WordPress Site Hacked? Here's What to Do First

How Do You Know You've Been Hacked?

The signs vary. Sometimes it's obvious, sometimes you only find out when Google emails you or a client complains.

Common signs:

• Strange links in your footer or content pointing to gambling, pharma, or adult sites
• Google Search Console shows a security warning
• Your host suspended the account for "malware"
• Visitors are being redirected to another site
• Your admin password stopped working
• Your site is listed as "deceptive" in Google

Step 1: Don't Panic and Don't Delete Everything

The instinct to delete everything and start fresh is understandable but wrong. You need to understand how they got in, or you'll get hacked again in a week.

Step 2: Take the Site Offline

Log in to your hosting control panel (e.g., cPanel, Plesk). Look for a "Maintenance Mode" or "Site Offline" toggle. If your host doesn't have one, install a free plugin like "Maintenance" from WordPress.org and activate it. This stops the malware from spreading to visitors while you clean.

Step 3: Change All Passwords

Change all of these, even if they seem unrelated:

• WordPress admin password: Go to Users > All Users, hover over each admin account, click Edit, scroll to Account Management, enter a new strong password and confirm.
• FTP / SFTP credentials: In your hosting control panel, go to FTP Accounts, edit each user and change the password.
• Hosting control panel password: Change via your host's account settings.
• Database password: Open wp-config.php via FTP or File Manager, find the line define('DB_PASSWORD', '...'), replace the password, then update it in your host's database manager (e.g., phpMyAdmin under User accounts).
• Email account linked to WordPress: Log in to your email provider and change the password.

Also check: are there admin accounts you don't recognise? Delete them (Users > All Users > hover and Delete).

Step 4: Scan for Malware

Install a security plugin like Wordfence from WordPress.org (Plugins > Add New, search "Wordfence Security", install, activate). Then go to Wordfence > Scan and click "Start New Scan". Wait for results.

Additionally, your host may offer a malware scanner in the control panel – look for "Malware Scanner" or "Site Scanner" and run it.

Step 5: Clean the Infection

Option A: Restore From Backup

If you have a clean backup from before the infection (from your host's backup tool or a plugin), restore it. This is the safest approach.

Option B: Manual Cleaning

1. Replace WordPress core files – Download a fresh copy of WordPress from wordpress.org. Using FTP or your host's File Manager, delete the wp-admin and wp-includes folders, then upload the new ones. Do not touch wp-content or wp-config.php.
2. Delete unknown plugins/themes – Go to Plugins > Installed Plugins and Themes > Manage Themes. Delete anything you don't recognise.
3. Reinstall all plugins from scratch – Delete each plugin, then reinstall it from WordPress.org (not from any backup).
4. Clean the database – Use Wordfence's database scan (Wordfence > Scan > Options, enable "Scan database"). Alternatively, ask your host for phpMyAdmin access and search for unusual entries – but using a plugin is simpler.

Step 6: Find How They Got In

Vector	How to check
Outdated plugin	Go to Plugins > Installed Plugins. If any have an available update, update them now. Check if you had ignored update notices.
Nulled theme/plugin	If you ever installed a premium theme or plugin from a free download site (nulled), that's almost certainly the cause. Delete it immediately.
Weak admin password	In your hosting control panel, look for "Access Logs" or "Raw Access Logs" and download the latest file. Search for many failed login attempts (e.g., "POST /wp-login.php" with 404 or 403 codes).
Old WordPress version	Check the file wp-includes/version.php – if it's not the latest, that version may have known vulnerabilities.
Compromised hosting account	Contact your hosting provider's support and ask if there were unauthorized logins to your account.

Step 7: Harden Before Going Back Online

• Update WordPress, all plugins, all themes to the latest versions.
• Delete any plugins or themes you don't actively use.
• Install a security plugin (Wordfence or Solid Security) and enable its firewall.
• Enable two-factor authentication for admin accounts (use a plugin like "Two Factor Authentication").
• Change the database table prefix if it's still wp_ — use a plugin like "Change Table Prefix" to do this safely.
• Disable XML-RPC: In a security plugin's settings, look for "Disable XML-RPC" and turn it on (unless you need it for mobile apps).

Step 8: Request a Google Review

If Google flagged your site, go to Google Search Console > Security Issues > Request Review after cleaning. It usually takes 1–3 days.

If you've followed these steps and the infection persists, or you'd rather not handle it yourself, DevCev Digital can help. Contact us for a free diagnostic.