Hacked WordPress site: what to do right away and how to prevent it

Discovering that your site has been hacked is a nasty feeling: pages you did not write, a red warning in the browser, customers calling to tell you something is wrong. The first reaction is panic, but the most useful thing is to proceed in order. In most cases a compromised WordPress site can be cleaned and made safe again.

In this guide I explain how to recognise an attack, what to do in the first hours and how to reduce the risk of it happening again.

How to tell whether the site has been compromised

Some signs are obvious, others you only notice by looking carefully.

• Pages, posts or links you did not create, often on topics unrelated to your site.
• Redirects: opened from a phone or from Google, the site sends you elsewhere.
• Browser or Google warnings about a "dangerous site" or deceptive content.
• Unknown administrator users in the dashboard.
• Sudden slowdowns or unexplained traffic spikes.
• Spam emails sent in the name of your domain.
• Odd files in the site's folders, with random names.

A single sign is not enough to be sure, but it is a good reason to check right away.

What to do in the first hours

Proceed calmly and in this order.

1. Do not delete everything in a hurry. You might lose traces useful for understanding what happened.
2. Change passwords: WordPress dashboard, hosting, database, FTP, linked email. Use long, different passwords, and do it from a device you know is clean.
3. Put the site in maintenance mode or offline, if it can harm visitors (redirects, suspicious downloads).
4. Tell your hosting provider: it often has tools and logs that help, and can isolate the problem.
5. Make a copy of the site as it is, even compromised, to keep for analysis.
6. Find the last clean backup, from before the attack, and check that it is intact.

How a WordPress site is cleaned

Cleaning is not just "removing the bad file". A good job includes:

• restoring from a clean backup, or reinstalling core, theme and plugins from official sources;
• checking files and the database for foreign code and back doors left by the attacker;
• verifying users and permissions, removing unknown accounts;
• closing the hole that allowed the access: often an outdated plugin or theme, or a weak password;
• a final check from another network and device, and a new review request to Google if the site had been flagged.

If the cause is not found and closed, the site gets hit again soon after. It is the most frequent mistake.

What to tell customers and visitors

If the site has collected people's data (contacts, orders, accounts), the matter also becomes one of privacy. There may be notification obligations under the GDPR: in that case it is best to consult a competent adviser. For everyone else, a simple, honest message about recovery times is better than silence.

How to reduce the risk of it happening

Absolute security does not exist, but some habits greatly reduce the likelihood.

• Update WordPress, theme and plugins regularly, testing updates on a copy first. It is the most important point.
• Delete plugins and themes you do not use; deactivating is not enough.
• Use strong, unique passwords, and two-factor authentication for administrators.
• Limit users: each with the permissions they need, no more.
• Take frequent backups, kept outside the site's server (I talk about it in Website backup).
• Choose maintained plugins with a history of updates, avoiding "cracked" or dubious-origin software.
• Turn on monitoring that warns you if the site changes or goes down.
• Choose serious hosting, with isolation between sites and real support.

Much of this work is the core of regular maintenance.

Mistakes that make the problem worse

• Restoring a backup without understanding the cause. The attacker comes back through the same door.
• Trusting a single "security" plugin. It helps, but does not replace updates and good practice.
• Using the same password everywhere. If one service breaks, they all fall.
• Ignoring warnings from the browser or hosting.
• Having no recent backup. It is what turns an emergency into an inconvenience.

An emergency plan to prepare beforehand

The worst moment to decide what to do is when the site is already compromised. It is worth having a small written plan in advance:

• who to call: the developer or whoever handles maintenance, and hosting support;
• where the backups are and how they are restored;
• who has access to the dashboard, hosting, domain and database, and where it is stored securely;
• how to notify customers and visitors, if needed;
• who decides to take the site offline.

An hour spent writing these lines saves hours of confusion at the wrong moment.

After the cleanup: what to check in the following weeks

Cleaning does not close the matter. In the following weeks it is worth:

• checking that no new suspicious files or users appear;
• looking at logs and monitoring for any attempts to get back in;
• verifying in Search Console that there are no security reports;
• keeping updates and backups at a closer rhythm.

Why entrust it to me

I have been programming since 1999 and have delivered more than 300 projects. I handle maintenance and security of WordPress sites, including ones not built by me: updates tested first on a copy, backup before every intervention, security checks and monitoring. I work from Rome and remotely.

If your site shows odd signs, or you want to prevent instead of chasing, write to me: a chat of about 20 minutes, no strings attached, then a written, free proposal. The service is described in WordPress maintenance.