A hacked WordPress site may display unknown pages, redirect visitors, send spam or become inaccessible. The priority is to minimise the damage, protect accounts and restore a healthy version without deleting evidence that is useful for diagnosis. If your website processes orders or customer data, act quickly and document every step.
This guide explains the first steps you should take. If you are not used to administering a server, avoid risky actions: hastily deleting files may conceal the backdoor without eliminating the intrusion.
Possible signs include redirects to unknown websites, administrator accounts you haven’t created, recently modified files, browser warnings, Google search results displaying spam, emails sent without your knowledge, or unusual resource usage. However, a slow website or a 500 error does not necessarily mean it has been hacked: a faulty update or a server outage can produce similar symptoms.
Make a note of the time the problem began, any error messages and any recent changes. Take screenshots and keep any alerts you have received from your hosting provider or Google. These details will help you distinguish between an infection and a technical issue.
If a hack is confirmed or strongly suspected, ask your web host if they can temporarily take the site offline or activate a maintenance page. If you run an online shop, consider how to notify customers without further exposing visitors. Do not simply delete the entire site or restore a random backup before you have assessed the situation.
From a secure device, change the passwords for your WordPress administrator accounts, hosting account, control panel, FTP/SFTP, database and associated email accounts. Use unique passwords and enable two-factor authentication where available. Revoke active sessions and remove unknown accounts after retaining the information required for diagnosis.
Report the incident to your hosting provider’s support team. They may have logs, backups, detection mechanisms and information about the source of the suspicious activity. Ask whether a copy of the files and the database can be retained for analysis before any clean-up takes place.
A backup created after the intrusion may already contain malicious code. It is therefore important to retain a copy of the current state for investigation purposes and to look for an earlier backup with a plausible date and integrity. Backups must be restored in a controlled environment and checked before the site is put back into production.
Common causes include a vulnerable plugin or theme, a compromised account, a reused password, an out-of-date version of WordPress, an infected computer or overly permissive file permissions. The analysis should examine the available logs, recently modified files, new accounts, scheduled tasks, plugins and server access.
Don’t just delete the visible page or change the WordPress password. A backdoor may be hidden in a different file, a discontinued plugin, a modified theme or a system account. Unless the root cause is identified, the attacker may return.
The approach depends on the scale of the incident. If a valid, recent backup exists, a controlled restore may be more reliable than an ad hoc clean-up. However, the original flaw must be rectified before the site is reopened. Otherwise, there is a risk that the same vulnerability could be exploited again.
Where manual cleaning is required, replace the WordPress core files with an official copy of the appropriate version, reinstall plugins and themes from trusted sources, and review any customisations. Unfamiliar files, obfuscated code and unexplained changes should be investigated before deletion. Do not download ‘free premium’ plugins from unofficial websites.
Also check the database: accounts, options, injected content, added scripts and scheduled tasks. Configuration files should contain only the necessary settings. WordPress security keys must be renewed once access has been secured.
Review all accounts with administrator or editor roles, as well as API keys, SMTP accounts, connections to external services and shared access. Disable integrations that are no longer in use and replace any potentially exposed secrets. The principle is to grant each user only the permissions they need.
If Google displays a security warning, refer to the section on security issues in Search Console. Once you have completed the clean-up, check the pages flagged and request a review, describing the corrections you have made. Do not submit this request until the infection has actually been resolved: a new detection may prolong the incident.
You should also check any indexed URLs that appear to contain spam. Any pages that have been tampered with must be removed or corrected, and any unusual 404 errors must be monitored. Updates to Google’s search results are not immediate.
Call in a specialist if the administrator cannot be contacted, if the files have been reinfected, if the site is still redirecting after restoration, if personal data may have been exposed, or if the server itself appears to have been compromised. An online shop, a corporate website or a site that collects information warrants a thorough analysis rather than a haphazard fix.
Elvis Web can help you investigate the problem, restore a WordPress installation and strengthen preventative measures in line with the scope of the site. Availability and turnaround time depend on the severity of the issue, access rights and the status of backups. In the event of an emergency, please have the URL, the error message, the time the issue began and any recent changes to hand.
Discover our WordPress troubleshooting service or Contact Elvis Web for a quote. Never send a password in plain text via email: use a secure method and revoke temporary access once the task has been completed.
Not automatically. Reinstalling the core files may form part of the clean-up process, but this is not enough if the database, accounts or extensions still contain malicious code.
Only if it is healthy and the original fault has been rectified. An infected backup, or one restored to a vulnerable installation, may cause the problem to recur.
The cost depends on access to the site, the extent of the infection, the condition of the backups and whether server analysis is required. A diagnostic assessment is needed to estimate the work involved.
Not necessarily. Google may display warnings or temporarily remove certain pages if a risk is detected. Clean up the site and then follow the instructions in Search Console.
Keep your software up to date, remove unnecessary extensions, secure your accounts and test your backups regularly.
Contact us now to discuss your project. We’ll provide a free, no-obligation quote within 24 hours.
