You open your website and something is wrong. Maybe it sends you to a pharmacy shop in another language. Maybe Google shows This site may be hacked under your name, or a customer emails to say their browser blocked your page. It is a horrible feeling, and it usually lands on the busiest day of the week.
Here is the good news. A hacked WordPress website can almost always be cleaned, and most of the work follows the same order every time. This guide walks you through that order in plain words, from the first ten minutes to the day Google lifts the warning. Where a step needs a developer, we say so, and you can hand this page to whoever helps you.
The short version
- Do not delete anything yet. Put the site in maintenance mode, tell your host, and take a full backup of the hacked site as it is.
- Lock the doors. Change every password, refresh the WordPress security keys, and remove any admin account you do not recognize.
- Clean it properly. Replace WordPress core, plugins and theme with fresh copies, then clean the database and uploads folder.
- Find out how they got in and close that gap, or the hack comes back within days.
- Ask Google to review the site in Search Console once it is fully clean, not before.
How to tell your WordPress site has been hacked
Some hacks are loud and some are almost invisible to you as the owner, because they only show spam to Google or to visitors coming from a search. These are the signs we see most often, and what each one usually points to.
| What you notice | What it usually means |
|---|---|
| Visitors from Google land on spam or a scam site | A redirect hidden in a plugin, theme file, the database or the .htaccess file |
| Google shows This site may be hacked or Chrome shows a red warning | Google found spam pages or malware and flagged the site |
| Thousands of strange pages in Google, often in Japanese or about pills and casinos | SEO spam pages created inside your site to borrow its rankings |
| Admin users you did not create | Someone has a way in and made sure they can come back |
| Your host suspends the site or warns about outgoing spam email | The server is being used to send spam or attack other sites |
| The site is suddenly slow or the hosting bill jumps | Hidden scripts are running on your server |
| Your own login stops working | Your password or account was changed |
If you want a second opinion, Google’s Safe Browsing site status tool shows whether Google currently considers your site unsafe, and the Security Issues report in Search Console lists exactly what Google found.
Why WordPress sites get hacked
It is rarely WordPress itself. Patchstack, a company that tracks WordPress vulnerabilities, found 11,334 new ones in 2025, a 42% rise on the year before. Only six were in WordPress core, and all six were low priority. The other 91% were in plugins and 9% in themes, the add-ons owners install over the years and then forget about.
The second problem is speed. For the vulnerabilities attackers like most, Patchstack measured a median of five hours between the flaw becoming public and mass attacks starting, and about half of high-impact flaws were exploited within a day. Worse, 46% of the 2025 vulnerabilities had no fix from the developer when they were made public. Updating every week is good, but on its own it cannot keep up.
Weak or reused passwords, old admin accounts from a past developer, abandoned plugins and cheap shared hosting where one infected site can reach its neighbours make up most of the rest. Server-level flaws happen too, like the PHP2Shell vulnerabilities in October 2026, but those are your host’s job to patch.
How to fix a hacked WordPress website, step by step
Work through these in order. Skipping ahead to the cleaning is the most common reason a site gets hacked again a week later.
Step 1. Stay calm and write down what you see
Take screenshots, note the time you first noticed the problem, and list anything that changed recently, such as a new plugin, a theme update or a new person with access. The WordPress.org guide FAQ My site was hacked calls this your incident report, and it saves hours later.
Step 2. Contain the damage
- Put the site in maintenance mode, or ask your host to show a temporary page, so visitors are not sent to spam or malware.
- Tell your hosting company. On shared hosting the hack may reach other sites, and your host can often see which file was changed first.
- Run a virus scan on the computers that log in to the site. Stolen passwords often come from an infected laptop, not from the website.
Step 3. Back up the hacked site as it is
It feels odd to back up something infected, but this copy is your safety net if the clean-up breaks something, and it is the evidence you need to work out how they got in. Download all files and export the database, and keep the copy somewhere it cannot run, such as your own computer.
If you have a clean backup from before the hack, keep it ready too. Just do not restore it blindly, because it contains the same weakness that let the attacker in, and an old backup may also hold a hidden back door.
Step 4. Reset every way in
- Change the passwords for every WordPress administrator, your hosting control panel, SFTP or FTP, and the database.
- Replace the security keys in the wp-config.php file with new ones from the official WordPress key generator. This logs everyone out at once, including the attacker.
- Open Users in WordPress and delete any administrator you do not recognize. Check Search Console’s users too, attackers sometimes add themselves there.
- Turn on two-factor login for every admin account.
You will change the passwords once more at the end. If the attacker still has a back door during the clean-up, they can read the new ones.
Step 5. Find the hack
Now look for everything the attacker added or changed. A security plugin scan and a remote scanner are a good start, but they miss things, so a developer usually checks by hand as well.
- Core files. Compare WordPress core and plugins against the official copies. If you or your developer use WP-CLI, the commands below list every file that does not match.
- Recently changed files. Look for PHP files inside the uploads folder, where they should never be, and for files changed around the date the problems started.
- The usual hiding places. The .htaccess file, wp-config.php, the theme’s functions.php, header.php and footer.php, and the mu-plugins folder.
- The database. Search posts, options and widgets for script tags, iframes and links you did not add.
wp core verify-checksums
wp plugin verify-checksums --all
wp user list --role=administratorThe first two commands come straight from the WP-CLI documentation. The last one lists every administrator, so you can spot an account that should not be there.
Step 6. Clean and replace
- Delete the wp-admin and wp-includes folders and upload fresh copies of the same WordPress version, rather than using the reinstall button.
- Reinstall every plugin and the theme from the original source. Delete any plugin or theme you no longer use, and replace any that has been abandoned by its developer.
- Remove PHP files from the uploads folder and clean the .htaccess file back to the WordPress default.
- Remove the spam content, redirects and injected scripts you found in the database.
- Once the site is clean, update everything, then change all passwords one final time.
Step 7. Close the door they came in through
If you never find how they got in, the clean-up is only a pause. Check your hosting access logs around the date of the first changed file, and compare the plugins you run against known vulnerabilities. Then add the protection that was missing, usually a web application firewall that blocks known attacks, limits on login attempts, and a regular update routine. WordPress.org’s hardening guide and our beginner’s guide to WordPress security cover the settings worth changing.
Step 8. Ask Google to review the site and keep watching
Only when the whole site is clean should you ask Google to look again. The next section explains how. After that, keep an eye on the site for a few weeks. Watch for new admin users, changed files and unfamiliar pages in Google, because a missed back door usually shows itself within days.
How to remove the “This site may be hacked” warning from Google
- Open Google Search Console for your site and go to Security and Manual Actions, then Security Issues.
- Read the issues listed and the sample pages. Make sure every one of those pages is fixed or returns a 404 or 410 error.
- Click Request Review and explain what happened, what you removed and what you changed to stop it happening again.
- Wait for the email. Google says reviews can take several days or weeks, and asking before the site is fully clean slows the next review down.
- If spam pages were indexed, remove them with the Removals tool and submit a fresh sitemap so Google picks up your real pages again.
Rankings usually come back once the warning is lifted and the spam pages drop out of Google, but it can take a few weeks. If yours have not recovered after that, a free SEO audit will show what Google still sees.
How to stop your WordPress site being hacked again
- Fewer plugins. Every plugin is a door. Keep only the ones you use and that are still maintained.
- Updates every week, with a check that the site still works afterwards.
- A firewall and malware scanning that work even when a plugin has no fix yet.
- Two-factor login and one account per person. Remove access the day someone leaves.
- Daily backups stored away from the server, and a test restore now and then.
- Good hosting. Isolated accounts, a patched server and someone who notices when something changes.
The Canadian Centre for Cyber Security’s baseline security controls for small and medium organizations is a good checklist for the business side, from passwords to backups. Our post on a website maintenance strategy turns the website part into a simple routine.
When to call in a professional
You can do steps one to four yourself today, and they are the ones that matter most in the first hour. Steps five to seven need someone comfortable with files, databases and server logs. If your site takes payments, stores customer details or is hacked for a second time, bring in help early, because a half-finished clean-up costs more in the end.
If you would rather hand it over, our website security service cleans hacked WordPress sites, finds how the attacker got in and puts protection in place. Our website maintenance plans keep it that way, with real-time malware scanning and removal on the Premium SEO+ and Enterprise plans, and our WordPress hosting adds Imunify360 malware protection, SSL and daily backups to every site.
Questions owners ask about hacked WordPress sites
Cleaning usually takes from a few hours to a couple of days, depending on how deep the hack goes and how big the site is. Getting a Google warning removed adds the review time on top, which Google says can take several days or weeks.
Rankings often drop while Google shows a warning or indexes spam pages. They usually recover once the site is clean, the warning is lifted and the spam pages drop out of Google, which can take a few weeks.
A clean backup helps, but restoring it on its own puts back the same weakness that let the attacker in, and an older backup may already contain a hidden back door. Restore it, then update everything, change every password and close the gap they used.
Usually not. Replacing WordPress core, plugins and the theme with fresh copies and cleaning the database removes the hack without losing your content, design or rankings.
In Canada, a business covered by PIPEDA must report a breach of personal information to the Office of the Privacy Commissioner and notify the people affected when there is a real risk of significant harm, and it must keep a record of every breach for two years. If customer details may have been exposed, read the Privacy Commissioner’s guidance or speak to a lawyer.
Check Google Search Console for security issues, search Google for site:yourdomain.ca to look for spam pages, and watch for new admin users or changed files over the next few weeks. A security scanner on a schedule makes this easier.
Hacked right now?
Let us clean your website and lock it down
We remove the hack, find how the attacker got in and close the gap, then help you get any Google warning lifted. Call us if it is urgent, or send the details and we will reply within one business day.
Sources
- Patchstack, State of WordPress Security in 2026
- WordPress.org, FAQ My site was hacked
- WordPress.org, Hardening WordPress
- Google Search Console Help, Security issues report
- Canadian Centre for Cyber Security, Baseline cyber security controls for small and medium organizations
- Office of the Privacy Commissioner of Canada, Mandatory reporting of breaches of security safeguards
