Hacked WordPress Site: What to Do Step by Step

Signs your WordPress site was hacked

Sometimes the attack is obvious, and other times it goes unnoticed for weeks. Check whether you see any of these signs:

• Strange results in Google: searching site:yourdomain.com turns up pages in Japanese, casino or pharmacy pages, or knockoff brand pages you didn't create.
• A warning in the browser or in Google results: "This site may be hacked" or a red dangerous-site screen.
• Redirects: the site sends you to another page, sometimes only on mobile or only when you arrive from Google, so the owner doesn't notice.
• Unknown admin users in the dashboard.
• Emails from your domain landing in spam or bouncing, because your server is sending junk mail.
• Your hosting provider suspends the account or warns about abnormal resource usage.
• Forms that stopped working without anyone touching anything.

In the case of Hidrantes y Rociadores del Norte, a fire protection company in Torreón, it was a client in Monterrey who let them know that searching for their name brought up results in Japanese. On inspection there were 1,863 spam pages, four fake administrators and a forms plugin that hadn't been updated since 2020.

Step 1: contain without destroying evidence

The natural reaction is to delete everything and restore the latest backup. Don't do that yet. First:

1. Put the site in maintenance mode or restrict access, so visitors aren't redirected or served malware.
2. Make a full backup of the infected site: all files and the database. It's your evidence for understanding how they got in, and for recovering legitimate content if something gets deleted by mistake.
3. Review the server access logs, if your hosting provides them, and save them before they rotate.
4. Notify your hosting provider. Many have procedures for compromised accounts and can confirm whether other sites on your account are affected.

If your most recent backup was taken after the infection started, restoring it is useless: you'd be restoring the problem. That's why it's so important to keep several weeks of history, as we explain in the guide to business backups.

Step 2: shut every door

The attacker may have obtained any password related to the site. Change them all from a clean device, using long, unique passwords created with a password manager or our password generator:

• Every WordPress admin user, and delete any you don't recognize.
• Hosting control panel (cPanel or similar), FTP or SFTP and SSH access; also check the authorized SSH keys.
• The database user, updating the password in wp-config.php.
• The security keys and salts in wp-config.php: regenerating them signs out every open session.
• The email account tied to the domain and to the admin user.
• The domain registrar and services such as Cloudflare.

Also review the scheduled tasks (cron jobs) in the hosting panel: attackers commonly leave one that reinstalls the malicious code every so often.

Step 3: clean the files

The golden rule: don't try to clean core or plugin files by hand. Replace them with clean copies.

1. Core: download the same version of WordPress from wordpress.org and completely replace the wp-admin and wp-includes folders and the root files, except wp-config.php.
2. Plugins and themes: delete and reinstall each one from its official source. Remove the ones you don't use and, above all, any pirated ("nulled") plugin or theme: they often ship with built-in backdoors.
3. wp-content/uploads: this folder should only contain images and documents. Any .php file in it is suspicious.
4. Special files: check .htaccess, wp-config.php, the mu-plugins folder and any file in the root that doesn't belong to WordPress.
5. Scanning: use a scanner like Wordfence or Sucuri to find remaining obfuscated code, typically with functions like eval, base64_decode or gzinflate.

Step 4: clean the database

• Users: in the users table, confirm that only legitimate accounts exist and check their roles.
• Options: verify that siteurl and home point to your domain, and look for scripts injected into widget or theme options.
• Content: look for script tags, iframes and hidden links in posts and pages. Delete the generated spam pages.
• Unknown tables that don't belong to WordPress or your plugins.

If the hack generated hundreds of spam pages, as in the case we mentioned, the most efficient approach is to identify them by pattern (creation date, fake author or URL structure) and delete them in bulk, with the forensic backup at hand in case something legitimate gets caught in the process.

Step 5: win back your place in Google

A clean site doesn't recover in search results on its own. In Google Search Console:

1. Review the Security issues report and the Manual actions report.
2. Make the spam URLs return a 410 status code (gone permanently) or a 404. A 410 tells Google more clearly that they won't be coming back.
3. If the spam pages appear in results, use the Removals tool to hide them temporarily while Google deindexes them.
4. Submit an updated sitemap with only your legitimate URLs.
5. When everything is clean, request a security review explaining what you did.

In the Hidrantes y Rociadores del Norte case, Google reindexed the clean site in 14 days. Also check whether your domain ended up on email blocklists; setting up SPF, DKIM and DMARC helps restore deliverability, as we explain in the guide to small business cybersecurity basics.

Step 6: harden the site so it doesn't happen again

• Updates: core, plugins and themes kept current, with a backup beforehand. The vast majority of WordPress hacks get in through outdated plugins or themes.
• Fewer plugins: each one is another door. Remove the ones that don't add value.
• Two-step verification for every administrator, plus a limit on login attempts.
• Block file editing from the dashboard with the DISALLOW_FILE_EDIT constant in wp-config.php.
• A web application firewall, such as Cloudflare's or one from a security plugin.
• Least privilege: Editor role for people who write content; administrators only where essential.
• Encrypted daily backups stored off the server, with several weeks of history.
• Monitoring: alerts for file changes and new administrators.
• Suitable hosting: a supported PHP version and isolation between sites. We compare the options in the guide to shared hosting vs. VPS.

Should I clean it myself or get help?

If you have server experience and the attack is small (for example, a fake admin spotted early), you can follow this guide on your own. Get professional help when:

• There are hundreds or thousands of spam pages indexed in Google.
• The site gets reinfected days after cleaning; that points to a backdoor you didn't find.
• The site processes payments or stores customers' personal data, because there may be legal notification obligations.
• Your hosting provider suspended the account and you need to negotiate reactivation.
• You don't have backups from before the infection.

When you hire someone, ask for a report with the likely point of entry, what was cleaned, which passwords were changed and which measures are now in place. A "it's fixed" with no explanation doesn't tell you whether the problem was really closed. And keep your own records too: dates, screenshots of the spam results in Google and emails with your hosting provider. If your customers' data was exposed, that record will be needed to comply with personal data protection law.

What if I just leave WordPress?

For many service-business websites that update their content a few times a year, WordPress is more attack surface than they need. A static site, generated as HTML files with no exposed dashboard or database, eliminates most of the risk: there are no plugins to update and no login form to attack.

That's what we did with Hidrantes y Rociadores del Norte after stabilizing the site: we replaced it with a static site, kept the URLs that were ranking, and quote requests rose 89%, with zero incidents over the following 12 months. A static site is also much faster, which helps with the metrics we explain in the guide to Core Web Vitals.

WordPress is still a good choice when your team publishes content often or you need WooCommerce, always with maintenance. If you'd like to evaluate your situation, see our web development service or first run the SEO and GEO audit to see where your site stands today.