WordPress Site Hacked on SiteGround — Step by Step Fix (2026)

Your WordPress site on SiteGround has been hacked. You are seeing a suspended account, spam content on your pages, visitors being redirected to unknown sites, or warnings in Google Search Console. Whatever the symptom, here is the complete step by step process to identify what happened, remove the infection fully, and get your account reinstated.

If you need hands-on malware removal or wordpress emergency support while you work through it, WPOPS can take over. For the host-side context, see why your host won't fix the infection for you — and the parallel guide if this happened on Hostinger instead.

Step 1 — Identify the Type of Attack

Before starting the cleanup, identify exactly what you are dealing with. Different attacks leave different traces and require slightly different approaches.

• Account suspended by SiteGround — their automated scanners detected malware and pulled your site offline. You received a suspension email and your site is showing a suspension page.

• Spam redirect hack — visitors arriving from Google or on mobile devices are redirected to spam, pharmaceutical, or adult content. You may not see it yourself — check by searching your domain on Google and clicking the result, or by visiting on cellular data rather than your home network.

• Japanese SEO spam — your Google search results show Japanese characters in page titles and descriptions. Attackers have injected thousands of spam pages into your WordPress database.

• Phishing pages — attackers have created fake login pages for banks or payment platforms inside your hosting account. Google Safe Browsing or SiteGround's scanner flagged it.

• Malware warnings — Google Chrome shows a red warning page when visitors try to access your site, or Google Search Console has flagged security issues.

• Backdoor only — the site appears normal but a routine scan found hidden PHP files giving attackers ongoing access.

Step 2 — Confirm Your Access

Log into my.siteground.com. Even with a suspended account, SiteGround typically keeps Site Tools and File Manager access open so you can perform the cleanup.

If Site Tools is inaccessible, email abuse@siteground.com to request temporary access. Include your domain name and account email address. When SiteGround suspended the account for malware specifically, that guide covers the reinstatement email in more detail.

Step 3 — Take a Full Backup

Before touching anything, download a complete backup. In Site Tools go to Security — Backups and download the most recent full backup.

If the automated backup is unavailable due to the suspension, connect via SFTP and download your entire public_html folder manually, then export the database directly from phpMyAdmin.

Do not skip this step. You need a restore point before making any changes.

Step 4 — Scan Files and Database

Run a complete scan of both the file system and the database. Scanning only files and missing database injections is the most common reason sites get reinfected after a cleanup.

File system — look for PHP files in wp-content/uploads (there should be none), recently modified core files, files with random string names like b3f7a1.php, and files that mimic WordPress filenames like wp-class-login.php. Check every subdirectory — attackers hide files in rarely-inspected locations.

Database — in phpMyAdmin search wp_posts, wp_options, and wp_comments for injected content. Common strings to search for: eval(base64_decode, <iframe src=, document.write(unescape, and any external URLs you do not recognise in option values or post content.

If you can still access your WordPress admin dashboard, install Wordfence and run a full scan — it compares your files against official WordPress repository versions and flags any modifications.

Step 5 — Remove All Malware

Delete every malicious file. For infected plugin and theme files, do not edit out the injected code — download fresh copies from official sources and replace the files entirely via SFTP.

For WordPress core file infections — download the same WordPress version from wordpress.org/download/releases and replace the infected files. Do not touch wp-content or wp-config.php.

For database injections — use phpMyAdmin to run targeted SQL queries to remove injected content. For the Japanese SEO hack, you may need to delete thousands of injected post rows — use a DELETE query with a WHERE clause targeting the injected content rather than deleting manually.

For backdoor files in uploads — delete every PHP file found in wp-content/uploads. These are always malicious.

Step 6 — Change All Credentials

After removing the malware, change every password and access credential.

• WordPress admin password — update every admin account. Delete any accounts you do not recognise.

• Database password — generate a new one in SiteGround Site Tools under MySQL Databases and update DB_PASSWORD in wp-config.php.

• WordPress security keys — generate new ones at api.wordpress.org/secret-key/1.1/salt/ and replace the existing block in wp-config.php. This logs out all active sessions including any attacker sessions.

• SiteGround account password — change at my.siteground.com under Profile settings.

• SFTP password — update in SiteGround Site Tools under FTP Accounts.

Step 7 — Update Everything and Remove Unused Plugins

Before contacting SiteGround's abuse team, update WordPress core, all plugins, and all themes to current versions.

Also remove every plugin you are not actively using — deactivated plugins retain their files and remain exploitable. Remove nulled or pirated plugins entirely. Check for plugins that have not been updated in over 12 months and replace them with actively maintained alternatives.

Step 8 — Harden the Installation

Before going back online, close the entry points the attacker used.

• Install a WordPress firewall — Wordfence free tier blocks known malicious IPs and brute-force login attempts. Cloudflare's free plan adds an additional layer at the DNS level.

• Correct file permissions — folders at 755, files at 644, wp-config.php at 600. Set these via SiteGround's File Manager or SFTP.

• Disable PHP execution in uploads — create a .htaccess file in wp-content/uploads that prevents PHP files from executing, even if an attacker manages to upload one.

• Enable two-factor authentication — on your WordPress admin account and your SiteGround account.

• Limit login attempts — Wordfence includes this by default. It blocks IP addresses after a set number of failed login attempts.

Step 9 — Contact SiteGround's Abuse Team

Keep it direct: "I have removed all malicious files and database injections, updated WordPress core and all plugins, changed all credentials, and hardened the installation. Please review the account for reinstatement."

SiteGround's abuse team typically responds within a few hours and reinstates clean accounts within 24 hours.

• Your SiteGround account username and domain name

• A summary of what was found and removed

• Confirmation that all software is updated and all credentials changed

• A request for account review and reinstatement

Step 10 — Request Google Review if Needed

If Google flagged your site, submit a review request in Google Search Console under Security Issues — Request a Review. Describe what was removed. Google typically clears malware warnings within 24-72 hours of confirming a clean site.

How to Stop This From Happening Again

The same three factors cause the vast majority of WordPress hacks on SiteGround: an outdated plugin, weak or reused credentials, and no active monitoring. A cleanup fixes the current infection. Addressing these three factors prevents the next one.

Staged plugin updates — every update is tested on a staging copy before touching your live site. Vulnerabilities get patched before attackers can exploit them.

Daily off-site backups — stored independently of SiteGround, so a suspended account cannot take your backup down with it. Restore to a clean point in minutes.

Continuous security monitoring — active scanning that catches infections before they trigger a suspension or Google blacklisting.

These are included in every care plan — see WPOPS care plans from $49/month, plus ongoing wordpress maintenance. The cost of one hack in time, lost traffic, and recovery work typically exceeds a full year of prevention.

Frequently Asked Questions

How do I know if my WordPress site on SiteGround has been hacked?

Common signs include: SiteGround suspending your account for malware; visitors being redirected to spam pages (especially from Google or mobile); Japanese characters appearing in your Google search results; Google Search Console showing security issues or manual actions; browser warnings when visitors try to access your site; or unfamiliar admin accounts in WordPress Users.

Will SiteGround fix my hacked WordPress site?

No. SiteGround manages hosting infrastructure, not WordPress applications. They will suspend your account when malware is detected, keep Site Tools and SFTP access open for cleanup, and reinstate the account once you confirm it is clean — but the malware removal itself is your responsibility.

How do I contact SiteGround about a suspended account?

Email abuse@siteground.com directly with your domain name, a summary of what was removed, and a request for reinstatement. Do not use live chat or general support for this — the abuse team handles account reinstatements separately and typically responds within a few hours.

How long does SiteGround take to reinstate a suspended account?

SiteGround's abuse team typically reinstates accounts within 24 hours of receiving a cleanup confirmation. The key is emailing abuse@siteground.com directly with a clear summary of what was removed rather than contacting general support.

My SiteGround WordPress site keeps getting hacked — why?

The most common cause is a missed backdoor file, usually in wp-content/uploads, or an unpatched plugin vulnerability that is still being exploited after the cleanup. A proper cleanup requires replacing all infected files with fresh copies from official sources and verifying no PHP files remain in the uploads folder.

How is a SiteGround hack different from a Hostinger hack?

The attack types and cleanup process are essentially identical — WordPress malware does not target specific hosts. The main differences are in the control panel interface (SiteGround uses Site Tools, Hostinger uses hPanel) and the abuse team contact details. The steps for identifying, removing, and preventing malware are the same regardless of host.

By Manny — Founder, WPOPS