Your WordPress site has been hacked. What to do in the first hour.

Take the site into maintenance mode, change every password including hosting and database, and do not delete anything yet.

The instinct is to start removing suspicious files, but the evidence of how the attacker got in is usually inside those files. Delete it and you will be cleaned up and reinfected within a fortnight.

What follows is what to do in the first hour, in order, and where to stop and get help. If you are not sure whether you have actually been hacked, start with the warning signs instead.

First, the six things to do now

1. Put the site into maintenance mode, or take it offline. This protects your visitors and stops Google indexing whatever has been injected. If the site is serving malware to customers, every minute it stays up compounds the problem.
   
   
2. Change every password. WordPress admin accounts, hosting control panel, FTP or SFTP, database, and the email accounts attached to any of them. Reused passwords are one of the most common ways a compromise spreads from one system to another.
   
   
3. Take a full backup of the site as it is now, infected. This sounds wrong, and it is the single most important step. You need a forensic copy before anything changes, because it is the only record of how the attack worked.
   
   
4. Check your user list for accounts you do not recognise, particularly administrator accounts created recently. Do not delete them yet. Note them down.
   
   
5. Contact your host. Most hosts have seen this hundreds of times, many will have server-side logs you cannot access yourself, and some will have already suspended the account. They can tell you when the intrusion started, which narrows everything else down.
   
   
6. Check Google Search Console for security issues, and check whether your domain has been flagged. If Google has marked the site as deceptive, visitors are seeing a red warning screen, and getting that lifted is a separate job from cleaning the site.

Site down and out of your depth?

If your site is live and compromised, the fastest thing you can do is talk to a developer. Our team is in Manchester and works on WordPress every day. Get in touch, and we will tell you straight away whether this is something you can handle or something you need help with.

What not to do.

Most of the damage in a WordPress compromise happens in the response, not the attack.

• Don't delete files you think look suspicious. Without knowing what the attacker changed, you are as likely to break the site as clean it, and you destroy the evidence trail.

• Don't immediately restore an old backup and consider it done. If the vulnerability that let them in is still present, and it usually is, you have simply reset the clock. Restoring a backup is a step, not a solution.
  
  
• Don't reinstall plugins from scratch and assume that clears it. Compromises frequently sit in the uploads directory, in the database, or in files that look entirely legitimate.
  
  
• Don't ignore it because the site looks normal to you. A large share of WordPress compromises are deliberately invisible to logged-in administrators and only show malicious content to search engines or to visitors arriving from Google.
  
  
• Don't skip telling people. If customer data may have been accessed, you have obligations under U GDPR and the timescales are short. 

How to tell how serious it is.

Not every compromise is equal, and the response should scale to the severity. Broadly, there are three levels.

1. Nuisance

Spam links injected into pages or posts, usually invisible to you and visible to Google. Irritating, damaging to rankings, and generally the cheapest to resolve.

2. Serious

Redirects sending your visitors elsewhere, injected scripts, fake admin accounts, or your server being used to send spam. At this point, your domain reputation and your email deliverability are both at risk, and Google may already have flagged you.

3. Critical

Any evidence of database access where customer data, orders or personal information is held. This is no longer a website problem. It is a data breach, and the priority shifts from fixing the site to establishing what was taken.

If you can't confidently place your situation in one of those three, treat it as the level above your guess.

How the clean-up actually works.

A proper remediation has five parts, and skipping any one of them is why sites get reinfected.

1. Identify the entry point. Usually an outdated plugin or theme, sometimes stolen credentials, occasionally the hosting environment itself.
   
   
2. Remove the malicious code, including anything left in the database and in the uploads directory, not just in the plugin that was exploited.
   
   
3. Find and close the backdoors. Attackers almost always leave a second way in, and this is the step that separates a clean-up that holds from one that does not.
   
   
4. Patch the vulnerability that allowed it, and update everything else while you're there.
   
   
5. Harden and monitor, so the next attempt is caught rather than discovered.

Why it happened.

It's almost certainly not because WordPress is insecure.

Security researchers consistently find that the overwhelming majority of WordPress compromises come through plugins and themes rather than WordPress core, followed by weak and unpatched hosting.

Which is uncomfortable, because it means the cause is usually something that was known about and could have been prevented. We have written separately about where the real risk sits and about why so many businesses stop updating.

Stopping it from happening again.

Once the site is clean, the work that matters is unglamorous: updates applied on a schedule rather than when someone remembers, a staging environment so updates can be tested before they go live, backups that are stored off the server and actually tested, restricted admin access with two-factor authentication, and monitoring that tells you about a problem rather than leaving you to notice it.

None of that is difficult. It just needs to be somebody's job. When it's nobody's job, this article becomes relevant again in about eighteen months.

Common questions.

Can a WordPress site be hacked?

Yes, like any website on any platform. WordPress is targeted more than most simply because it powers such a large share of the web, which makes automated attacks against it worthwhile at scale. The platform itself is well maintained; the risk almost always sits in what has been added to it.

How do I find hacked files in WordPress?

Compare your installation against clean copies of WordPress core, your theme and your plugins, and look for files whose modification dates do not match a change you made. Malicious code is frequently obfuscated and placed in legitimate-looking files, so a visual scan is unreliable. This is the point at which a scanner or a developer is worth more than an afternoon of your time.

Will I lose my Google rankings?

Possibly, temporarily, and it's recoverable. Rankings suffer when Google detects injected content or flags the site as unsafe. Once the site is clean and you have submitted a review request through Search Console, positions usually return, though it can take weeks. The longer a compromise stays live, the longer the recovery.

Should I just rebuild the site instead?

Sometimes, yet. If the site was already outdated, running abandoned plugins, or built in a way no one can maintain, a clean-up buys you months rather than years. We'll tell you honestly which situation you're in, because a remediation on a site that needs replacing is money spent twice.

Talk to our team.

We build and maintain WordPress sites for businesses across the UK from our HQ in Manchester, UK, with security handled at the code level rather than patched on afterwards. No juniors, no outsourcing.

If your site has been compromised, or you would rather it never was, we should talk.