Finding out you have a hacked WordPress site is a stomach-drop moment. Maybe the browser is throwing a warning, the homepage looks wrong, visitors are being redirected to something strange, or your host just emailed to say they suspended the account. Whatever tipped you off, the instinct is to panic and start deleting things. Try not to. This article walks through exactly what to do when your WordPress site is hacked, in the right order, so you can fix a hacked WordPress site without making it worse.
6 minute read · Published by WPSiteOps Team
Quick Answer
If you have a hacked WordPress site, do not panic and do not start deleting files at random. Take the site into maintenance mode if you can, change your important passwords, and confirm you have a recent clean backup. Then identify and remove the malicious code before you restore the site and reopen it. If you are unsure at any step, get professional help before you act, because the wrong move can destroy evidence or your only clean copy.
First, confirm you really have a hacked WordPress site
Not every scary-looking problem is a hack. A few common issues look alarming but are something else entirely, and the fix is very different.
- A plain white screen or an error message is often a plugin conflict or a failed update, not an attack.
- A “Not Secure” warning in the address bar usually means an expired or missing security certificate, not a breach.
- A site that is simply down may be a hosting outage rather than anything malicious.
The real signs of a hacked WordPress site tend to look different: pages that redirect to spammy sites, content or pop-ups you did not add, new admin accounts you do not recognize, a flood of strange files, or a warning from Google or your host that malware was detected. If you are seeing those, treat it as a hack and move carefully.
WordPress site hacked? What to do first, in order
Order matters here. Doing these in sequence protects your evidence, your data, and your ability to recover cleanly.
- Stay calm and stop changing things. Resist the urge to delete files or plugins in a hurry. Hasty changes can wipe out the clues needed to find the actual problem.
- Take the site offline or into maintenance mode. If the site is serving malware or redirects, taking it down protects your visitors and your reputation while you work.
- Change your important passwords. Update your WordPress admin, hosting, and database passwords, and your email if it shares a password. This helps lock out whoever got in.
- Confirm you have a clean backup. Find your most recent backup from before the problem started. A good backup is the difference between a quick recovery and a rebuild.
- Contact your host, then decide on help. Many hosts can tell you what they detected and may have their own backups. From there, decide whether to clean it yourself or bring in someone who handles WordPress malware removal regularly.
What not to do right now
In the rush to fix a hacked WordPress site, well-meaning owners often make the situation harder to recover from. A few things to avoid:
- Do not delete everything in a panic. Wiping files at random can take your clean content with the bad code and leave you with nothing to restore.
- Do not ignore it and hope it passes. Hacked sites tend to get worse, spreading to more pages and damaging your standing with Google and your visitors.
- Do not pay a ransom-style demand. If something on the site is demanding payment to restore access, treat it with suspicion rather than reaching for your card.
- Do not just install another plugin and assume it is handled. A scanner can help find problems, but thorough WordPress malware removal is a separate job from spotting the infection.
Cleaning up and closing the door behind it
Once the immediate steps are done, the real work is removing the malicious code and figuring out how it got in. WordPress malware removal usually means scanning the files and database for anything that does not belong, removing the injected code, and checking for hidden backdoors that let an attacker return even after the obvious mess is gone.
That last part is the step people miss. Removing the visible damage feels like the finish line, but if a backdoor is left behind, the site simply gets reinfected days later. Closing the door means updating everything, removing accounts and files that should not be there, and confirming the entry point is sealed.
It also helps to understand how you got here in the first place. Most break-ins are not dramatic. They come through outdated software and weak passwords, which is the same theme we cover in why WordPress sites get hacked in the first place. Understanding the entry point is how you keep it from happening again.
If your site is actively serving malware and you are not confident you can fix a hacked WordPress site safely, this is a reasonable moment to get in touch rather than risk a deeper mess.
After the cleanup: keeping it from happening again
Recovery is not finished when the site looks normal again. The point of cleaning up is to come out more secure than you went in, so the same gap does not get used twice.
- Update WordPress core, plugins, and themes, and remove anything you no longer use.
- Reset passwords again now that the site is clean, and turn on two-factor login.
- Make sure automatic backups are running so you always have a recent clean copy.
- Put ongoing monitoring in place so the next attempt is caught early instead of after the damage.
None of this is about fear. It is about not having to relive this same afternoon in a month.
When to call for help instead of going it alone
Handling WordPress malware removal yourself can make sense if the damage is small, you have a clean backup, and you are comfortable working in your files. It is worth bringing in help when the site is actively serving malware, when you cannot find a clean backup, when it keeps reinfecting after you clean it, or when the site is core to your business and downtime is costing you. There is no prize for struggling through a hacked WordPress site alone while it keeps spreading the problem.
The signs of a hacked WordPress site include redirects to spammy sites, content or pop-ups you did not add, unfamiliar admin accounts, or a malware warning from Google or your host. A white screen or “Not Secure” message is usually a different, non-hack problem.
Sometimes, if the damage is limited and you have a clean backup. The risk is missing a hidden backdoor and getting reinfected. If the site keeps coming back infected or is business-critical, professional WordPress malware removal is the safer route.
Not usually, if you have a recent clean backup or the malicious code can be removed without deleting your pages. The biggest risk to your content is deleting files in a panic, which is exactly why the first step is to slow down.
It depends on how deep the infection goes. A contained issue can be cleaned in a matter of hours, while a site with multiple backdoors and reinfection takes longer. Having backups and monitoring already in place makes recovery much faster.
A hacked WordPress site is recoverable, especially with help on call
A hack feels like the end of the world in the moment, but most sites recover fully when the cleanup is done carefully and the entry point is closed. The owners who come through it easiest are usually the ones who already had backups, monitoring, and someone to call before the trouble started.
We are US-based and have helped clean up and protect WordPress sites for years, so we know how to fix a hacked WordPress site without losing your content or papering over the real problem. If you would rather have that safety net in place before the next scare, ongoing WordPress maintenance plans keep your site backed up, monitored, and ready to recover quickly.
To know better is to do better. Please share.
