WordPress Site Hacked? What to Do and How to Fix It

You usually find out from someone else. A customer tells you your website sends them to a betting site. Google shows "This site may be hacked" under your name. Or your hosting company emails to say it has suspended the account. Take a breath: it is almost always fixable, and in the first hour the order you do things in matters more than the speed.

It is not personal, either. Small business sites are rarely attacked by someone who picked them out. Automated programs crawl the web looking for WordPress sites with out-of-date plugins and let themselves in. Knowing that changes what you do now, and what you do afterwards so it does not happen again.

How to tell your site has been hacked

These are the most common signs. One is enough to take it seriously:

• Redirects to spam. Your site sends people to gambling, pharmacy or fake prize pages, often only when they arrive from Google or on a phone. Many infections deliberately hide from anyone who is logged in, so check from a phone on mobile data without logging in.
• Administrators you do not recognise. Under Users there is an admin account nobody created.
• Google's warning. "This site may be hacked" appears under your site in the results, or Chrome shows a red warning screen before letting people through.
• Security issues in Search Console. If your site is verified, Google emails you, and the Security issues report shows what it found and on which pages.
• Your host suspends the account or tells you it has found malicious files or unusual activity.
• Your domain is sending spam. Bounce messages for emails you never sent, customers receiving strange messages in your name, or your own emails landing in spam folders.
• Pages on Google that are not yours. Search for site:yourdomain.com. Hundreds of pages in Japanese or for products you do not sell mean someone has injected content.

What to do in the first hour, in order

The order matters. Anyone can do the first four steps, which stop the damage; the rest clean the site, and if you are not comfortable with them, that is the moment to get help.

1. Do not delete the site or reinstall it in a panic. Wiping everything destroys the clues to how they got in, and it does not close the door: reinstall the same vulnerable plugin and they are back within days.
2. Tell your hosting company. Explain what you are seeing. They may hold recent backups and logs that show how the attacker got in, and if they suspended the account, they will tell you what they need to restore it. If the site is sending your visitors somewhere dangerous, ask them to take it offline, or put it in maintenance mode yourself while you clean it.
3. Change every password, from a clean computer. Every WordPress administrator, the hosting control panel, FTP or SFTP, the database (put the new one in wp-config.php too, or the site will stop working) and the email account linked to it. Turn on two-factor authentication wherever you can.
4. Take a copy of the site as it is now. Files and database, infection included, stored somewhere separate and clearly labelled as infected. It is your evidence if you have to report the breach, and it shows what was changed. Never restore it.
5. Restore a clean backup, if you have one. It has to pre-date the hack: if they got in two weeks ago, last night's backup is infected too. Work out when the redirects started or when the strange user appeared.
6. Update WordPress, every plugin and the theme. Restoring does not close the hole; updating does. The Updates screen lets you reinstall WordPress's own files. Delete, rather than just deactivate, plugins you do not use, abandoned ones and any "nulled" theme or plugin, meaning a paid one downloaded for free from an unofficial site.
7. Scan the site. A security plugin such as Wordfence, which has a free version, checks your files for malicious code. If it finds something, clean it up and scan again until it comes back clear.
8. Remove users you do not know. Under Users, filter by Administrator and delete any account you cannot put a name to. Take admin rights away from anyone who no longer needs them, starting with whoever built the site years ago.
9. Change WordPress's security keys. These are the keys and salts in wp-config.php. Changing them logs out every session, the attacker's included. WordPress has an official generator: paste in the new ones and log back in.

If after all that the site still redirects, or the scanner keeps finding things, the door is still open. A half-cleaned site gets reinfected within days, and that is when paying a professional is worth it.

If personal data was involved: the 72-hour rule

If your site stores information about people, such as contact form messages, shop customers or registered users, and the attacker could get at it, that is a personal data breach.

Under Article 33 of the GDPR, which the UK GDPR mirrors, you must report it to the data protection authority without undue delay and, where feasible, within 72 hours of becoming aware of it, unless it is unlikely to result in a risk to people's rights and freedoms. If the risk is high, you must also tell the people affected (Article 34). If you do not have every detail yet, you can provide the information in phases. And even if you decide it does not need reporting, you still have to record it.

In the UK that authority is the ICO, which explains the process on its data breach reporting page. In Spain it is the AEPD, which has its own breach notification page in Spanish.

This is general information, not legal advice. If you are unsure about your situation, take professional advice.

How to get Google's warning removed

Once the site is genuinely clean, and not before:

1. Open the Security issues report in Search Console. If the site was never verified, you can verify it now.
2. Make sure you have cleaned every page, not just the examples Google lists, and closed the hole the attacker used.
3. Click "Request review" and explain what happened, what you cleaned and what you changed so it cannot happen again.

Google says reviews take between a few days and a few weeks. Do not rush it: if the site is still infected, the request is turned down and everything takes longer. Spam pages Google had indexed drop out of the results once they no longer exist.

Why they get in (and why your site)

According to Patchstack's annual report, 11,334 new vulnerabilities were found in the WordPress ecosystem in 2025: 91% in plugins, 9% in themes and just 6, all low priority, in WordPress itself. Almost half had no fix available when they were made public. So the ways in are nearly always the same:

• Plugins and themes that are not updated. Once a flaw is published, bots try it on thousands of sites within days.
• Abandoned plugins. If nobody maintains a plugin, its hole will never be closed.
• "Nulled" themes and plugins. The paid version downloaded for free often comes with a back door thrown in.
• Weak or reused passwords without two-factor authentication, up against programs that try passwords around the clock.
• Forgotten access. The login of whoever built your site, an old FTP account or a test user nobody deleted.

Proper WordPress backups turn a hack into a lost afternoon rather than a lost week, and a "Not secure" warning in the browser is another symptom of a site nobody is looking after.

How to stop it happening again

What stops nearly every hack is not sophisticated. It is routine:

• Update every week, with a backup first and a check afterwards that nothing has broken.
• Keep only the plugins you need and delete the rest.
• Two-factor authentication on every administrator account.
• Backups stored off the server, from several dates, and tested.
• Review who has access and remove anyone who no longer needs it.
• Monitor the site, so you hear about problems before your customers do.

To find out whether you are falling behind, check for free whether your WordPress is up to date: our audit looks from the outside, without asking for any password, along with your certificate and any scripts with known flaws. It cannot detect a hack, but it does show the door they usually come through.

And if you would rather not have to remember, that is what WordPress maintenance is for: updates with a backup first, monitoring and hosting, even if we did not build your site. If you have already been hacked, cleaning it up is a repair, not maintenance: we look at it, give you a fixed price before we start, and the monthly maintenance afterwards makes a repeat far less likely.

Frequently asked questions

Can I clean up a hacked WordPress site myself?

If you have a clean backup and the infection is recent, often yes: restore, update everything, change passwords and keys, and scan. If there is no backup, the infection goes back a long way or it returns after cleaning, it is worth paying someone, because a back door left behind undoes all the work.

How long does Google take to remove the hacked warning?

Between a few days and a few weeks from when you request a review in Search Console, according to Google. Only request it once the site is completely clean, because a rejected request makes the process longer.

Is restoring a backup enough?

No. A backup gives you the site back, but it does not close the hole the attacker used. After restoring you still need to update everything, change passwords and keys and remove unknown users, or they will come back the same way.

Do I have to tell my customers?

If the breach poses a high risk to them, data protection law requires you to tell them. And if spam went out from your domain, a short note stops anyone falling for a fake message in your name.

Why does a site get hacked again after it has been cleaned?

Almost always for one of these reasons: a hidden back door was left behind, the vulnerable plugin is still not updated, a password was not changed (FTP and hosting are the ones people forget) or a backup that was already infected was restored.

How much does it cost to clean a hacked website?

It depends on how much was touched and whether there is a clean backup. We look at the site first and give you a fixed price before we start, rather than an hourly bill with no end in sight.

If it is happening right now, tell us what you are seeing on your site and we will reply the same day.