WordPress site hacked? What to do first

By Alleo Gordon, founder of WonderlandSites

Here’s a moment I’d like you never to have. You’re between clients, you open your own website to send someone the link, and it isn’t your website. It’s a page selling something you’ve never heard of. Or Google shows a red warning before it will let anyone in. Or a client messages to say their antivirus blocked your site.

(That’s an example, not a real client. But every part of it is a sign WordPress itself lists as a clear indicator of a hack.)

If that’s happening to you right now, you’re not the first, and it’s recoverable. Here’s what to do first, in order, in plain English.

Step 1: Stay calm and write down what you see

WordPress’s own guidance starts in the same place: stay calm, then document (WordPress: FAQ My site was hacked). Before you change anything, note:

• What you’re seeing that makes you think you’ve been hacked.
• When you first noticed it, and the time zone.
• What changed recently: a new plugin, a theme change, a new user, a password shared with someone.

Take screenshots on your phone. This becomes your incident record. Whether you fix it yourself or ask someone else to, it saves hours.

Step 2: Check it really is a hack

“Hacked” can mean lots of things, and some problems look like a hack but aren’t. A site that’s simply down, or a scary email that turns out to be a false alarm, needs a different fix.

These are the clear signs, taken from WordPress’s own list:

• Google, Bing or another service flags your site as unsafe or blocklisted.
• Your host has switched your site off.
• Your site has been flagged for spreading malware.
• Visitors say their antivirus is warning them about your site.
• You’ve been told your site is attacking other sites.
• You see things you didn’t do, such as new admin users.
• You can see the hack when you open the site in a browser.

If none of these apply, it may be a different problem. Your host can often confirm whether it’s a hack or an outage.

Step 3: Tell your host

Contact your hosting company early. On shared hosting, a hack can affect more than your site, and your host may already be taking steps. They can also tell you whether your site’s email has been caught up in it, because hacked sites are sometimes used to send spam, which can get your email blocked.

Ask them three things: what they can see, what they’ve already done, and whether they have a clean backup from before the problem.

Step 4: Lock the doors

Next, change every way into your site, not just your WordPress password. WordPress’s guidance lists the access points to change (WordPress: FAQ My site was hacked):

1. Your WordPress admin password, and those of every other user, especially administrators.
2. Your hosting control panel login.
3. FTP or SFTP logins (how files get onto your server).
4. Your database password, if you know how (your host can help).

Use long, unique passwords from a password manager. While you’re there, look at Users in WordPress and remove any account you don’t recognise. If you can’t change some of these because the person who set them up has stopped replying, here’s how to get your logins back when your web developer has disappeared.

WordPress also recommends logging everyone out by changing the “secret keys” in a file called wp-config.php. If that sentence means nothing to you, that’s fine. It’s a job for your host or whoever looks after your site.

Then do one more thing that’s easy to forget: scan your own computer with your antivirus. Sometimes the way in was a stolen password from an infected laptop, not the website at all.

Step 5: Take a copy before anyone cleans

This feels odd, but it matters. Before cleaning starts, take a backup of the site as it is now, infected or not. If the clean-up goes wrong, you’ll at least have something to go back to, and it helps work out how the attacker got in.

If you already have a clean backup from before the hack, that’s your best friend. But be careful: if the hack started weeks before anyone noticed, your recent backups may include it too. This is why keeping several backups over a few weeks matters.

Step 6: Clean it, or have it cleaned

This is the hard part, and honestly, it’s where most owners should get help. Cleaning a hacked site means finding every changed or added file, not just the obvious one. Attackers often leave a hidden back door so they can return.

What a proper clean-up includes:

• Scanning the site with a reputable security scanner, from inside and outside the site.
• Replacing WordPress’s own core files with fresh copies of the same version.
• Checking the theme, plugins and uploads for files that shouldn’t be there.
• Checking the files attackers like most, such as .htaccess, which controls redirects.
• Removing anything you don’t use. Old plugins and themes are common ways in.
• Updating everything once it’s clean.

Restoring an old backup can look like a shortcut, but if the hole the attacker used is still open, they can simply come back. Clean, close the hole, then update.

Step 7: Change the passwords again

Once the site is confirmed clean, change all those passwords again. WordPress specifically recommends this, in case the attacker saw the first set of new ones while they still had access.

Then turn on two-step login if you can. It means a stolen password alone isn’t enough to get in.

Step 8: Think about your visitors’ data

If your site collects personal information, such as enquiry forms, bookings, newsletter sign-ups or customer accounts, a hack may count as a personal data breach.

This part is not legal advice. In the UK, the Information Commissioner’s Office says that if a breach is likely to put people’s rights and freedoms at risk, you must tell the ICO as soon as possible and, where you can, within 72 hours of becoming aware of it. If the risk to people is high, you must also tell those people without undue delay (ICO: UK GDPR data breach reporting). The ICO has a self-assessment tool and a guide for small businesses on its site. If you’re unsure, start there, or speak to a qualified adviser.

Step 9: Ask Google to look again

If Google showed a warning, you’ll need to tell Google once the site is clean. Google Search Console is the free tool for this, and WordPress recommends registering your site with it (and with Bing Webmaster Tools) so you hear about problems sooner.

After it’s over: make it harder next time

No site can be made “unhackable”. Security is about lowering the risk, not removing it (WordPress: Hardening WordPress). The basics go a long way:

• Keep WordPress, plugins and themes up to date.
• Keep backups off the site, for long enough to go back a few weeks.
• Use strong, unique passwords and two-step login.
• Delete plugins and themes you don’t use.
• Know when your site goes down.

And if you want this off your mind entirely, that’s what website care is for.

Want a second pair of eyes? Start with a free Website Check

If your site has been cleaned and you’d like to know where it stands now, send me your link and I’ll look it over.

Your free Website Check I look over your website and tell you in plain words what’s working and what’s holding it back, with your top 3 fixes, most important first. It arrives within 24 to 48 hours, Monday to Friday. No jargon, nothing to sign, and nothing changed on your site. Get your free Website Check

Which of the steps above would you want someone else to handle?

---

Frequently asked questions

How do I know if my WordPress site has been hacked? Clear signs include a Google or antivirus warning, your host switching the site off, admin users you didn’t create, or pages you can see have been changed. If none of these apply, the problem may be an outage or a false alarm instead.

Can I just restore a backup? Sometimes, but only if the backup is from before the hack and you also close the hole the attacker used. Otherwise they can get back in. Take a copy of the hacked site first, in case you need it.

Do I have to report a hacked website? Not legal advice. If personal data may have been exposed and that’s likely to put people at risk, UK GDPR expects you to report it to the ICO, where feasible within 72 hours. The ICO’s self-assessment tool can help you decide.

---

About the author Alleo Gordon, founder of WonderlandSites. IT technician at a sixth form college in Bethnal Green for 3 years; looking after websites since 2018.