WordPress Hacked – What to Do? Guide

Suddenly your website redirects to unfamiliar sites, Google shows a warning, or unknown administrators appear in the backend? Then you need to act quickly, but carefully. This guide shows step by step what to do if your WordPress website has been hacked – and how to prevent another attack.

In short: If WordPress has been hacked, first back up the current state, change all passwords and, if necessary, put the website into maintenance mode. Then remove the malicious code from files and database or restore a clean backup, close the exploited vulnerability, update everything and request a review from Google. If you don’t close the cause, the attack usually comes back.

How can you tell that WordPress has been hacked?

A hack is often not obvious at first glance. Many pieces of malware are built so that logged-in administrators notice nothing while visitors or search engines are redirected. Watch for these typical signs:

Visitors are redirected to spam, gambling or phishing sites, often only on mobile devices or when arriving via Google.
Google shows “This site may be hacked” in search results or the browser warns against the site.
Security issues or foreign pages in foreign languages appear in Google Search Console.
Unknown users with administrator rights exist.
The host suspends the account or reports mass email sending.
Unknown files are in the WordPress directory, especially in the uploads folder.
The website is unusually slow or the server is heavily loaded.

What types of WordPress hacks are there?

Most attacks on WordPress pursue a financial goal: attackers want to use the server and the trust Google places in your domain for their own purposes. The type of hack determines how urgently you need to act and what consequential damage is at stake.

Type of hack	What happens	Typical sign
SEO spam	Thousands of spam pages are created or links are injected	foreign pages in Google search, often in other languages
Redirects	Visitors are redirected to scam or advertising sites	Redirect mainly when arriving via Google or on mobile devices
Phishing	Fake login or banking pages are placed on your server	Warning from Google or from the host
Spam sending	The server sends mass emails	Emails end up in spam, host blocks sending
Backdoor	Hidden access for later attacks	often no visible signs
Data theft	Customer data or payment forms are skimmed	modified checkout scripts, customer complaints

What should you do immediately? The first 5 steps

In the first hour, the aim is to limit the damage and secure evidence. Don’t delete anything hastily – the infected files will help you find the cause later. Proceed in this order:

Stay calm and document: Take screenshots of the warnings and anomalies, with date and time.
Back up the current state: create a complete copy of files and database – even if it is infected.
Change passwords: all WordPress administrators, hosting account, FTP/SFTP, database and the email accounts linked to the website.
Restrict access: for active redirects or phishing, put the website into maintenance mode.
Inform your host: Many providers help with analysing server logs and provide older backups.

How do you remove malware from WordPress?

You remove malware either by thoroughly cleaning the existing installation or by restoring a backup from before the attack. A backup is faster, but only works if the time of infection is known and the vulnerability is closed afterwards. Otherwise the website will be infected again after a short time.

Approach	Advantage	Disadvantage	Suitable if
Restore a clean backup	fast, complete	Changes since the backup are lost	Time of infection known, backup certainly clean
Manual cleanup	no data loss	time-consuming, expertise required	no clean backup available
Rebuild with content import	very thorough	high effort	Installation badly damaged or infected multiple times

How to proceed with the cleanup

Replace the WordPress core with a fresh copy of the same version (the wp-admin and wp-includes folders).
Delete all plugins and themes and reinstall them from official sources.
Search the uploads folder for PHP files – they don’t belong there.
Check wp-config.php and .htaccess for foreign code.
Search the database for injected scripts, foreign links and unknown administrators.
Run a malware scan with a security plugin or a server-side scanner.
Renew the security keys (salts) in wp-config.php so that all sessions become invalid.

How do you close the security vulnerability?

You close the vulnerability by finding and eliminating the cause of the attack. In most cases this is an outdated plugin or theme, less often a stolen password or insecure hosting. The server logs often show which file the first access came through. Then update all components and remove extensions that are no longer maintained. Our article The most common security vulnerabilities in WordPress plugins shows which vulnerabilities are exploited most often.

How do you remove Google warnings after a hack?

You remove Google warnings via Google Search Console. Once the website is fully cleaned, request a review in the “Security issues” section and briefly describe what you have done. The review usually takes a few days. Also check whether spam pages have been indexed and, if necessary, have them removed from search results using the removals tool.

Does a hack have to be reported?

If personal data may have been affected by the attack – such as customer accounts, orders or form entries – a reporting obligation under the GDPR may apply. The report to the competent data protection authority must then generally be made within 72 hours. Clarify this promptly with your data protection officer or legal counsel.

How do you prevent another attack?

Update plugins, themes and the WordPress core regularly.
Delete unused plugins and themes completely.
Use strong, unique passwords and two-factor authentication for administrators.
Use a firewall and a malware scanner.
Set up daily external backups with a sufficiently long retention period.
Continuously monitor the website for changes and availability.

Frequently asked questions when WordPress has been hacked

Can I simply restore the latest backup?

Only if the backup definitely dates from before the infection and you close the vulnerability afterwards. Many infections go unnoticed for weeks, so even more recent backups may already be affected.

How long does it take to clean a hacked WordPress website?

A typical cleanup takes between a few hours and one working day. Getting Google warnings lifted can then take a few more days.

Why was my website hacked of all things?

As a rule, it was not a targeted attack. Bots automatically scan the internet for vulnerable plugin versions and attack every website they find – regardless of size or fame.

Is it enough to install a security plugin?

No. A security plugin can find malicious code and make attacks harder, but it does not reliably remove all backdoors and does not close the original vulnerability.

Who can help me if I can’t manage it myself?

Our WordPress hacked – malware removal service cleans files and database, closes the vulnerability and supports you with Google warnings – with a free initial assessment and a fixed price.

Conclusion

A hack is annoying, but almost always fixable. The order is decisive: secure the state, lock down access, remove malicious code, close the cause, inform Google. Anyone who then relies on regular updates, backups and monitoring significantly reduces the risk of another attack. For acute problems, you can reach our WordPress Emergency Service.

Updates, backups and security – handled by us

From €39/month, cancel monthly, hosting-independent.

Start maintenance now Free consultation