Finding out that your WordPress website was hacked is stressful. Maybe customers see strange ads, Google shows a warning, your pages send visitors to other sites, or you cannot log in. The first day matters. Calm, careful steps can protect your customers, your data and your search presence. Panic, like deleting everything or reinstalling random plugins, can make it worse. This guide walks you through what to do in the first 24 hours, in simple steps.
Signs Your WordPress Site May Be Hacked
- Visitors are sent to another website, often only on mobile or only from Google.
- Spam pages, strange links or foreign-language text appear on your site or in Google results.
- A browser or Google shows a security warning for your site.
- New admin users that you did not create.
- You cannot log in, or your password was changed.
- Your hosting company suspends the account or warns about malware.
- The site becomes very slow, or your email starts landing in spam.
What Usually Causes a Hack
Most WordPress hacks come from a few common holes:
- Old versions of plugins, themes or WordPress itself.
- “Nulled” (pirated) premium plugins or themes that contain hidden code.
- Weak or reused passwords, especially for admin, hosting or FTP accounts.
- Too many admin users, including old staff or freelancers.
- Cheap hosting where many sites share the same space without good isolation.
Cleaning the files without fixing the hole is the main reason a hack comes back.
The First 24 Hours: Step by Step
Hour 0 to 2: Stay calm and limit the damage
- Do not delete things in a panic. You may remove evidence that shows how the attacker got in.
- Tell your hosting company. Many hosts can scan the account, show logs and restore backups.
- Put the site in maintenance mode if needed, especially if visitors are sent to harmful pages or if you take payments.
- Take a full copy of the site as it is now (files and database). Keep it separate. It helps the person cleaning the site.
Hour 2 to 6: Lock the doors
- Change all passwords from a clean computer: WordPress admin users, hosting panel, FTP/SFTP, database, and the email linked to the site.
- Remove unknown admin users after noting their names and emails.
- Turn on two-factor login for WordPress admin and your hosting account.
- Check your other accounts. If you used the same password elsewhere, change it there too.
Hour 6 to 18: Find and clean the infection
- Scan the site with a trusted security tool and ask your host for a server-side scan.
- Replace WordPress core files with fresh copies from WordPress.org.
- Reinstall plugins and themes from their official sources. Delete any you do not use, and remove any nulled ones completely.
- Check the database for injected scripts, spam links and unknown users.
- Look for the cause. Which plugin was out of date? Which account was used? Fix that hole.
Hour 18 to 24: Restore trust
- Update everything: WordPress, plugins, themes and PHP version, if your host supports it.
- Test the site on desktop and mobile, including forms and checkout.
- Check Google Search Console. Open the Security Issues report. Once every issue is fixed across the whole site, use “Request Review” and explain what happened and what you fixed. Google says reviews can take days or weeks.
- Tell customers if their data may be affected, and follow the law in your country on data breaches.
Keep a Simple Incident Note
While you work through the steps, keep a short written note. It helps your developer, your host and, if needed, your Google review request. Write down:
- The date and time you first noticed the problem, and what you saw.
- Any warnings from your host, browser or Google, with screenshots.
- Unknown users, files or plugins you found.
- Every password you changed and every account you checked.
- What was cleaned, restored or removed, and by whom.
- The cause you found and how it was fixed.
This note also becomes your checklist for the next few weeks, when you keep watching the site for signs of a return.
Restore From Backup or Clean the Site?
| Option | When it works | Watch out for |
|---|---|---|
| Restore a clean backup | You have a backup from before the hack, and you know roughly when it happened | The hole is still there. Update and fix it right after restoring. Recent orders or posts may be lost. |
| Clean the current site | No clean backup, or you cannot lose recent data | Takes more care. Hidden backdoors are easy to miss. |
| Rebuild from scratch | The site is old, heavily infected, or full of unknown code | Takes longer, but gives you a clean, modern base. |
What Affects the Cost of Cleaning a Hacked Site
- How badly the site is infected, and how many files and database tables are affected.
- Number of sites on the same hosting account. One infected site can affect others in the same account.
- Whether a clean backup exists.
- Size of the site, such as a store with thousands of products.
- Extra work after cleaning, such as the Google review, email fixes and hardening.
- Ongoing protection, like monitoring, backups and updates.
See our Website Security packages for cleanup and protection.
How to Stop It Happening Again
- Keep WordPress, plugins and themes updated every month, or sooner for security updates.
- Use only licensed plugins and themes from official sources.
- Use strong, unique passwords and two-factor login.
- Give admin access only to people who need it, and remove old users.
- Keep automatic backups stored away from the website server.
- Use good hosting with security tools. See Cloud Hosting Setup.
- Have someone check the site regularly. Our Website Care plans include updates, backups and checks.
Common Mistakes to Avoid
- Only deleting the files you can see, while the backdoor stays.
- Restoring a backup and not fixing the hole, so the hack returns.
- Changing only the WordPress password and forgetting hosting, FTP and database passwords.
- Installing many security plugins at once, which can slow or break the site.
- Asking Google for a review before the whole site is clean.
- Using a nulled plugin again after cleaning.
- Ignoring the problem because “the homepage looks fine”.
Frequently Asked Questions
Will my Google rankings come back after cleaning?
Fixing the site and removing warnings is the first step, but nobody can promise when or whether rankings return to where they were. A clean, fast and updated site gives you the best chance. See our SEO packages.
Can I fix a hacked site myself?
If you are comfortable with hosting panels, file managers and databases, you can follow the steps above. If not, get help, because missed backdoors are common.
Should I delete the website and start again?
Not in a panic. First take a copy and find the cause. Rebuilding can be the right choice for very old or heavily infected sites, but decide calmly.
How do I know the hack is fully gone?
Run fresh scans, check for unknown users and files, watch the site for a few weeks, and check Google Search Console for new security issues.
My hosting account was suspended. What now?
Contact your host, ask what they found, and ask for temporary access to clean the site. Many hosts will lift the suspension after the malware is removed.
Was customer data stolen?
It depends on the type of hack. If you store customer data or take payments, ask an expert to check, and follow your local law on informing customers.
My emails are going to spam after the hack. Why?
Hacked sites are sometimes used to send spam, which can hurt your domain’s reputation. After cleaning, check your email settings. See Business Email Setup.
Conclusion
Stay calm, do not delete things in a panic, change every password, take a copy of the site, and clean the malware and the cause together. Then update everything, check Google Search Console, and put regular care in place so it does not happen again.
Need help with a hacked WordPress site? Rawaani gives a written quote before work starts, and our launch offer is 40% off until 30 November 2026. See Website Security packages, explore our IT and cloud services or compare all our prices.
