How to fix a hacked WordPress site (and what to do first)

Short answer

If your WordPress site is hacked, the short answer is this: preserve evidence calmly instead of panicking, limit access rather than shutting the site down abruptly, reset every password and security key, remove the malicious code, and finally close the entry point by applying the updates you skipped.

Followed in that order, these five steps remove the visible damage and stop the same attack from repeating within days. Rushing to delete one suspicious file and assuming the problem is solved is the single most common, and most expensive, mistake site owners make.

How do you know your WordPress site has been hacked?

The signs that a WordPress site has been compromised rarely show up in just one place. A homepage that suddenly looks different, search results showing pharmacy or gambling descriptions next to your site’s name, an unexplained drop in traffic, and admin accounts you don’t recognize are the most visible ones. A security warning from Google Search Console deserves attention too, since Google only sends that notice after its own crawler detects a malicious redirect or hidden link on your pages.

In some cases the site looks completely untouched. An attacker can deliberately stay quiet and use the server to send spam or attack other sites instead of defacing anything visible. A “resource usage spike” or “malware detected” notice from your hosting provider is worth taking just as seriously, even without a visible symptom to match it.

Why do WordPress sites get hacked in the first place?

Research consistently shows that most compromised sites aren’t breached through a software vulnerability at all. A weak or reused admin password is the entry point, and automated brute-force attempts against wp-login.php and xmlrpc.php eventually guess it. Outdated plugins and themes, especially “nulled” copies pulled from outside the official marketplace and no longer receiving security patches, make up the second most common doorway.

Shared hosting adds its own risk: another compromised site on the same server, loosely configured file permissions, and an outdated WordPress core version all sit near the top of the list too. What these causes share is that nearly every one of them is preventable, and most of the fixes cost nothing but time.

What to do if your WordPress site is hacked: the first 24 hours

Once you confirm your WordPress site is hacked, the order you follow in the first 24 hours directly determines how much damage spreads and how long cleanup takes. The five steps below follow the sequence most security firms and major hosting providers recommend.

1. Preserve evidence, don’t shut the site down abruptly

The first instinct is usually to take the site offline immediately, but that can tip off the attacker and prompt them to erase their tracks faster than you can investigate. Back up the current state of files and database first, note which files changed most recently along with their timestamps, and review the list of admin users. These records make it far easier to work out where and how the attacker got in, and they’re the most useful thing you can hand to a hosting provider or security specialist.

2. Reset every password and every security key

Change every admin password, the database user password, and your hosting and FTP credentials, all of them, not just the ones you suspect were touched. Update the security salt keys in wp-config.php using fresh values from WordPress’s official secret-key generator; this single step instantly invalidates any stolen session cookies the attacker was relying on. Don’t stop at the WordPress dashboard either, since reusing the same password anywhere else means that account needs changing too.

3. Remove malicious code and hidden backdoors

Attackers typically leave a hidden “backdoor” file behind so they can walk back in after cleanup, often disguised under an innocent-looking name inside a folder like wp-includes. Run a full scan with a trusted security plugin such as Wordfence or Sucuri to catch known malware signatures, then compare every file changed within the last month against a clean WordPress installation. Replacing plugin and theme files with fresh copies from official sources is far more reliable than manually reading through code line by line, which is slow and easy to get wrong.

4. When does restoring a clean backup make sense?

If the damage is extensive, or you can’t pin down exactly how far the malicious code spread, rolling back to a clean backup from before the hack is the fastest and safest route. The critical detail is making sure that backup genuinely predates the attack; some malware sits undetected for weeks, so even a backup from last week can already be compromised. Once you restore, don’t skip the password and key reset, or the attacker simply walks back in through the same door.

5. Close the gap: updates and hardening

Once cleanup is done, update WordPress core, every plugin, and the theme to their latest versions. Delete anything you no longer use outright rather than just deactivating it, since a deactivated plugin still sits on the server as a potential target. Turn on two-factor authentication, add a mechanism that limits login attempts, and disable the file-editing feature inside wp-config.php so code can’t be changed from the dashboard. Reviewing our broader WordPress security and performance guidance alongside this step helps make sure the same weakness doesn’t resurface later.

What should you do if Google flagged your site as hacked?

If your site shows up in search results tagged “This site may be hacked,” or Search Console sent a security notice, open the Security Issues report first to see exactly which pages and which issue type, malware, hidden text, or phishing, were flagged. Once you’re confident cleanup is complete, request a review from the same panel. Google usually responds within a few days, but if the cleanup was only partial, the warning simply returns and the whole process starts over.

You can generally leave the site live while waiting for that review, since the warning displays at the browser level and doesn’t pull the site offline on its own. Still, disabling sensitive flows such as checkout or membership login until cleanup is confirmed is a sensible precaution for protecting visitor trust in the meantime.

Staying clean: habits that prevent a repeat

Finishing the cleanup isn’t the end of the job; a few habits need to become permanent if you want to avoid going through this twice. A separate, strong password for every admin account, stored in a password manager instead of a shared document, removes one of the easiest entry points outright. Turning on automatic updates for WordPress core, plugins and themes, or at minimum checking them weekly by hand, shrinks the window during which a known vulnerability stays exploitable.

Regular backups stored somewhere independent of the site itself remain the fastest recovery path for a hack or any other technical failure. A backup that exists but has never been test-restored is not something you can rely on. Finally, learning to tell this scenario apart from a white screen or critical error that has a purely technical, non-security cause saves time during diagnosis and keeps you from chasing the wrong fix.

Next step

The answer to what to do if your WordPress site is hacked follows a clear sequence, but carrying it out takes time, and skipping a single step puts the whole recovery at risk. If the damage is extensive, the backdoor is well hidden, or Google’s warning keeps coming back after cleanup, bringing in outside help cuts both the lost time and the reputational risk substantially. If you’d like to talk through a security cleanup, hardening, or the ongoing technical maintenance that follows for a WordPress site, our group company Web Tasarım Ofisi supports exactly this kind of work.

To talk through your site’s security architecture or a custom software need, take a look at our custom software service or get in touch with Argo Ajans. WP Engine’s detailed recovery guide is also a useful point of comparison for the technical steps covered above.