If your WordPress site has been hacked, the first few hours matter. The goal is to stop the damage, find how they got in, remove every trace, and make sure it doesn’t happen again — in that order. Work through the steps below calmly. Skipping straight to “delete the bad file” is the single most common reason a site gets reinfected days later.
1. Confirm it’s really a hack
Common signs: your site redirects visitors to spam, Google shows a “this site may be hacked” warning, unknown admin users appear, your homepage is defaced, spammy pages show up in search results, or your host suspends the account. A sudden traffic or performance collapse can be a symptom too. If you see any of these, treat it as a compromise.
2. Take a snapshot before you touch anything
Before you clean, copy the current state of the files and database somewhere safe. It feels backwards to back up an infected site, but that snapshot is your evidence: it preserves the malicious files so you can find the entry point and every backdoor. Delete things blindly first and you lose the trail — which is exactly why reinfection is so common.
3. Contain it
Put the site into maintenance mode if it is serving malware or redirects, so you stop harming visitors and your reputation while you work. Then cut off the attacker’s access:
- Change every password — WordPress admins, hosting/cPanel, FTP/SFTP, and the database user.
- Force all users to log out and rotate your secret keys and salts in
wp-config.php, which invalidates any stolen sessions. - Review the user list and remove any administrator you don’t recognise.
4. Find the entry point and the backdoors
This is the step people skip, and the reason hacks come back. The visible symptom — the spam pages, the redirect — is not the infection; it is the output of it. Somewhere there is an entry point (usually a vulnerable or outdated plugin) and one or more backdoors the attacker planted to get back in. You have to find both. Scan the site for malware, and specifically use an integrity check that compares your core, plugin, and theme files against known-good versions — that is what surfaces injected and added files a signature scan walks straight past.
5. Clean, or restore
If you have a known-clean backup from before the compromise and you have identified the entry point, restoring is often fastest — but only if you then close the hole, or you will be reinfected through the same door. Otherwise, clean manually: replace core files with fresh copies, reinstall plugins and themes from trusted sources, and remove every injected snippet and backdoor you found in step 4. Re-scan until it comes back clean.
6. Clear the warnings
Once the site is genuinely clean, request a review in Google Search Console to lift the “this site may be hacked” or “deceptive site” warning, and ask your host to lift any suspension. Do this only after cleaning — a review that finds the site still infected sets you back.
7. Make sure it doesn’t recur
Update everything, turn on two-factor authentication, and put a firewall in front of the site so the attacks that caused this get blocked before they reach your plugins. If your site has been cleaned before and keeps coming back, the backdoor was never fully removed — we cover that specifically in why your WordPress site keeps getting hacked.
If this is urgent, or you’d rather not do it under pressure, DefendMyWP offers a done-for-you cleanup: our team removes the malware by hand, finds the entry point, and includes a year of the plugin so it stays clean. Most sites are fixed within 24–48 hours — see hacked WordPress site cleanup.
