My WordPress Site Was Hacked — What to Do Right Now

If you’re reading this because your site is already showing spam links, redirecting to a pharmacy or casino page, or your host just emailed you about malware, skip the panic and start here. This is the order I work through when a client site gets compromised — contain it first, understand it second, clean it third.

Every hack is a little different, but the response pattern isn’t. Work through these steps in order. Don’t skip to cleanup before you’ve isolated the site — that’s how sites get reinfected an hour after you think you’ve fixed them.

Step 1: Isolate the site before you touch anything else

The malware is running right now, on every page load, for every visitor. Before you diagnose anything, stop it from doing more damage and stop yourself from working on a moving target.

• Put the site in maintenance mode or take it fully offline if your host allows it. This stops search engines from indexing the spam content and stops visitors from hitting whatever’s been injected.
• Change every password tied to the site — WordPress admin accounts, the database user, FTP/SFTP, and your hosting control panel login. If you reuse passwords anywhere else, change those too. Assume the credentials are compromised, not just the site.
• Revoke and regenerate API keys and application passwords if the site uses any (payment gateways, email services, third-party integrations).
• Don’t delete anything yet. I know the instinct is to nuke the infected files immediately, but you want a copy of the compromised state first in case you need to figure out how they got in.

Step 2: Figure out how bad it is

Before you start cleaning, get a clear picture of what’s actually compromised. This determines whether you’re looking at a quick fix or a full rebuild.

• Check Google Search Console for security issues — it will often tell you if Google has flagged specific pages for malware or spam content, which narrows down where to look.
• Look for new admin users in Users → All Users that you didn’t create. This is one of the most common signs of a compromised site and the fastest way in for an attacker to come back later.
• Check recently modified files via your hosting file manager or SFTP client, sorted by modification date. Malware often touches wp-config.php, theme files like functions.php, or drops new files into wp-content/uploads/ — a folder that should never contain PHP files.
• Scan the database for injected content — spam links, hidden text, or scripts stuffed into post content or widget/theme option fields. A hacked site frequently looks fine to you (logged in, cache-cleared) while showing spam to Google’s crawler or first-time visitors.

Step 3: Clean it — or know when to stop and call someone

If the infection is limited to a plugin or a handful of files you can clearly identify, cleanup looks like this:

• Replace WordPress core, your theme, and all plugins with fresh copies from the official source rather than trying to edit out malicious code line by line. It’s faster and you won’t miss a hidden backdoor.
• Delete anything you don’t recognize — unfamiliar plugins, unfamiliar admin users, unfamiliar scheduled tasks (cron jobs) that weren’t set up intentionally.
• Check wp-config.php and your theme’s functions.php line by line if you have the technical background to recognize what belongs there and what doesn’t. Attackers like hiding backdoors in these files because they’re rarely audited manually.
• Restore from a clean backup if you have one from before the compromise, rather than trying to manually remove an infection you can’t fully account for. A known-good backup beats a manual cleanup you’re not 100% certain caught everything.

Here’s the honest line I’d draw: if you can’t say with confidence exactly how the attacker got in, and exactly what they changed, don’t just clean the visible symptoms and call it done. A site that “looks fixed” with the entry point still open gets reinfected, often within days. That’s the point where it makes sense to bring in someone who does this for a living rather than keep guessing.

Step 4: Verify before you bring it back online

Don’t take the site out of maintenance mode until you’ve confirmed the infection is actually gone, not just hidden.

• Run a malware scan with a reputable security plugin and confirm it comes back clean.
• Re-check the admin user list and confirm only accounts you recognize have access, with fresh passwords on all of them.
• Request a manual review in Google Search Console if the site was flagged, so the warning gets cleared once you’re confident it’s resolved.
• Watch server logs and file-change alerts closely for the first week after bringing the site back — a reinfection this soon almost always means the original entry point is still open.

Step 5: Close the door that let them in

Cleaning the infection without fixing how it happened just buys you time until the next one. Most compromises trace back to the same handful of causes: outdated plugins or themes, weak or reused passwords, or a nulled/pirated plugin with a backdoor built in.

I’ve written up the full set of checks I run on every client site — updates, backups, login hardening, and ongoing monitoring — in my WordPress security checklist. If you’ve just been through a hack, that’s the next thing worth reading, because the same gaps that let this happen once will let it happen again.

Frequently asked questions

How do I know if my WordPress site has actually been hacked?

Common signs: spam links or redirects to unrelated sites (pharmacy, casino, ads), a malware warning from your host or browser, unexpected admin users, or Google Search Console flagging security issues. Sometimes the site looks fine to you while showing spam only to search engines or first-time visitors.

Should I take my site offline immediately if I suspect a hack?

Yes — maintenance mode or fully offline if your host allows it. The malware is active on every page load, so isolating the site first stops it from doing more damage while you figure out the extent of it.

Can I clean a hacked WordPress site myself?

If the infection is limited to a plugin or a handful of identifiable files, often yes. If you can’t say with confidence exactly how the attacker got in and what they changed, that’s the point where bringing in someone experienced beats guessing — a site that “looks fixed” with the entry point still open tends to get reinfected fast.

Will Google penalize my site permanently after a hack?

No. Once you’ve confirmed the site is actually clean, request a manual review in Google Search Console and the security warning gets cleared. It’s not permanent, but it does require that extra step — the warning doesn’t disappear on its own just because the malware is gone.

If this feels like too much to handle alone

A hacked site under deadline pressure is a bad time to be learning file forensics for the first time. I handle cleanup and lockdown for clients who’d rather hand the whole thing off than spend a weekend digging through server logs — and once it’s clean, ongoing maintenance means you’re not back here again in six months. If you’re shopping around rather than defaulting to me, here’s what to look for in any provider.

Get in touch if you want a second set of eyes on it, or take a look at what ongoing WordPress care looks like so this doesn’t happen again.