WordPress Site Hacked? Here's What to Do Right Now

Discovering your WordPress site has been hacked is stressful. First: most hacked sites can be fully recovered. Speed matters. Here's exactly what to do, in order.

Step 1: Confirm the Hack

Signs: redirects to other sites, Google malware warnings, unexpected admin users, strange content, host account suspended. Run your URL through Google's Safe Browsing checker and Sucuri's free site scanner.

Step 2: Change All Passwords Immediately

WordPress admin accounts, FTP credentials, database passwords, hosting control panel. If attackers still have valid credentials, cleaning malware won't matter — they'll re-infect within hours.

Step 3: Put Site in Maintenance Mode

Stop exposing your visitors to malware and prevent search engines from indexing compromised pages while you work on cleanup.

Step 4: Restore From a Clean Backup

If you have a verified clean backup from before the hack, restoration is the fastest path. After restoring, change all passwords again and apply all outstanding WordPress updates — the vulnerability may still exist in the restored version.

Step 5: Scan and Remove Malware

Without a clean backup, use Wordfence or MalCare for a complete scan. Remove every flagged file. Be thorough — hackers leave multiple backdoors.

Step 6: Request Blacklist Removal

Submit a review in Google Search Console after cleanup. Google typically reviews within 1–3 business days.

Step 7: Harden to Prevent Re-Infection

Fix the vulnerability, enable 2FA, configure WAF, limit login attempts. A cleaned site without hardening will be re-infected, often within hours.