My WordPress Site Was Hacked — What Now? A Step-by-Step Recovery Guide

Strange redirects, spam pages in Google, a warning in the browser, or an email from your host saying your account is suspended — finding out your website was hacked is stressful. The key is to work through it calmly and in the right order.

Step 1: Contain the damage

• Don’t delete everything in panic — you may destroy evidence of how the attacker got in.
• Take a full backup of the current (infected) site and database, clearly labelled, so nothing is lost.
• If customers could be affected, consider putting the site into maintenance mode.
• Tell your hosting provider — many can help or scan the server.

Step 2: Change every password

Change passwords for WordPress admin users, hosting, FTP/SFTP, database and email accounts. Turn on two-factor authentication. Remove any admin users you don’t recognise.

Step 3: Find and remove the malware

• Scan the site with a reputable security scanner.
• Compare core WordPress files with fresh copies and replace them.
• Reinstall plugins and themes from official sources instead of trying to clean each file.
• Check the uploads folder for PHP files — they should not be there.
• Look in the database for injected scripts, spam links and unknown admin users.

If you have a clean backup from before the hack, restoring it can be faster — but you must still update everything and close the hole, or it will happen again.

Step 4: Close the hole

Find how they got in. Common causes: an outdated plugin with a known vulnerability, a nulled (pirated) theme or plugin, a weak password, or an old abandoned site on the same hosting account. Update everything, remove what you don’t use and fix the root cause.

Step 5: Restore trust

• If Google flagged your site, use the Security Issues report in Google Search Console and request a review after cleaning.
• Check for spam pages indexed under your domain and remove them.
• If your host suspended the account, send them the cleanup details.

Step 6: Prevent it happening again

Follow a security routine: updates, backups, 2FA, a firewall and monitoring. My WordPress security checklist covers the essentials, and a maintenance plan makes sure it actually happens every month.

Need urgent help?

If your website is hacked right now, message me on WhatsApp with your website address — I can help clean it, close the hole and secure it properly.