the theme and the plugins from official sources, then checking the database. A backup helps only if you know when the attacker got in. A backup taken after the hack brings the problem back.
| Situation | What to do |
|---|---|
| You have a backup from before the hack | Restore it, update everything and change the passwords again |
| You do not know when it started | Ask for a full clean-up, file by file |
| The site uses pirated themes or plugins | Replace them with official versions or drop them |
After the clean-up, open the Security issues report in Google Search Console. If Google flagged the site, you request a review from there.
How to stop it happening again
Most hacks exploit a known weakness: an outdated plugin, a pirated theme or a reused password. You close them with simple habits, not expensive software.
- Update WordPress, the theme and the plugins at least once a month.
- Install plugins and themes only from official sources, never "free" copies of paid ones.
- Turn on two-factor authentication for every administrator.
- Keep automatic backups somewhere other than your hosting account.
- Delete plugins you no longer use.
If the site brings in orders or enquiries, call a specialist when you cannot get into the dashboard, when the problem returns after a clean-up or when your host has suspended the account. Every day of redirects costs you visitors and Google's trust.
Frequently asked questions
Can I clean a hacked WordPress site myself?
You can if you have a clean backup and know when the problem started. Without both, you risk removing the visible code and leaving a hidden way back in. The problem then returns within days.
Why does the site look normal to me?
The attacker's code often recognises a logged-in administrator or a returning visitor. Check from a phone, in a private window, arriving from Google.
Will I lose my Google rankings after a hack?
They can drop while Google shows warnings or indexes spam pages. After the clean-up and a review request in Search Console, the site can recover.
Is a security plugin enough?
It helps with alerts and blocks common attempts. It does not replace updates, unique passwords and backups kept separately.
In short
Stop the damage, keep a copy for the investigation, change every password and clean up from official sources. Then close the weaknesses attackers use to get in. If you want the team to check your WordPress site and keep it up to date, see our services.