WordPress site hacked? What to do in the first hour — and after

A hacked WordPress site announces itself in ugly ways: visitors redirected to sites you have never heard of, spam pages appearing in your own search results, a red warning in the browser, an email from your host, or an admin user nobody created. What you do in the first hour matters — and so does what you refuse to do. Panic-deleting things destroys the evidence that tells you how they got in, and a hack whose entry point is never found gets repeated.

How do I know it is really a hack?

• —Redirects: your address opens, then lands somewhere else entirely — often only on mobile, or only from Google, which is deliberate camouflage.
• —Search results you never wrote: spam pages in pharmaceutical or gambling English appearing under your own domain.
• —Browser or Google warnings: “this site may be hacked” or a red interstitial before the page loads.
• —Admin users nobody created, or password-reset emails nobody requested.
• —The host suspending the account for outbound spam — often the first anyone hears of it.

The first hour, in order

• —Take the site out of public traffic — maintenance mode, or ask the host to do it. This protects visitors and stops the damage compounding while you work.
• —Contact your hosting company. They see server-level logs you cannot, they may already know the entry point, and some will run their own scan.
• —Change every password, not just the obvious one: all WordPress admin accounts, the hosting control panel, FTP and the database. Assume all of them are known.
• —Take a full copy of the site as it is — infected. It is evidence, and cleaning without a copy means any mistake is permanent.
• —Do not delete anything yet. Diagnosis first, then removal.

Find out what actually happened

Most WordPress compromises come through an outdated plugin or theme with a known vulnerability, a weak or reused password, or occasionally a neighbouring site on the same shared hosting. The host’s logs, the list of what was out of date, and a malware scan together usually name the door. This matters because the cleanup must close the door, not just sweep the floor.

Cleaning: files

WordPress core files can simply be replaced with a fresh copy from wordpress.org — never overwriting wp-content, which holds everything that is actually yours. Plugins and themes get the same treatment: delete and reinstall clean copies rather than trying to spot injected code by eye. The places that need a careful human read are wp-config.php, .htaccess and the uploads folder — attackers hide executable files where only media should live, and leave backdoors precisely so that a quick cleanup lets them straight back in.

Cleaning: database and users

Malware does not only live in files. Check the users table for administrators nobody created and delete them. Check that the site URL settings have not been altered. Search posts and options for injected scripts and spam links. If a recent, known-clean backup exists, restoring it and then updating everything is often faster and more trustworthy than cleaning in place — the judgement call is how much content you lose against how much certainty you gain.

Why half-cleaned means not cleaned

This is the step most DIY cleanups miss. A compromise that leaves one backdoor behind is a compromise that returns in a fortnight, usually worse. Complete means: entry point identified and closed, files verified or replaced, database audited, every credential rotated, and the site watched afterwards. In the rescue work on this site, a suspected compromise changes the job entirely for exactly this reason — thoroughness is not optional, it is the whole job.

After: make the next attempt fail

• —Update everything, and keep updating on a schedule — most hacks walk in through software that had a fix available.
• —Two-factor authentication on every admin account; unique passwords from a password manager.
• —Fewer plugins: every install is attack surface. Delete the inactive ones entirely — disabled code can still be exploited.
• —Backups on a schedule, stored off the server, and test-restored at least once.
• —A staging copy, so updates land somewhere safe before they land in production.

Will the Google warning go away?

Yes — after the clean-up is genuinely complete. Verify the site in Google Search Console if it is not already, use the security section to see exactly which URLs Google flagged, and request a review once they are clean. The warning lifts when the review passes. Requesting review with malware still present fails and slows the next attempt down, which is one more reason the half-clean shortcut costs more than it saves.

A hack is cleaned completely, or it is not cleaned at all.