Updated: 2026-10-27
A customer emails a screenshot: your site, a red browser warning, and the line “is this you?” Or your host suspends the account overnight. Or you open the homepage and it redirects to a casino.
The first instinct is to start deleting things. Don’t. The order you do this in matters more than how fast you do it.
Is my website hacked, or just broken?
“Hacked” is a vague word, and WordPress.org’s own FAQ says so: before you can fix anything, name the symptoms. It lists the clear indicators of compromise, which it calls IoCs (WordPress.org, FAQ My site was hacked):
- the site is blocklisted by Google, Bing or another engine;
- your host has disabled the site;
- the site is flagged for distributing malware, or visitors’ antivirus complains;
- someone tells you the site is being used to attack other sites;
- behaviour you never authorised, such as new users appearing;
- you can see the damage in the browser.
Two more checks from Google’s side. Open Search Console’s Security Issues report; it shows what Google has found on your site, and it sorts hacked-site problems into malware, code injection, content injection and URL injection (Search Console Help, Security Issues report). Then search site:yourdomain.com and look for pages you never wrote. If those pages are in Japanese and sell brand goods, that is a specific pattern with its own cleanup; skip to the guide to fix japanese keyword hack spam once you have done the first two steps below.
If none of that fits and the site is simply down, it may be a hosting fault or a bad update, not an attack. Your host can usually tell you which.
Why a hacked site needs a sequence, not a scan
Most owners do this:
panic → install a scanner → delete what it flags → change the admin password → back to normal for two weeks → reinfected
The work that holds looks like this:
document → snapshot → lock access → scan inside and out → replace, don’t patch → clean the index → update → change passwords again → find the door
The difference is the last three arrows. A scanner removes what it recognises. It does not close the hole the attacker came through, and it does not touch what Google already indexed.
What to do if your website is hacked: step by step
1. Write down what you see
WordPress.org puts documentation first: what you saw, when (with time zone), and what changed recently, such as a new plugin, a theme edit or a widget. Note your host and PHP version too. It takes a few minutes and it becomes your incident report, whether you clean the site yourself or hand it over.
2. Snapshot the infected site
Copy the files and export the database before you change anything. WordPress.org recommends this explicitly: even an infected copy is something to go back to if the cleanup goes wrong. If you have a clean backup from before the hack, keep it separate and do not overwrite it.
3. Lock everyone out
Reset the passwords for every access point, not just your admin login: WordPress, hosting panel, FTP/SFTP and the database. Force a reset for every user, especially administrators. Then replace the secret keys in wp-config.php with a fresh set from the WordPress key generator; that logs out anyone still holding a session. Look through the user list for administrators you did not create.
4. Check with your host
On shared hosting, the compromise may not stop at your account. Your host may already be acting on it, and may hold backups you did not know you had.
5. Scan from both sides
WordPress.org suggests two kinds of scanner, because each sees different things. Inside the site, malware-scanning plugins from the WordPress.org directory; its FAQ names Quttera, GOTMLS, Wordfence and Sucuri. From outside, remote scanners such as VirusTotal and Sucuri SiteCheck. “No one solution is the best approach,” the FAQ says, “but together you improve your odds.” WordPress malware removal plugins find known patterns; treat their results as a list of leads, not a verdict.
Scan your own computer too. WordPress.org points out that many infections start with a trojan on the owner’s machine that steals FTP or admin logins.
6. Replace, don’t patch
Reinstall WordPress core of the same version you run, by SFTP, not with the dashboard reinstall button. The built-in installer overwrites existing files, but hacks add new ones. /wp-admin and /wp-includes can be replaced wholesale. Reinstall plugins and themes from their original source. Then go through wp-content slowly; your uploads and custom theme live there, and so do most leftovers.
Files to read line by line: .htaccess (in the root and in any subfolder that has one), index.php, and your theme’s header.php, footer.php and functions file. A change in any of them runs on every page request.
7. Or restore a clean backup
If you know roughly when the hack started and have a backup from before it, restoring is often faster than cleaning. Google’s cleanup guide lays out the three cases: a clean, current backup (restore it); a clean but outdated one (save the infected copy, restore the old one, then bring content forward carefully); or no backup (clean a copy, not the live server) (web.dev, “Clean and maintain your site”). The mechanics are in our guide on how to restore a WordPress website from a backup. A restore brings back the hole as well, so steps 8 to 10 still apply.
8. Clean what Google holds
Spam pages the attacker created must return 404 or 410. Remove unknown owners from Search Console under Settings → Users and permissions, and delete any sitemap you did not submit. The Removals tool hides a URL for about six months, but only sticks if the page is really gone (Search Console Help, Removals tool). If Security Issues listed a problem, fix every affected page, then use Request Review once. Google says malware reviews take a few days and spam-hack reviews can take up to several weeks (web.dev, “Request a review”).
9. Update, then change the passwords again
Once the site is clean, update WordPress, plugins and themes. Then change every password a second time. WordPress.org is specific about this: if you only changed them when you found the hack, change them again now, after the site is clean. Consider changing the database user and password as well, and update wp-config.php to match.
10. Find the door
Forensics is the step most people skip. Access logs, the modification dates on the injected files and the version of each plugin usually point at how they got in. If you cannot answer “how did they get in?”, assume they still can.
A worked example
There are no client case studies on this site yet, so this is a plainly hypothetical case.
Say a WordPress site starts redirecting mobile visitors from Google to a pharmacy page, while the owner sees nothing wrong on desktop. My agent would start where the redirect has to live: .htaccess, then the theme’s header, then the database options table, then any plugin that injects scripts. He compares every core file against a clean copy of the same version, lists the differences, and flags anything he is unsure about for the human reviewer instead of guessing. The report names what was removed, what is still the owner’s to do, and the most likely entry point.
Common mistakes
- Deleting before snapshotting. You lose the evidence and your only undo.
- Changing one password. The attacker usually has more than one way in: FTP, the database, a second admin user.
- Using the dashboard reinstall. It leaves the files the hack added.
- Restoring a backup and calling it done. The backup has the same unpatched plugin.
- Ignoring Google. A clean server with a dirty index still costs you clicks.
- Resubmitting the review request early. Google asks you not to resubmit while a request is pending.
DIY or hire?
My stance: if you have a clean backup, know roughly when the hack began, and Google shows no spam under your domain, do it yourself. The steps above are complete, and the follow-up is our WordPress security checklist.
If the site keeps getting reinfected, the redirect is invisible to you, or spam pages are already indexed, hand it over. Our hacked website repair service covers the full sequence above, cleanup through de-indexing and hardening. If the problem is mostly injected code on an otherwise healthy WordPress install, the narrower website malware removal job may be enough. Both run through the same AI agent pipeline, with a human review before delivery. No ranking promises. Hack cleanup is $79; if pages also need rebuilding, the restore tiers start at $49 with delivery in 3 days (pricing).
A scanner tells you what it found. A cleanup is finished when you can say how they got in.
Wayback Press (waybackpress.com) is an independent restoration and hacked-site cleanup service. Not affiliated with the Internet Archive or the Wayback Machine, nor with the Shift8 open-source “WaybackPress” command-line tool of the same name.