WordPress Site Hacked? What to Do in the First Hour

If your WordPress site has been hacked, spend the first hour on four things, in this order: confirm it really is a hack, contain it (maintenance mode or take it offline, and lock out the attacker), change every password and key, and save a copy of the infected site before anyone cleans it. Don't delete files at random or restore a backup straight away. A rushed clean-up often leaves the back door in place and the site is reinfected within days. Once it's contained, you clean the site properly, ask Google to review it if it was flagged, and fix whatever let the attacker in.

I'm Rustam from Frame the Pixel, a WordPress maintenance studio in Kuala Lumpur. I clean up hacked sites, and the ones that go best are the ones where the owner stayed calm in the first hour. Here's what that hour looks like.

Minutes 0 to 10: Confirm it's a hack

Not every strange thing is a hack. A broken layout after an update, or a critical error message, is usually a conflict, not an attacker. Signs that point to a real compromise:

• Visitors are redirected to spam, gambling or pharmacy sites, often only on mobile or only from Google.
• Google shows "This site may be hacked" in results, or Chrome shows a red warning.
• Search results for your site show pages you never wrote, often in another language.
• New administrator accounts you didn't create.
• Your host has suspended the site or emailed you about malware or spam.
• Unfamiliar files in the root folder or in uploads, especially PHP files in uploads.

Check Google Search Console's Security Issues report if you have access. It tells you what Google has found and on which pages.

Minutes 10 to 25: Contain it

The goal now is to stop the damage spreading and stop the attacker getting back in while you work.

1. Tell your host. They may already know, and many can isolate the account, scan it or restore server-level snapshots. Ask whether other sites on the same account are affected.
2. Put the site in maintenance mode or take it offline if it's sending visitors to harmful pages. Losing a few hours of traffic is better than infecting customers. Your host can help with this if you can't log in.
3. Check for unknown admin users. In WordPress go to Users and filter by Administrator. Remove anyone you don't recognise, after noting their usernames and email addresses for your records.
4. Don't install five security plugins at once. It slows the site and confuses the clean-up. One reputable scanner is enough at this stage.

Minutes 25 to 40: Change every password and key

Assume every login connected to the site is known to the attacker.

• Every WordPress administrator, editor and shop manager password.
• Hosting control panel and any FTP or SFTP accounts.
• The database password (update it in wp-config.php too, or the site will stop connecting).
• Your email account, if the attacker could have used password resets.
• The WordPress security keys and salts in wp-config.php. Changing them logs everyone out. WordPress's wp-config documentation explains where they are and links to the official generator.

Turn on two factor authentication for every admin account while you're at it. WordPress's own guide to brute force protection covers the basics.

Minutes 40 to 60: Save evidence and take a snapshot

Before anyone deletes anything, take a full backup of the infected site: files and database. Label it clearly as infected and keep it away from your normal backups. It's useful because:

• It shows how the attacker got in, which you need to fix.
• If something legitimate is deleted by mistake during clean-up, you can recover it.
• If customer data might have been exposed, you may need it for reporting.

Then write a short timeline: when you noticed, what you saw, what you changed. It takes five minutes and helps everyone later.

A word on customer data

If your site stores personal data, such as WooCommerce orders, membership accounts or form entries, a hack may be a data breach. In Malaysia, the amended Personal Data Protection Act introduced data breach notification duties, and in the UK and EU, GDPR has its own reporting rules and timelines. I'm not a lawyer, so check with your regulator's guidance or a legal adviser, but don't leave this until the end of the week.

What not to do in the first hour

• Don't restore last week's backup and call it fixed. The backup may already contain the back door. Attackers often get in days or weeks before you notice.
• Don't delete core files at random. You may remove the infection's symptoms and leave its source.
• Don't just change the admin password. The attacker may have other users, a hidden file or database access.
• Don't pay anyone demanding a ransom without professional advice.

After the first hour: Clean up properly

Clean-up takes longer than an hour, often a day or more for a badly infected site. A proper clean-up:

1. Replaces WordPress core files with fresh copies from WordPress.org.
2. Reinstalls every theme and plugin from the official source, rather than trusting existing files.
3. Removes anything unknown in uploads, especially PHP files.
4. Searches the database for injected scripts, spam links and rogue admin users.
5. Removes any plugins or themes you don't use, and any nulled (pirated) ones, which often carry malware.
6. Checks scheduled tasks, .htaccess and server cron jobs for things that put the malware back.
7. Updates everything and checks the site is on a supported PHP version.
8. Scans again, and keeps scanning for a few weeks.

Once it's clean, if Google flagged the site, follow Google's guide for hacked sites and request a review in Search Console. Reviews for malware warnings usually take days, not weeks.

If you also have a backup you trust, from before the infection started, restoring it and then patching the hole can be faster. I've written about restoring a broken WordPress site in more detail.

Why WordPress sites keep getting hacked

If this is the second or third time, something is letting the attacker back in. The usual causes:

• Outdated plugins and themes. Security researchers consistently find that the large majority of new WordPress vulnerabilities are in plugins rather than core (see Patchstack's State of WordPress Security report). WordPress publishes security releases and plugin developers do the same, but only if someone installs them.
• A back door left behind after a rushed clean-up.
• Weak or shared passwords, or old staff and developer accounts.
• Nulled premium plugins downloaded from unofficial sites.
• Other infected sites on the same hosting account.
• Hosting on an unsupported PHP version.

WordPress's hardening guide is worth reading end to end. In short: update promptly, use strong unique passwords with two factor, give each person their own account with the lowest role they need, keep off-site backups, and monitor for file changes.

The backup, security and uptime tools I use cover the software side, and the WordPress maintenance checklist covers the routine.

Your first hour, as a checklist

1. Confirm it's a hack (redirects, Google warning, unknown admins, host notice).
2. Tell your host.
3. Maintenance mode or offline if visitors are at risk.
4. Remove unknown admin users, noting their details first.
5. Change all passwords: WordPress, hosting, FTP, database, email.
6. Reset WordPress security keys and salts.
7. Turn on two factor authentication.
8. Back up the infected site separately, and write a timeline.
9. Check whether customer data was involved.
10. Plan a proper clean-up, or call someone who does them.

Need help now?

If you'd rather not do this alone, cleaning hacked sites and keeping them clean is part of my website maintenance service. I'll contain the site, clean it properly, find the way in and close it, then help with the Google review. I work 9am to 5pm Malaysia time (GMT+8) with clients in Malaysia, the UK, Europe and elsewhere. Contact me here or email contact@framethepixel.com with your domain and what you're seeing.

FAQ

How do I know if my WordPress site is hacked?

Common signs are redirects to spam sites, a Google or browser warning, unknown admin users, strange pages in search results, or a notice from your host. Search Console's Security Issues report confirms what Google has found.

Can I just restore a backup?

Only if you're confident the backup predates the infection, and even then you need to fix the hole that let the attacker in. Otherwise you'll be hacked again.

How long does it take to clean a hacked WordPress site?

The first hour is about containment. A full clean-up usually takes from a few hours to a couple of days, depending on how deep the infection goes.

Why does my WordPress site keep getting hacked?

Usually a back door left after an earlier clean-up, an outdated or nulled plugin, weak passwords, or another infected site on the same hosting account.

Will a hack hurt my Google rankings?

It can if Google flags the site or indexes spam pages. Clean up quickly, request a review in Search Console, and rankings usually recover once the warning is removed.