Your WordPress Site Got Hacked: What to Do First

It usually starts with a phone call. Picture a fastener manufacturer in Derabassi. A dealer rings the sales manager: “I clicked your website from Google and it sent me to some betting site.” The sales manager opens the site on his laptop and it looks perfectly normal. Then he tries it on his phone, from a Google result, and sees the same thing the dealer saw.

What the business does in the next hour decides whether this is a bad week or a bad few months. This lesson is about that hour, the cleanup after it, and the long tail of spam that a hack leaves in Google and Bing.

If you are not sure yet whether your site has been hacked, start with our list of signs your WordPress site has been hacked, then come back here.

01Why Should You Not Start Deleting Files?

The natural reaction is to log in and start removing anything that looks strange. It feels like action. It usually makes things worse.

Panic-deleting wipes out the evidence of how the attacker got in, which is the one thing a cleanup must find. It can break the site, so now it is hacked and down. And the files you can see are rarely the ones that matter. The part that lets the attacker come back is usually hidden somewhere else, and it survives your tidy-up.

Copy first. Clean second.

02What Should You Do in the First Hour?

None of this needs technical skill. It needs someone calm with the account logins.

1. Write down what you saw: what happened, on which device, from which link, at what time. Take screenshots. Your developer and your host will both ask.
2. Take a full copy: files and database, even though they are infected. Store it off the server, label it clearly as infected, and never restore from it without checking. It is your record of what happened.
3. Secure the accounts above WordPress: from a computer you trust, change the passwords for the hosting panel, the domain account and the email address that can reset them, and switch on two-factor login. These are the keys to everything else.
4. Contact your host: ask whether their scanners have flagged anything, what changed recently, whether other sites share the same hosting account, and which of their backups go back furthest.
5. Tell whoever looks after the site: your developer or agency, with your notes and the copy.

What about the WordPress admin, database and FTP passwords? Change them too, but understand they will need changing again once the cleanup is done. While a hidden backdoor is still on the server, an attacker may not need a password at all. The final reset, after cleanup, is the one that locks them out.

03What Does a Proper Cleanup Involve?

You do not have to do the cleanup yourself, but you should know what a proper one looks like, so you can tell it apart from a quick scan and a “should be fine now”. A thorough cleanup covers these steps:

• Find the way in: an out-of-date plugin, a stolen password, an old PHP version. Recent alerts such as PHP2Shell show that the weakness can sit underneath WordPress, not just inside it.
• Replace, do not repair: WordPress itself, plugins and themes are replaced with fresh copies from their official sources rather than edited file by file.
• Check everywhere else: the uploads folder, the main website folder, and every other folder in the hosting account, not just the WordPress content folder.
• Check the database: admin users nobody can name, and content or settings the business never added.
• Reset every key: all passwords again, plus WordPress’s security keys, which signs everyone out at once.
• Update and close the door: everything updated, then hardened, as in our guide on how to harden WordPress.

At the end, ask for a short written report. For the manufacturer, a good one might read:

Way in: a form plugin last updated two years ago — Removed: hidden files in the uploads folder and the main folder, one unknown admin user — Replaced: WordPress, all plugins and the theme — Reset: all passwords and security keys — Still to watch: Google results for spam pages over the next few weeks

If whoever cleaned the site cannot tell you how the attacker got in, the job is not finished.

04Can You Just Restore a Backup Instead?

Only if the backup is from before the attacker got in, and only together with closing the hole. As we covered in the backups lesson, a backup taken after the break-in brings the attacker’s files back with it. A clean backup restored onto a site with the same weak plugin is reinfected the same way. A restore is a useful part of a cleanup. It is not a shortcut around one.

05Why Do Hacked Sites Get Reinfected?

Many owners clean a site, relax, and find it hacked again a few weeks later. It is rarely a new attack. It is usually the old one that was never fully removed.

If this has already happened to you, our post on why malware keeps coming back on WordPress walks through each of these causes in more detail.

06Why Is Google Still Showing Spam Pages?

This is the part that surprises people most. The site is clean, the redirects have stopped, and a search for your business still shows pages about casinos or cheap medicines on your domain. Search engines take weeks, sometimes longer, to forget what they saw.

Search Google for site: followed by your domain to see what is indexed. Then ask your developer to make sure every spam address returns a “410 Gone” response, which tells search engines the page has been removed for good. Sending them all to your home page, or showing a normal page, keeps them hanging around.

In Google Search Console, check the Security issues report. If Google flagged your site, fix the problem first, then use the button there to request a review. The Removals tool can hide the worst spam addresses from results for a while, which helps while the 410 responses do the permanent work. Bing Webmaster Tools has its own content removal tool and is worth the same attention, since Bing results also feed Microsoft Copilot and DuckDuckGo. Then be patient. Watch the site: search every week or two and note the trend.

07How Do You Stop It Happening Again?

Everything in this module, done and kept up: a named person on updates, two-factor on every login that matters, backups off the server and tested, file change alerts that reach someone who reads them. If you would rather not carry this alone, we clean hacked sites and look after them afterwards as part of our WordPress development work, and we will tell you plainly what we find.

08What Comes Next?

Module 5 is about running the site week to week. It starts with the monthly WordPress maintenance checklist: updates, backups, uptime, a form test, broken links and renewals, the routine that keeps a day like this one from coming at all.