Don’t Panic: How to Recover and Secure Your Hacked WordPress Site

If you find your WordPress site hacked, work through it in order: confirm the signs, contain the damage, take a copy of the site as it is, then clean it, lock it down and ask Google to review it. Cleaning means replacing WordPress, your theme and your plugins with fresh copies and removing what the attacker added, or restoring a backup from before the hack.

A hack is stressful, but it is fixable. What slows recovery is rushing: deleting files at random, restoring a backup that is already infected, or never closing the hole the attacker used.

Is your WordPress site hacked? How can you tell?

The clearest signs are warnings from Google or your host, and changes nobody on your team made. Look for:

• Redirects to spam. Google notes these redirects can fire only for some visitors, such as people arriving from search results, so the site may look normal when you type the address yourself.
• Google warnings. Your listing says "This site may be hacked" or "This site may harm your computer", or Chrome shows a red "Dangerous site" page.
• A Search Console alert in the Security issues report, or an email from Google.
• Spam pages in search results. A Google search for site:yourdomain.com shows pages you never created.
• Administrator accounts nobody on your team added.
• New files you did not add, especially PHP files (scripts) in the uploads folder, which is meant for images and documents.
• A suspension or malware notice from your host.
• A sudden slowdown or resource spike, since some malware uses a lot of server power.

Hackers often hide their spam from the site's owner, so treat Search Console's Security issues report as the source of truth. Google also advises against opening infected pages in your own browser; Search Console's URL Inspection tool shows what Google sees instead.

What should you do in the first hour?

Contain the damage and keep the evidence; do not start deleting things.

Write down what you see

Note what made you suspect a hack, when you noticed it, and any recent changes, such as a new plugin.

Take a copy of the hacked site

Before you change anything, back up the files and database as they are, label the copy "infected" and store it off the server. If the cleanup goes wrong you can return to it, and it holds clues about how the attacker got in.

Take the site offline if visitors are being harmed

If visitors are being redirected, served malware or shown a fake login or payment page, take the site offline until it is clean. Google advises doing this from outside the infected site, for example by having your host show a "temporarily unavailable" page, and says a short outage is unlikely to affect your rankings.

Contact your host and change the main passwords

Your host can check whether other sites on your account are affected, read the server logs and may hold backups. Change your hosting, WordPress admin and SFTP (secure file transfer) passwords now; you will change them again once the site is clean. If the site takes payments or stores customer details, tell your payment provider and get advice on notifying customers: the FTC notes that every US state has a data breach notification law.

How do you clean up a hacked WordPress site?

Scan to find what changed, replace everything you can with fresh copies, then remove what the attacker added where a fresh copy does not reach.

Scan with more than one tool

Use a remote scanner such as Sucuri SiteCheck (free), which checks your site from outside the way a browser sees it, and one that runs inside WordPress, such as the free version of Wordfence, which compares your WordPress, theme and plugin files with the official copies and looks for known malware. WordPress.org recommends using both. A clean result is not proof: a remote scan cannot see backdoors (hidden scripts that let an attacker back in) stored in server files.

Replace WordPress, themes and plugins with fresh copies

Download the WordPress version you are running from WordPress.org and replace the wp-admin and wp-includes folders completely over SFTP. WordPress.org advises against the dashboard's reinstall option here, because it replaces existing files and attackers often add new ones. Keep wp-config.php and the wp-content folder, but check wp-config.php and the .htaccess file for code you did not add.

Then delete each plugin and theme folder, install fresh copies from WordPress.org or the developer, and remove any you no longer use. Restore a custom-coded theme from a copy you know is clean.

Check the places a fresh install misses

• wp-content/uploads. Look for PHP files. A few plugins keep legitimate files here, so ask before deleting one you are unsure of.
• wp-content/mu-plugins. Must-use plugins run automatically and are not listed with your other plugins, which is why attackers hide malware here.
• The site's main folder. Watch for files named like WordPress core files that do not belong there.

Inspect the database

Back up the database first, then open it with the phpMyAdmin or Adminer tool in your hosting panel. Look for spam posts, links or scripts injected into your content, and administrator accounts you did not create. Some malware hides its account from the Users screen, so check the users table directly. If you are unsure whether something is malicious, get help rather than deleting it.

Or restore a backup from before the hack

Restoring a clean backup is often the fastest way back. A hack can go unnoticed for days, so choose one from before the first sign of trouble and scan it before you trust it. You lose everything added since: posts, form entries, comments and, on a store, orders, so note those from the infected copy first. Then update everything straight away, because the restored site still has the weakness the attacker used.

How do you lock your site down after a hack?

Change every password and key, then close the hole the attacker used. Skip either step and they can walk back in.

• Change every password again: every WordPress user, hosting, SFTP and SSH, the database (put the new one in wp-config.php) and email accounts on your hosting.
• Generate new security keys. Replace the keys and salts in wp-config.php with a fresh set from WordPress.org's secret-key generator. This logs everyone out, including an attacker holding a stolen login session.
• Remove what you do not recognize: users, plugins, and application passwords (under Users > Profile).
• Turn on two-factor login for every administrator, with the free Two Factor plugin maintained by WordPress contributors or a security plugin such as Wordfence.
• Scan the computers you log in from, because malware there can capture your new passwords.
• Turn off the dashboard file editor with the DISALLOW_FILE_EDIT setting in wp-config.php. WordPress notes it is often an attacker's first tool after logging in.

Find and close the way in

Common ways in are an out-of-date plugin, theme or WordPress version, a weak or reused password, and malware on an administrator's computer. Update everything, install plugins and themes only from WordPress.org or the developer, and ask your host for the access logs from when the hack began. Fix the way in before you ask Google for a review.

How do you get your site off Google's blocklist?

Once the site is clean and the hole is closed, request a review in Google Search Console. As of October 2026, the process is:

• Verify that you own the site in Search Console.
• Open the Security issues report and fix every issue it lists across the whole site, not only the sample pages.
• Select Request Review and explain what you found, what you fixed and how you checked it.
• Wait for the email. Google says reviews take from a few days to a few weeks, with spam hacks taking longest, and that warnings come off within 72 hours of a clean result.

Do not resubmit while a review is pending. A site that keeps switching between clean and infected can be marked a repeat offender, which blocks new review requests for 30 days.

For spam pages still in search results, make sure they return a "not found" error, then use Search Console's Removals tool to hide them for about six months while Google recrawls. If your host suspended the site, tell them what you cleaned and ask them to lift it. Bing and antivirus companies run their own review processes.

When should you get help with a hacked site?

Get help if the site takes payments or holds customer data, if you cannot log in, if the hack returns after a cleanup, or if you are not comfortable editing files and the database; Google notes that fixing malware takes the ability to read code.

If your site is hacked now, WP Resolve's Emergency Fix is a flat $199 with a 24-hour turnaround, and no plan is needed. For ongoing protection, our care plans start with Essential Care at $79 a month, including malware scanning, uptime monitoring, basic hardening and daily off-site backups kept 30 days. Business Care ($149 a month) adds malware cleanup.

Not sure whether your site is clean, or whether your backups would get you back? Ask for a free site health check covering updates, backups, security and speed, or text (916) 209-0917.

Frequently asked questions