My WordPress Site Was Hacked: The First Hour

If your WordPress site was hacked, do these things in order: put the site into maintenance mode so it stops harming visitors, change every password from a device you trust, then find and remove the infection before you bring the site back. Do not start deleting files at random. A messy panic can lose you the evidence of how they got in, which is the one thing you need to stop it happening again.

Here is the first hour, step by step.

First, contain it

A hacked site is often actively hurting you: serving malware to visitors, sending spam, or hosting scam pages under your domain. Every hour it stays up that way, the damage grows and search engines get more reason to flag you.

1. Put the site into maintenance mode, or switch it off at the host. Most hosts have a one-click "disable site" or you can point the domain at a holding page. A site that is off cannot infect anyone.
2. If you cannot switch it off yourself, ask your host's support to disable it. Getting the site offline is faster and safer than trying to clean it while it is live and still infecting visitors.

Contained does not mean fixed. It means you have stopped the bleeding and bought time to work carefully.

Lock the attacker out

Assume the attacker has credentials. Changing passwords is pointless if you do it on a device that is also compromised, so use a computer you trust.

• Reset your hosting control panel password.
• Reset the WordPress admin passwords for every user, and delete any admin account you do not recognise.
• Reset the database password and update wp-config.php to match.
• Reset FTP and SSH credentials.
• If you reused any of these passwords anywhere else, change those too.

New admin users you have never seen are a classic sign the attacker gave themselves a way back in. Remove them.

How do I find out what the hacker changed?

Now you look for the damage before you undo anything. You are trying to answer two questions: what did they change, and how did they get in.

Start with a malware scan. A reputable scanner will flag injected files, modified core files, and suspicious database entries. How to tell if your website has malware walks through free scanning options and what the results mean.

Then check the obvious hiding places: recently modified files (sort by date), unfamiliar files in your uploads folder, and unexpected admin users or posts. Note what you find. If the same out-of-date plugin keeps showing up in the results, you have probably found the door they walked through.

Restore clean, do not just patch over

You have two realistic ways back to a clean site.

Restore a backup from before the hack. If you have a known-good backup from before the attack, this is usually the fastest clean route. Restore it, then immediately update everything and change passwords again, because the vulnerability that let them in is still there in an old backup. This is exactly why tested, off-site backups matter so much. A backup you have never restored is a guess, and the day of a hack is a bad day to find out it does not work.

Clean the live site. With no clean backup, you remove the malicious files and database entries by hand or with a cleanup tool, and reinstall WordPress core and any compromised plugins from official sources. This is slower and easier to get wrong. If the infection is deep or you are not confident, this is the point to bring in someone who does this for a living. A missed backdoor means you are back here in a week.

Close the hole and tell Google

Cleaning the site without patching the vulnerability just resets the clock. Whatever you found in the damage step, fix it now:

1. Update WordPress core, every theme, and every plugin to the current version. What happens if you never update WordPress explains why this is the fix for most hacks.
2. Delete plugins and themes you are not using. Inactive code still gets exploited.
3. Follow the official WordPress hardening guide for file permissions and access.

If your site was flagged as hacked in search results or your browser showed a warning, request a review once it is clean. Google's help for hacked sites covers the process in Search Console. Reviews can take a few days, so do this as soon as the site is genuinely clean, not before.

What to check before you call it done

Run through this before you take the site out of maintenance mode:

Then run a quick website audit to confirm forms, SSL, and load speed all survived the cleanup.

What to do next

If you have a clean backup and some confidence, you can work through this yourself. If the scan keeps flagging files after you clean them, or you cannot find how they got in, stop and get help before the site goes back online. A half-cleaned site that gets reinfected is worse than one that stays offline for another day.