Finding out that your website is hacked is stressful, but a clear order of steps helps. With new attacks on plugins and PHP in the news this autumn, more owners are asking this question, so here is the plan we follow.
Common signs of a hacked site
- Google or your browser warns that the site is dangerous or deceptive.
- Visitors are redirected to strange sites, or you see spam pages and unknown text in search results.
- Unknown administrator users, plugins or files appear.
- The site suddenly becomes slow, or your host suspends it for sending spam or heavy load.
- You cannot log in, or your password stops working.
Recovery steps
- Stay calm and do not delete things at random. Contact your host and tell them the site is compromised.
- Isolate the site with maintenance mode or a temporary block, so visitors and search engines are protected.
- Save a full copy of the infected files and database as evidence and for analysis.
- Change all passwords: WordPress admins, hosting, database, FTP or SSH, email accounts used for resets, and API keys.
- Restore a clean backup from before the infection, or reinstall core, plugins and themes from official sources.
- Hunt for backdoors in uploads, mu-plugins, the database and hidden admin users. Remember that one remaining backdoor brings the infection back.
- Find how the attacker got in: an outdated plugin, a nulled theme, a weak password or an old PHP version. Fix that cause.
- Update everything, including the server’s PHP version, and turn on two-factor login for administrators.
- If Google flagged the site, request a review in Search Console after cleanup.
If the site handles orders or personal data, you may also need to inform affected customers. A professional cleanup service can save time and reduce the chance of a repeat infection.
Frequently asked questions
How long does recovery take?
A simple infection can be cleaned in hours; a deep one with several backdoors can take days. Preparation, such as having backups, makes it much faster.
Will my Google ranking recover?
Usually yes after the site is clean and the warnings are removed, though spam pages that were indexed may take time to disappear.
How do I avoid a second hack?
Close the original entry point, keep everything updated, use strong unique passwords with two-factor login, and keep regular off-site backups.
Read next
- The Self-Healing WordPress Backdoor: Why Malware Comes Back After Cleanup
- Protect Your WordPress Admin: Two-Factor Login, Strong Passwords and Least Access
- WordPress Maintenance and Support: What Is Included and Why You Need It
Need help keeping your WordPress site secure? We offer maintenance, updates and security checks. Contact us
