Hacked WordPress Site: What to Do in the First Few Hours

Redirects to shady websites, a red warning in the browser, an email from your host suspending the account: when a WordPress site is hacked, every hour counts. But acting fast does not mean acting in a rush. Deleting files at random or restoring an old backup without understanding how the attacker got in is often the best way to get reinfected a few days later. Here is, step by step, what I do and what I recommend doing in the first few hours.

Signs that your WordPress site has been hacked

• Visitors, often on mobile or coming from Google, redirected to casino, pharmacy or fake prize pages.
• Unknown pages in search results: type site:yourdomain.com into Google and look for titles in Japanese or products you do not sell.
• A “Deceptive site ahead” warning in Chrome, or a message in the “Security issues” section of Google Search Console.
• Administrator accounts nobody created, unknown plugins, PHP files inside wp-content/uploads/.
• A suspension or warning from your host for sending spam or using an abnormal amount of resources.

Any one of these signs is enough to treat the situation as a confirmed hack.

Step 1: isolate the site without destroying the evidence

The first goal is to protect your visitors. Put the site into maintenance mode at server level (a rule in the .htaccess file that only lets your own IP address through, or the option provided by your host) rather than with a WordPress plugin: if the site is compromised, the plugin may be too. Do not delete anything yet. Modified files and server logs are the only clues that show how the attacker got in.

Step 2: back up the infected site

It sounds counter-intuitive, but make a full copy of the site as it stands: files, database and, if possible, the server’s access and error logs. Store it off the server and label it clearly as infected. It is used for the analysis, and to roll back if the clean-up removes a legitimate file by mistake. Also take stock of your clean backups: a backup made before the infection is valuable, provided you know when the intrusion happened.

Step 3: clean thoroughly

Proper cleaning does not mean running a scanner and deleting whatever it flags. The reliable method is to rebuild from trusted sources:

1. Reinstall WordPress core from the official archive, fully replacing wp-admin/ and wp-includes/.
2. Reinstall every plugin and theme from its official source, and remove those you no longer use or that came from sites giving away paid products for free (“nulled” versions): this is the number one cause of infection I come across.
3. Inspect the remaining files: wp-config.php, the uploads folder (which should contain no PHP files at all), the .htaccess files and the server’s scheduled tasks.
4. Check the database: user accounts, the siteurl and home options, scripts injected into content or widgets.
5. Find the entry point (vulnerable plugin, stolen password, compromised FTP account) and close it, otherwise reinfection is almost certain.

Step 4: change every password and key

Assume the attacker knows every password linked to the site. Change them all, from a computer you know is clean:

• WordPress administrator accounts, deleting any accounts you do not need;
• FTP, SFTP and SSH access;
• your hosting account and your domain registrar account;
• the database password, updated in wp-config.php;
• the security keys (salts) in wp-config.php, regenerated to log out every open session;
• any API keys: payment, transactional email, third-party services.

Take the opportunity to enable two-factor authentication on every administrator account.

Step 5: notify the right people

Tell your host, who can provide logs and lift any suspension. Once the site is clean, request a review in Google Search Console so the warning shown to visitors disappears. If personal data may have been accessed or stolen (customer accounts, forms, orders), there is also a regulatory side: in France and the EU, the GDPR requires notifying the data protection authority (the CNIL in France) promptly in certain cases, and sometimes the people affected; in Algeria, check with the national authority in charge of personal data protection. If in doubt, contact the relevant authority or a legal adviser.

After the emergency: preventing a repeat

A site that has been cleaned but is still just as exposed will be hacked again. Update the core, the plugins and the PHP version, remove everything you do not use, set up off-site backups and keep a close eye on the site for the following weeks: new files, new accounts, newly indexed pages.

Has your site been hacked and would you rather hand the job over? Hacked WordPress site clean-up costs €390 excl. VAT (40,000 DZD in Algeria): removal of malicious code and backdoors, hardening, getting the site back online and a 30-day guarantee against reinfection, with intervention within 48 hours, or 24 hours for emergencies. Describe your situation through the quote request form.