WordPress Site Hacked? Here's What to Do Right Now

Discovering your WordPress site has been hacked is stressful. First: most hacked sites can be fully recovered. Speed matters. Here's exactly what to do, in order.

Step 1: Confirm the Hack

Signs: redirects to other sites, Google malware warnings, unexpected admin users, strange content, host account suspended. Run your URL through Google's Safe Browsing checker and Sucuri's free site scanner — our full guide to scanning for malware yourself covers more free tools and what to check manually.

Step 2: Change All Passwords Immediately

WordPress admin accounts, FTP credentials, database passwords, hosting control panel. If attackers still have valid credentials, cleaning malware won't matter — they'll re-infect within hours.

Step 3: Put Site in Maintenance Mode

Stop exposing your visitors to malware and prevent search engines from indexing compromised pages while you work on cleanup.

Step 4: Restore From a Clean Backup

If you have a verified clean backup from before the hack, restoration is the fastest path. After restoring, change all passwords again and apply all outstanding WordPress updates — the vulnerability may still exist in the restored version.

Step 5: Scan and Remove Malware

Without a clean backup, use Wordfence or MalCare for a complete scan. Remove every flagged file. Be thorough — hackers leave multiple backdoors.

Step 6: Request Blacklist Removal

Submit a review in Google Search Console after cleanup. Google typically reviews within 1–3 business days.

Step 7: Harden to Prevent Re-Infection

Fix the vulnerability, enable 2FA, configure WAF, limit login attempts. A cleaned site without hardening will be re-infected, often within hours.

Should You Notify Your Customers?

This depends on what the hack actually exposed. If it was purely a defacement or malware injection with no evidence customer data was accessed — no database breach, no payment information exposed — formal notification usually isn't required, though transparency is still good practice if visitors may have seen a warning or odd behavior. If there's any indication customer data, passwords, or payment details were compromised, most jurisdictions have specific breach notification laws with real deadlines, and this is a case where getting legal advice quickly matters more than trying to handle it quietly. When in doubt, treat any WooCommerce store or site that stores customer accounts more cautiously than a purely informational site.

How Attackers Usually Get In

Understanding the common entry points makes the hardening step above much more concrete. The large majority of WordPress compromises trace back to a small handful of causes rather than some especially clever attack. Outdated plugins and themes are the most common by far — automated bots constantly scan the web for sites running versions with known, published vulnerabilities, and a site with even one out-of-date plugin is an easy target regardless of how strong its passwords are.

Weak or reused admin passwords are the second major cause, especially when the same password gets used across multiple sites or services. If any one of those gets breached elsewhere, attackers try the same credentials against thousands of WordPress logins automatically, a technique that costs them almost nothing to run at scale. Compromised FTP or hosting account credentials open a similar door, often through malware already sitting on an admin's own computer rather than anything wrong with the site itself. Installing a "nulled" (pirated) premium theme or plugin is another frequent cause, since these files are often modified to include a hidden backdoor before being distributed for free.

Less common but still real: vulnerable third-party integrations, exposed API keys committed somewhere public, and straightforward brute-force attempts against a login page with no limit on failed tries. Knowing which of these actually applies to your situation matters, because restoring a backup and updating plugins won't help if the real point of entry — a reused password, a pirated theme, a compromised local computer — is still sitting there waiting to be used again.

Common Questions