Hacked WordPress Site: Act Fast Without Making It Worse
Is your site showing strange redirects, unknown pages, a warning message, or a blocked admin login? A hacked WordPress site needs to be handled with method. In the rush, the wrong moves can erase evidence, break the site, or leave an active backdoor in place.
The immediate goal is to limit exposure, keep a copy of the current state, and identify the source of the compromise before bringing the site back online.
This intervention is scoped to search for malicious files, remove the identified elements, check sensitive access, and reduce the risk of reinfection.
The first 30 minutes: what to do if WordPress is hacked
- Stay calm and document what you see. Note the messages shown, the redirects, the pages affected, and the time you discovered it. Take screenshots before making any changes.
- Put the site into maintenance mode or isolate it. If possible, temporarily restrict public access. If in doubt, contact your host to suspend the display without deleting files.
- Back up the current state, even infected. Copy the files and the database before the cleanup. This backup shouldn't be restored as-is, but it can help understand the incident and recover a useful element.
- Change your passwords and security keys. Start with hosting, SFTP or FTP, the database, WordPress admin accounts, and the associated email addresses. Also renew the WordPress security keys to close active sessions.
- Don't delete files at random. A file with an unusual name isn't necessarily malicious, while a backdoor can hide inside a file that looks legitimate.
What you should absolutely not do
Immediately restoring an old backup
A backup may already contain the injected code or the exploited vulnerability. Restoring without checking can bring the site back online with the same problem.
Installing several cleanup plugins at once
Stacking scanners complicates the analysis, sometimes overloads the server, and can produce contradictory results. An automated tool can spot some known files, but it doesn't replace a structured review.
Updating WordPress and every plugin in the middle of the emergency
Updates matter, but they should come after backing up the compromised state and identifying suspicious elements. A rushed change can blur the trail or cause an additional outage.
Assuming the problem is fixed because the homepage works
A hacked site can look normal while still sending some visitors to another page, creating spam in search results, or keeping a hidden access point open.
When to hand it off to a professional
It's wise to hand things off when you can no longer access the admin area, when the site redirects visitors, when files keep coming back after deletion, or when several sites on the same hosting account are affected.
Professional help is also recommended for a WooCommerce store, a membership site, or a site that processes personal data. In that case, you need to check not just the public display, but also user accounts, available logs, technical access, and any possible impact on the data.
You can check the WordPress interventions offered by WPASSIST to choose the right level of support.
What a professional checks beyond generic guides
A thorough cleanup isn't just about deleting the file flagged by a scanner. It means looking for the mechanisms that let the attacker come back.
Ghost admin accounts
An account may have been created with an inconspicuous name, an unknown address, or hidden elevated rights. WordPress accounts, hosting access, and database users all need to be checked.
Persistent backdoors
A backdoor can be placed in a plugin, a theme, a WordPress core file, or a rarely monitored directory. It lets the attacker regain control after a superficial cleanup.
Malicious cron jobs
Some infections use WordPress or server scheduled tasks to recreate deleted files, launch spam, or reinject code at regular intervals.
Files injected into the uploads folder
The media folder seems harmless, but it can contain scripts that have no business being there. A proper check needs to tell legitimate images apart from executable or obfuscated files.
Hidden redirects
They can depend on the browser, the country, where the visitor came from, or their login status. So the site owner doesn't always see the malicious behavior.
The risk of reinfection
Removing the symptoms without fixing the compromised access, the vulnerable plugin, or the exposed credentials leaves the site fragile. The work needs to include finding the likely cause and applying suitable hardening measures.
WPASSIST intervention: Malware cleanup at 119 €
The "Malware cleanup" intervention aims to clean up a compromised WordPress site and reduce the risk of reinfection. The scope covers analyzing the available files and access, searching for malicious elements, removing what's identified, checking admin accounts, and verifying common persistence mechanisms.
We keep this honest: a cleanup doesn't replace regular maintenance, tracked updates, verified backups, and suitable monitoring. After the intervention, the site still needs ongoing upkeep.
This intervention is carried out by WPASSIST's WordPress technical team, specialized in maintenance and troubleshooting for WordPress and WooCommerce sites.
To set up this kind of prevention for the long run, check out WPASSIST Care plans.
FAQ — Hacked WordPress: frequently asked questions
How do I know if my WordPress site has been hacked?
Common signs include unknown redirects, new pages, unrecognized admin accounts, modified files, browser warnings, spam in search results, or abnormal server resource use. Some incidents, however, stay invisible without a technical analysis.
Can I clean up a hacked site myself?
It's possible if you're comfortable with WordPress, hosting, the database, and technical logs. You need to work on a backed-up copy, identify persistence mechanisms, and check access. Simply deleting the detected files may not be enough.
Is a clean backup enough to bring the site back online?
Not always. You need to check the backup's date, fix the likely cause of the intrusion, renew access credentials, and check the other sites on the same hosting account. Otherwise the compromise can come back.
What should I do after the cleanup?
Set up verified backups, apply updates methodically, remove unnecessary accounts, limit admin rights, and monitor sensitive changes. These measures reduce exposure without eliminating all risk.