Home / Quick tips

WordPress site hacked: what to do right now

Is your site redirecting to strange pages, is Google warning visitors, or has your host suspended it? Don't delete anything yet, and first make a backup of the current state. Then work through the steps in this order, otherwise the infection will soon come back.

How to tell you've been hacked

• Redirects to unknown sites, often only on mobile or when arriving from Google.
• A browser warning, or an entry under Security issues in Search Console.
• Strange pages in search results when you search for site:yourdomain.com.
• An unknown administrator, unknown files, or an email from your host about sending spam.

What to do

1. Back up the files and the database exactly as they are. You'll need the backup for analysis, and to go back if the cleanup fails.
2. Change every password: WordPress administrators, hosting, FTP or SFTP, database. Do it from a computer you trust.
3. Delete unknown administrators and replace the security keys in wp-config.php. That logs out all active sessions.
4. Replace files with originals: WordPress core, plugins and themes. Delete plugins and themes you don't use.
5. Check what originals won't replace: PHP files in wp-content/uploads, the mu-plugins folder, .htaccess files, wp-config.php, the siteurl and home rows in the wp_options table, and foreign scripts in your content.
6. Find the way in. It's usually an outdated plugin, a pirated theme or a leaked password. As long as the hole stays open, the attacker will come back.
7. Request a review. Once the site is clean, request a review under Security issues in Search Console so the warning can be removed.

Is restoring a backup enough?

Only if you know when the hack happened and the backup is older. Even then you have to close the hole the attacker used. An infection often sits in a site for weeks before it shows, so your latest backups may be infected too.

Don't forget

Could the attacker have reached your customers' personal data? In the EU you may have to report it to the authority within 72 hours. After the cleanup, turn on two-factor login and regular updates.

Would you rather not deal with it yourself? I can clean your hacked site and find how the attacker got in, and the initial diagnosis is free.