WordPress Website Hacked? What to Do and How to Get It Fixed

If you think your WordPress website has been hacked, the first priority is to work out what has happened and stop the problem getting worse.

A hacked website doesn’t always look obviously hacked.

You might see strange redirects, spam pages appearing in Google, an unfamiliar administrator account, security warnings, unexpected files, changes to your homepage or emails from your hosting company.

Sometimes everything looks completely normal to you while visitors are being redirected somewhere else.

The good news is that a hacked WordPress website can usually be cleaned and recovered without rebuilding it.

But simply deleting the first suspicious file you find isn’t enough. You need to remove the compromise, establish how access was gained and close that route so the website isn’t infected again.

Want us to check your website?

If you suspect your WordPress website has been hacked and would rather have somebody investigate it properly, our Website Security service can help identify, clean and secure the problem.

Tell Web Medic What’s Happening

How Can I Tell If My WordPress Website Has Been Hacked?

There isn’t one single symptom.

Signs of a compromised WordPress website can include:

• visitors being redirected to another website
• spam or pharmaceutical pages appearing in Google
• unknown administrator accounts
• security warnings from Google or browsers
• your hosting company reporting malware
• strange files appearing on the server
• unexpected changes to pages or menus
• new plugins you didn’t install
• emails being sent from the website without your knowledge
• the website suddenly becoming very slow
• the site being suspended by your hosting company
• security software reporting modified or malicious files

WordPress describes these kinds of symptoms as Indicators of Compromise in its official guidance for hacked WordPress websites.

Before you start deleting things, make a note of exactly what you’re seeing and when you first noticed it.

That information can be extremely useful when tracing what happened.

1. Don’t Panic – But Don’t Ignore It

Finding out that your website may have been compromised is alarming, but making lots of uncontrolled changes can make the investigation harder.

Start by recording what you know.

For example:

• When did you first notice the problem?
• What exactly did you see?
• Has your host contacted you?
• Has Google or a security service issued a warning?
• Were any plugins or themes recently installed or updated?
• Has anyone recently been given administrator, hosting or FTP access?

Take screenshots of warnings where useful.

If your host has sent you details of infected files or suspicious activity, keep that information too.

You are effectively creating a small incident record that can help establish what changed and when.

2. Take a Backup Before You Start Cleaning

Backing up a website that’s already infected might sound strange.

But before making significant changes, it’s useful to have a snapshot of the current files and database.

The official WordPress hacked-site guidance recommends taking a snapshot before the cleaning phase.

An infected backup isn’t something you’d want to restore casually later, but it can preserve evidence and give you something to refer back to if an attempted repair removes or damages legitimate files.

If you already have historical backups, don’t overwrite them.

An older backup from before the compromise may become extremely useful.

Keep clean historical backups and the current compromised snapshot separate.

3. Change the Important Passwords

If somebody has gained unauthorised access, assume that credentials may have been exposed until you’ve established otherwise.

Important credentials can include:

• WordPress administrator passwords
• hosting control panel passwords
• FTP/SFTP or SSH credentials
• database credentials
• other accounts with access to the website

Use strong, unique passwords rather than variations of passwords used elsewhere.

WordPress also recommends invalidating existing logged-in sessions after a compromise so that changing a password doesn’t simply leave an attacker with an already authenticated session.

And once the website has been completely cleaned, change the important passwords again.

Why twice?

Because if malicious code capable of capturing credentials is still present during the initial response, your first replacement password may itself be exposed.

4. Check for Unknown WordPress Administrators

Go to:

Users → All Users

and look carefully at accounts with Administrator privileges.

Do you recognise all of them?

An attacker who has created their own administrator account may be able to regain control even after some malicious files have been removed.

Don’t automatically delete an unfamiliar account until you’ve established whether it belongs to a developer, agency or legitimate service provider.

But an administrator account nobody recognises needs investigating.

On a seriously compromised site, checking only the WordPress Users screen may not be sufficient because user information can also need inspecting directly in the database.

5. Scan the Website for Malware and Changed Files

A security scan can help identify suspicious files, modified WordPress core files and known malicious code.

But treat a scan as evidence rather than a magic clean-up button.

A scanner may tell you:

/wp-content/plugins/example/file.php contains suspicious code

That’s useful.

But the next questions are:

Is that the only malicious file?

and:

How did it get there?

A compromise may involve several files, database changes, rogue administrators or hidden backdoors.

Deleting one flagged file can therefore make the scan look cleaner while leaving the attacker with another way back in.

6. Check WordPress Core Files

WordPress core should be a known quantity.

If core files have been modified or malicious files have been inserted into core directories, clean copies can be compared with or restored from the official WordPress distribution.

The official hacked-site guidance specifically identifies areas such as:

/wp-admin/

and:

/wp-includes/

as places where known-clean WordPress files can be useful during recovery.

But wp-content needs more care.

That’s where your themes, plugins and uploaded content live, so blindly replacing or deleting everything there could remove legitimate parts of your website.

7. Check Your Plugins and Themes

Outdated or vulnerable plugins and themes are a common route into WordPress websites.

Check what is installed.

Anything you no longer use should normally be removed rather than simply left deactivated indefinitely.

For software you do use:

• check that it comes from a trusted source
• check whether updates are available
• look for plugins or themes you don’t recognise
• investigate anything that has been abandoned for years

The official WordPress security hardening guidance recommends keeping plugins updated and removing plugins that are no longer required.

Be particularly suspicious of pirated or “nulled” commercial themes and plugins. Saving the licence fee isn’t much of a bargain if the download contains a backdoor.

8. Look for Backdoors and Persistence

This is where cleaning a hacked website becomes considerably more technical.

Malware isn’t always designed merely to display spam or redirect visitors.

An attacker may leave behind a backdoor – another way to execute code or regain access later.

That can be hidden in places that look unrelated to the visible infection.

This explains a frustrating situation some website owners experience:

the site is cleaned, everything looks fine, and a few days later it’s hacked again.

That doesn’t necessarily mean somebody successfully attacked it twice.

The original access may never have been completely removed.

Finding persistence can involve inspecting PHP files, database records, scheduled tasks, server logs and files outside the obvious WordPress directories.

At that point, this is no longer normal WordPress administration.

9. Check .htaccess and Other Important Files

Some compromises alter files that affect how requests are handled across the whole website.

WordPress’s hacked-site documentation specifically highlights .htaccess as a file worth inspecting during a cleanup.

Other important files may include:

• wp-config.php
• index.php
• theme functions files
• header and footer files

That doesn’t mean every unusual-looking line is malicious.

WordPress sites can contain legitimate custom code, security rules, caching directives and hosting-specific configuration.

The challenge is distinguishing intentional modifications from malicious ones.

10. Check Whether Google Has Found the Hack

Sometimes the first sign of compromise appears in Google rather than on the website itself.

You might search for your business and find unexpected pages advertising:

• pharmaceutical products
• gambling
• fake products
• foreign-language spam
• completely unrelated services

Attackers can create large numbers of spam URLs while leaving the visible homepage apparently untouched.

Google Search Console can be useful here.

Check for security warnings and unexpected indexed pages. Google’s Security Issues report guidance explains the types of hacked content and security problems Google may detect.

After the website has been cleaned, Google may need time to recrawl affected URLs and remove spam results.

If Google has issued a formal security warning, follow the appropriate review process once you’re confident the site is genuinely clean.

11. Check the Website From More Than One Device

A hacked site may deliberately avoid showing malicious behaviour to everyone.

Redirects can be conditional.

For example, they might only affect:

• mobile visitors
• visitors arriving from Google
• people who aren’t logged into WordPress
• first-time visitors
• particular countries

This can make the owner think:

“It works perfectly for me.”

Meanwhile customers are being redirected somewhere completely different.

Test the website logged out, in a private/incognito browser window and on another device where appropriate.

If a customer reports something you can’t reproduce, don’t automatically assume they’re mistaken.

12. Work Out How the Website Was Compromised

This is one of the most important stages.

Cleaning the malware deals with what happened.

Finding the entry point helps stop it happening again.

Possible routes include:

• a vulnerable plugin or theme
• outdated WordPress software
• a compromised administrator password
• stolen hosting or FTP credentials
• malicious or untrusted software
• another compromised account with server access
• insecure server configuration

Server and access logs can sometimes provide useful evidence about when suspicious requests or file changes occurred.

You won’t always be able to prove exactly how an attacker got in.

But you should at least remove obvious vulnerabilities and access routes rather than considering the job complete as soon as the homepage looks normal.

13. Update and Harden WordPress After the Cleanup

Once the website is genuinely clean, bring its legitimate software into a sensible supported state.

That normally means reviewing and updating:

• WordPress core
• plugins
• themes
• PHP where appropriate

Remove unused software and unnecessary administrator accounts.

Use strong unique passwords and consider two-factor authentication for administrator accounts.

The WordPress Hardening guide also covers additional measures for strengthening a WordPress installation.

The aim isn’t to install fifteen security plugins.

It’s to reduce unnecessary attack surfaces, keep software maintained and make unauthorised access considerably harder.

Should I Just Restore a Backup?

A known-clean backup from before the compromise can be extremely useful.

But there are two questions:

How do you know when the website was first compromised?

and:

Have you fixed whatever allowed the compromise?

A site might have been infected days or weeks before the visible symptoms appeared.

Restoring yesterday’s backup could therefore restore the malware as well.

And even a genuinely clean backup can be compromised again if you restore it while leaving the same vulnerable plugin or stolen credentials in place.

For ecommerce, membership and frequently updated sites, you also need to consider newer orders, customer data and content that would be lost by rolling the database backwards.

So:

restore + identify cause + secure

is much better than:

restore + hope.

Does a Hacked WordPress Website Need Rebuilding?

Usually, no.

A compromised WordPress installation doesn’t automatically mean your pages, products, images and content need throwing away.

The website can normally be cleaned, legitimate files restored or repaired, compromised access removed and security tightened.

There are exceptional cases where rebuilding part or all of a severely compromised or hopelessly outdated website makes practical sense.

But that decision should come after diagnosis, not simply because somebody sees the word “hacked” and spots an opportunity to sell a new website.

Web Medic’s starting point is the opposite:

Can we safely repair the website you’ve already got?

Can I Clean a Hacked WordPress Website Myself?

Possibly, if you have the necessary technical experience.

But there’s a significant difference between:

installing a security scanner

and:

being confident that a compromised website is clean.

Once the job involves malicious PHP, modified server files, database inspection, hidden administrators, access logs, backdoors and determining the original attack route, it’s easy to remove the visible symptom without removing the compromise.

If you’re running a business website, that can create a false sense of security.

This is one of those jobs where “it looks fixed” isn’t quite good enough.

If you’d rather have the site investigated properly, our Website Repair Services and Website Security service cover hacked and compromised websites.

We don’t need to have built your website or host it.

We’ll investigate what’s happened, clean the compromise and deal with the underlying problem so you can get back to using the site.

Hacked WordPress Website – Frequently Asked Questions

Think Your WordPress Website Has Been Hacked?

Don’t wait for the problem to disappear by itself.

Send Web Medic your website address and tell us what you’ve noticed.

We’ll investigate what’s happened, explain the problem and work out the sensible way to clean and secure your website.