Hacked WordPress site — the first hour
Redirects, spam pages, a warning in Google, or an email from your host. Do these four things now to stop the damage — then get the cleanup done properly, because a half-cleaned hack comes back.
Before anything else
Take a full copy of the site — files and database — exactly as it is now, infected. It is evidence of how they got in, and it is your way back if anything goes wrong next.
0 of 8 checks complete.
Is it actually a hack?
Visitors redirected somewhere else — often only on mobile, or only from Google. Spam pages under your own domain in search results. A browser or Google warning. Admin users nobody created. Your host suspending the account for outbound spam.
Contain — do these four now
Maintenance mode, or ask your host to do it. This protects your visitors and stops the damage compounding.
They see server-level logs you cannot, and they may already know how it got in.
WordPress admins, hosting control panel, FTP and the database. Assume all of them are known.
Do not start deleting files or plugins.
Panic-deleting destroys the evidence that shows how they got in — and a hack whose entry point is never found simply happens again.
Why the next part is not a DIY job
The files are the easy half. Malware also sits in the database, in scheduled tasks, and in backdoors left in places that look innocent — the uploads folder, wp-config, .htaccess. Miss one and the site is reinfected within days, usually worse.
Until the vulnerability that let them in is identified and fixed, every clean-up is temporary. That means reading logs, auditing versions and knowing what normal looks like.
Google only lifts a "this site may be hacked" warning after a review passes. Requesting one too early fails and slows down the next attempt.
This is the stage where most self-cleanups cost more than they save. It is worth handing over.
Your own checks
House rules, a client’s brand checks, the footgun your stack has and nobody else’s does. These stay in this browser — nothing is sent anywhere.
When this runs out
Send me the symptoms and your hosting details and I will tell you what you are looking at — I have done this cleanup enough times to know within a few minutes whether it is a small one or a rebuild. Fastest route is the contact form or a call.
43aryanchoubey@gmail.com · aryan-portfolio-beta-pink.vercel.app/contact