WordPress site hacked: what to do, step by step

Signs your site has been hacked

Hacks are not always obvious. Common signs include:

• visitors redirected to spam, gambling or fake prize pages, sometimes only on mobile or only when arriving from Google;
• search results showing your site with pages or titles you never wrote;
• a browser or Google warning that the site is unsafe;
• administrator accounts you do not recognise;
• your host suspending the account or reporting unusual activity;
• outgoing spam email from your domain.

If you see any of these, assume the worst until you have checked, and start with step 1.

The first hour: contain and preserve

Step 1: Contain the damage

1. Tell your host. They can see server logs you cannot, may already know about the problem, and may need to isolate the account.
2. Put the site into maintenance mode or ask the host to restrict access if it is actively harming visitors.
3. Change passwords, from a clean device. WordPress administrators, hosting control panel, FTP or SFTP, the database password and your email account. If your computer may be infected, use another device.
4. Log out all sessions. In WordPress you can log a user out everywhere from their profile. Changing the security keys in wp-config.php forces everyone to log in again.

Step 2: Preserve evidence and take a copy

Before you change anything else, take a full backup of the site in its hacked state and keep it separate from your clean backups. Label it clearly. This sounds odd, but you may need it to work out how the attacker got in, or to recover content added after your last clean backup.

Ask your host for access logs covering the period before the hack was noticed. They often show the request that started it.

Step 3: Work out the extent

• Users: list every administrator and remove any you did not create.
• Files: look for recently modified files, unfamiliar PHP files in the uploads folder (which normally contains only media) and changes to .htaccess or wp-config.php.
• Plugins and themes: look for any you did not install, and note any that were out of date. An outdated plugin with a known vulnerability is the most likely entry point.
• Database: injected scripts or links can sit in posts, options and widget settings.
• Scheduled tasks: attackers sometimes add tasks that reinstall their code.
• Scanner: run a reputable security scanner plugin, and use any scanning tool your host provides. Treat the results as a starting point, not a guarantee.

Step 4: Clean or restore

You have two broad routes, and often you combine them.

Route A: restore a clean backup

If you have a backup from before the hack, restoring it is usually the fastest route. The difficulty is knowing when the hack actually began, since it may predate the visible signs. Restore to a staging copy first, check it carefully, then put it live. Content added since that backup will need re-adding. Our guide to WordPress backups explains why keeping older backups matters here.

Route B: clean the site in place

1. Replace WordPress core files with a fresh copy of the same version from WordPress.org, keeping wp-config.php and wp-content.
2. Delete every plugin and theme and reinstall fresh copies from their official sources. Never reinstall from the hacked site's files.
3. Check the uploads folder for anything that is not media and remove it.
4. Inspect wp-config.php and .htaccess line by line for code you do not recognise.
5. Search the database for injected scripts and unfamiliar links.

If the site holds orders, bookings or anything business-critical and you are not confident doing this, bring in a professional. A partial clean-up often leaves a backdoor behind, and the site is reinfected within days.

Step 5: Close the way in

Restoring or cleaning without fixing the cause is the most common reason sites are hacked again.

• Update WordPress, every plugin and every theme to the latest versions.
• Remove plugins that are abandoned or that you do not need.
• Generate new security keys in wp-config.php.
• Enable two-factor authentication for administrators and reduce the number of administrator accounts.
• Check file permissions with your host.

Our guide to keeping your WordPress site secure covers the longer-term hardening steps.

Step 6: Tell the right people

Search engines

If Google flagged the site, check the Security Issues report in Google Search Console, confirm the problem is fixed and request a review. Warnings can take some time to clear after the review.

Personal data

If the hacked site held personal data, such as contact form entries, customer accounts or orders, the incident may be a personal data breach under UK GDPR. Organisations must report certain breaches to the Information Commissioner's Office within a strict time limit, and in some cases tell the people affected. Check the ICO's breach reporting guidance at ico.org.uk straight away, and take advice if you are unsure whether your situation needs reporting. Our guide to UK GDPR and WordPress gives background.

Customers and suppliers

If your domain sent spam or your visitors were redirected, a short, factual message to affected customers is better than silence.

After recovery

Keep a close eye on the site for the next few weeks: check administrator users and recently modified files weekly, and watch Search Console. Write a short note of what happened, how the attacker got in, what you changed and what it cost in time and money. It is not pleasant, but it turns a bad week into a clear list of improvements, and it is useful evidence if the ICO, an insurer or a customer asks questions later.

Then look at the routine that failed. Most hacks trace back to an update that was not applied, a password that was reused or an old administrator account that nobody removed. Fixing the routine is what stops it happening again. Hosting with regular backups and updates handled for you, such as WP Web Hosting's WP Managed plan, makes both the recovery and the prevention side much less work.

Frequently asked