Signs that your WordPress site has been hacked
Some attacks are obvious, such as a defaced home page or a ransom message. Many are quiet. Common signs include visitors being redirected to strange sites, pages or links about pills, gambling or loans that you did not write, a browser or Google warning that the site is dangerous, unknown administrator accounts, a sudden drop in traffic, your hosting company suspending the account for malware, or emails from your domain landing in spam.
In Google results you may see Japanese or other unrelated text in your titles, or hundreds of unknown pages indexed. Search for site:yourdomain.com and look for anything you do not recognise. Check Google Search Console for a Security issues notice, and look at the Pages report for sudden growth in indexed URLs.
Step 1: Contain the damage
Put the site into maintenance mode or take it offline at the hosting level so that visitors and search engines stop meeting infected pages. If the site handles payments or personal data, treat it as an incident: tell your host, and consider whether customers need to be notified under the rules that apply to you.
Before you change anything, take a full backup of the files and the database, even though they are infected. You may need it to find out how the attack happened, and it is a fallback if cleaning goes wrong. Store it away from the server.
Step 2: Lock every door
Change all passwords that could be involved: WordPress administrators, hosting control panel, FTP and SFTP, SSH, the database user, email accounts tied to the site and any API keys. Change the secret keys and salts in wp-config.php, which logs everyone out. Remove any administrator account you do not recognise and check every user with an elevated role.
Ask your host to check the server for other infected sites on the same account, because malware often spreads between sites that share a login or a folder tree. If several sites share one hosting account, clean all of them or the infection will return.
Step 3: Find and remove the malware, or restore a clean copy
The cleanest route is often to restore a backup taken before the infection, then update everything and close the hole it used. Check that the backup is clean, because some infections sit for weeks before they show.
If you must clean the live site, compare the files with the originals. WP-CLI can verify the integrity of WordPress core and of plugins from the official directory, using the commands wp core verify-checksums and wp plugin verify-checksums --all. Replace core files with fresh copies, delete and reinstall plugins and themes from trusted sources, and look inside the uploads folder, where PHP files should not exist. Search for suspicious code such as long encoded strings, eval and base64_decode calls, and recently changed files.
Check the database too. Attackers inject spam links into posts, add hidden administrator users and insert scripts into options. Security scanners help, but they are not perfect, so a manual review of users, scheduled tasks and the .htaccess file is worth the time.
- Restore a clean backup if you have one, then update everything
- Reinstall WordPress core, plugins and themes from official sources
- Delete unused plugins and themes entirely, not just deactivate them
- Look for PHP files in the uploads folder and for changes to .htaccess and wp-config.php
- Remove unknown users, scheduled tasks and injected database content
Step 4: Find out how they got in
If you skip this step the site is likely to be hacked again. The most common causes are an out-of-date or abandoned plugin or theme with a known vulnerability, a cracked or nulled premium theme or plugin that arrived with malware, weak or reused administrator passwords, and compromised hosting or FTP credentials.
Look at the server access logs around the time of the first infected file, check the modification dates of files, and read the changelogs and security advisories of the plugins you used. Public vulnerability databases list known issues for WordPress plugins, which helps you match an attack to a cause.
Step 5: Clean up in Google and protect your SEO
Hacks can do lasting damage to search visibility if they are left in place, because Google may flag the site as dangerous or remove pages. Once the site is clean, open Search Console. If a Security issues report appears, fix every listed problem and request a review. If hacked spam pages were indexed, make sure they return a 404 or 410 status, submit a fresh sitemap and use the removals tool for urgent cases.
Check that your robots.txt and sitemap have not been altered, and look for injected links in your templates. Monitor Search Console and analytics for several weeks. Recovery usually follows within weeks of a thorough cleanup and a successful review, though it depends on how long the infection lasted.
How to stop it happening again
Security is mostly maintenance. Keep WordPress core, themes and plugins updated, and remove anything you do not use. Use only plugins and themes from reputable sources, never nulled copies. Choose strong, unique passwords with a password manager, and turn on two-factor authentication for every administrator.
Limit administrator accounts, use a web application firewall and keep automatic, off-site backups that you have tested by restoring. Choose good hosting with isolated accounts. Disable file editing from the dashboard and restrict access to wp-login.php where practical. A managed maintenance plan covers most of this for businesses that do not want to run it themselves.
Some businesses reach a point where the plugin count and the risk are not worth it. Moving to a static or headless setup, where the public site has no login page or plugin code to attack, removes a whole class of incidents. It is a bigger project, but it changes the security profile rather than just patching it.
An incident checklist you can keep
Panic leads to mistakes, so keep a short checklist where the whole team can find it. Record who to call at the hosting company, where the latest clean backup lives, who holds the domain and DNS logins, and who is allowed to take the site offline. Write down the order of steps: contain, back up for evidence, change credentials, clean or restore, update, find the cause, clean up in Google, and review.
After the incident, write a short note on what happened, how it was found and what changed. That note is useful the next time and it is the starting point for a better maintenance routine.
The cost of waiting
Every day an infected site stays live can add to the damage. Search engines may flag it, visitors may be redirected to harmful sites, email from your domain may be blocked and customer data may be exposed. Rankings that took years to build can slip within days if hacked pages flood the index.
Acting quickly also limits the cleanup. A recent infection is easier to remove than one that has spread across files and databases and been re-infected several times. If you are unsure, bringing in a specialist early is often cheaper than repeated attempts.
Related services