What to Do If Your WordPress Site Gets Hacked

Last updated: November 6, 2026 · By Ryan Walsh

Recovering a hacked site means regaining control of your WordPress installation, removing the malicious code, closing the weakness the attacker used, and bringing your content back online safely. Start by containing the damage: preserve evidence, change your passwords, and find out how the intruder got in. Then remove the malware or restore a clean backup taken before the infection, update everything, and harden the site so the same attack does not work twice. This guide walks through each step in the order that works best for beginners, with the reasoning behind it.

Key Takeaways

• Copy your files, database and server logs before you delete anything, because they show how the attacker got in.
• Change every credential that can reach the site, including your WordPress admin, hosting, FTP or SFTP, database and email accounts.
• Restore the most recent backup made before the infection date, not simply the newest backup, which may already contain malware.
• Remove malware before you rebuild from backups, and reinstall WordPress core, themes and plugins from official sources.
• Patch the vulnerability that allowed the breach, since CISA advises patching known weaknesses in internet-facing systems immediately.

How Do You Know Your WordPress Site Has Been Hacked?

Your site has likely been hacked if you see changes you did not make, unfamiliar administrator accounts, redirects to other websites, or sudden slowdowns. Malware, meaning software written to damage a system or secretly control it, often reveals itself through odd behavior before the owner notices anything wrong on the front end.

Common warning signs include:

• Administrator or editor accounts in the Users screen that you did not create
• Plugins, themes or files you did not install, or existing ones that were altered or deactivated
• Posts, pages or links you did not write, including hidden spam
• Redirects to unrelated sites, especially on mobile devices or from search results
• Browser or search engine warnings that your site may be unsafe
• Unexpected CPU spikes, slowdowns or outbound traffic from your hosting account
• Logins or file changes in your access logs from unfamiliar IP addresses or at unusual times

Check the access logs in your hosting control panel and compare file modification dates against the last time you updated the site. A burst of changes on a single day is a strong sign of an intrusion. Treat anything you cannot explain as suspicious until you have checked it.

What Should You Do First When Your Site Is Hacked?

In the first hours, your priority is to limit further damage and keep evidence intact. Work through the steps below in this order, because restoring a backup before you close the entry point can let the attacker back in.

1. Preserve evidence by copying your files, database and logs.
2. Contain the site by taking it offline or enabling maintenance mode.
3. Change all passwords and remove any accounts you do not recognize.
4. Identify the entry point and patch the weakness.
5. Remove the malware or restore a clean backup.
6. Verify the site and check for lingering damage.
7. Harden the site, monitor it and document what happened.

Why Should You Preserve Evidence Before You Clean?

Before you delete anything, make a full copy of your files, database and server logs. CISA’s guidance on targeted cyber intrusions says recovery is unlikely to succeed if an intruder is simply hunted down without first preserving forensic data and stopping lateral movement, meaning the attacker moving from one account or system to another. Store the copy in a separate location and never work on your only copy.

Should You Take the Site Offline Temporarily?

Yes, if the site is actively sending visitors to malicious pages or spam. Maintenance mode stops most visitors from receiving harmful content while you work. Many hosts offer a one-click option to suspend a site, and a simple placeholder page also works. Keep the outage short, because a hacked site left online can get flagged by browsers and search engines.

How Do You Change Passwords and Review User Access After a Hack?

You change every password that can reach your site so the attacker cannot log back in with credentials they already stole. Treat this as a full credential reset, not just a change to the WordPress admin password.

Work through this list:

• WordPress administrator and editor accounts
• Your hosting control panel and server login
• FTP, SFTP or SSH accounts
• The database user password, updated in wp-config.php to match
• Email accounts tied to the site, since attackers often use them to reset passwords
• API keys and connected services, such as payment, email marketing or analytics tools

Use a password manager to generate long, unique passwords, and never reuse one across accounts. Changing the authentication keys and salts in wp-config.php also invalidates current login sessions, which helps cut off sessions an attacker may still hold.

Next, review the Users screen. Delete any account you do not recognize, and lower the role of anyone who no longer needs elevated access. Turn on two-factor authentication, a login step that requires a second proof of identity such as a code from an app, for every administrator. For a deeper look at assigning roles safely, read our guide to managing WordPress user roles and permissions.

How Do You Find and Patch the Entry Point?

You find the entry point by identifying the weakness the attacker used, and you patch it so a restored site cannot be reinfected the same way. Common entry points include an outdated plugin or theme, a weak or reused password, a stolen login, or a vulnerable hosting account.

CISA’s advisory AA20-245A, which covers technical approaches to uncovering and remediating malicious activity, says known vulnerabilities in internet-facing systems should be patched immediately, beginning with the point of compromise if it is known. If you cannot determine how the exploit worked, notify the developer of the affected software. Review every installed plugin and theme for known vulnerabilities, and remove any that are abandoned or no longer receive updates.

How Do You Remove Malware From a WordPress Site?

Malware removal means deleting or replacing every file, database entry and setting that the attacker changed. A malware scanner is a good starting point, but scanners can miss backdoors, which are hidden entry points that give attackers repeat access. Verify scan results with a manual review.

Run a full scan with a reputable security plugin such as Wordfence or Sucuri, and use your hosting provider’s malware scanning tools if they are available. Scanners match known patterns, so review every flagged file rather than assuming a result is a false positive.

How Do You Clean WordPress Core, Themes and Plugins?

The safest method is to replace WordPress core files with fresh copies from WordPress.org and reinstall each plugin and theme from its official source. Delete any file that does not belong to a known plugin or theme. For example, the uploads folder should contain images and media files, so any PHP file there is a strong warning sign.

Reinstalling only overwrites files that match the originals, so also inspect wp-config.php, .htaccess and your database for injected code. Look for long encoded strings, eval or base64 functions used in unexpected places, and unfamiliar scheduled tasks. If you cannot find or understand the infected code, a professional cleanup is worth the cost.

How Do You Restore a Hacked WordPress Site From a Clean Backup?

Restoring from a clean backup replaces infected files and data with a version saved before the breach. Choose the most recent backup made before the infection, not the newest one, because the newest backup may already contain the malware. If you do not know when the breach began, step back through your backup history until you find a version with no unexplained changes.

The joint CISA and MS-ISAC ransomware guide advises removing malware from affected systems before rebuilding from backups, and the same order applies to a hacked website. Follow these steps:

1. Confirm the backup predates the infection by checking file dates and content.
2. Restore to a staging copy first if your host provides one, and test it before going live.
3. Restore both the files and the database, since they must match each other.
4. Update WordPress core, themes and plugins again, because an older backup will roll them back to outdated versions.
5. Reapply the security settings and new passwords you set earlier, since the backup will not include them.
6. Scan the restored site once more before reopening it to visitors.

If you do not yet have a backup routine, choose a plugin that supports scheduled backups and off-site storage. Our guide to WordPress backup plugins covers the main options. Storing copies with a cloud service such as Google Drive or Dropbox keeps them safe even if your server is compromised.

How Often Should You Update WordPress Core, Themes and Plugins?

Update WordPress core, every theme and every plugin as soon as a security release is available, because known vulnerabilities are the most common targets for automated attacks. Updates can change how features behave, so check your key pages after each batch of updates.

• Turn on automatic updates for WordPress core security and minor releases.
• Review plugin and theme update notices at least once a week.
• Delete plugins and themes you no longer use, rather than leaving them deactivated.
• Check the developer’s support history before installing a new plugin or theme.

How Do You Check for Lingering Damage?

Hacks can leave behind spam pages, redirects or altered content that visitors and search engines still see after the malware is gone. Check these areas before you announce that the site is back.

After you clean a site that search engines flagged, request a review in Google Search Console so the warning can be lifted. Keep monitoring Search Console for new security issues over the following weeks.

How Do You Prevent the Next Hack?

Preventing a repeat attack comes down to fewer entry points, fewer privileges and faster detection. Start with these measures, which address the most common routes into WordPress sites:

• Keep core, themes and plugins updated, and remove the ones you do not use.
• Require two-factor authentication for every administrator account.
• Give each user only the role they need.
• Serve your site over HTTPS so logins and form data are encrypted in transit. Our guide on enabling HTTPS on WordPress with a free SSL certificate explains how.
• Use a firewall, including a Web Application Firewall (WAF), which is a filter that inspects web requests and blocks malicious ones before they reach your site.
• Keep automated backups stored off-site, and test a restore at least once.
• Turn on alerts for file changes and new administrator accounts.

For a broader checklist, see our article on must-know WordPress security practices for 2026.

When Should You Call a Professional for Help?

Call a professional if you cannot identify the entry point, if the site processes payments or personal data, or if the infection keeps returning after cleanup. CISA’s fact sheet on protecting sensitive information from ransomware-caused data breaches suggests bringing in a reputable third-party incident response provider with data breach experience when the damage is serious.

If someone demands a ransom to release your site or data, do not pay it. The joint guide from CISA, MS-ISAC and federal law enforcement does not recommend paying ransom. Report the incident to your hosting provider and, where relevant, to law enforcement. If customer data was exposed, check the breach notification rules that apply where you operate.

Frequently Asked Questions

Can I recover a hacked WordPress site without a backup?

Sometimes, but it takes more work. You can replace core files, themes and plugins with official copies, remove injected code, and reset every password. Ask your host whether it keeps server-level snapshots, which can serve as a fallback backup.

How long does it take to recover a hacked WordPress site?

There is no fixed timeline. A simple infection with a recent clean backup can often be resolved in an afternoon, while a deep infection with unknown entry points can take several days. Time spent preserving evidence and finding the entry point is well spent, because it prevents a repeat incident.

Will Google penalize my site after a hack?

A hack can cause security warnings and spam pages that hurt your visibility in search results. Once the site is clean, use the Security Issues report in Google Search Console to see what was flagged, fix it, and request a review. Results vary, so keep the site clean and monitored afterward.

Should I pay a ransom if my site is locked?

No. The joint CISA, MS-ISAC and federal law enforcement guide does not recommend paying ransom. Restore from a clean backup, remove the malware, and get professional help if you need it.

Is a security plugin enough to protect my site?

No. A security plugin helps with scanning, firewall rules and login protection, but it cannot replace updates, strong passwords, two-factor authentication, limited user roles and tested backups. Use the plugin as one layer in a broader plan.

Should I restore the newest backup or an older one?

Restore the most recent backup made before the infection. The newest backup may already contain the malware or the attacker’s changes, so check each backup’s date and contents before you choose.

Conclusion

Recovering a hacked site follows a clear sequence: preserve evidence, contain the damage, lock out the attacker, patch the entry point, remove the malware or restore a clean backup, and then harden and monitor the site. Work through each step carefully, and you can bring your WordPress site back safely and make it harder to hack next time.