WordPress Site Hacked — What to Do Right Now

Your WordPress site has been hacked. You are seeing spam redirects, a suspended hosting account, a Google warning page, or content on your site you did not put there. Whatever the symptom, the next 60 minutes matter more than most people realise.

Do not start clicking around and making changes. Every action you take either helps or makes recovery harder. The order matters.

Here is exactly what to do.

First: Identify What Type of Hack You Are Dealing With

Before doing anything, identify what you are actually seeing. Different attacks look different and require slightly different approaches.

• Spam redirect hack — visitors arriving from Google or on mobile devices are sent to spam, pharmaceutical, or adult content pages. You may not see it yourself because the redirect only triggers for specific traffic sources. Test by searching your domain on Google and clicking through, or by visiting on cellular data.

• Hosting account suspended — your hosting provider (SiteGround, Hostinger, Bluehost, GoDaddy) detected malware and pulled the site offline. You received a suspension email. The site is showing a suspension page instead of your content.

• Google warning page — visitors see a red "This site may harm your computer" or "Deceptive site ahead" warning when trying to access your site. Google Safe Browsing has flagged it.

• Spam content injected — your pages are showing content you did not write. Japanese characters in Google search results, pharmaceutical keywords in your pages, or links to sites you do not recognise in your page source.

• Admin account compromised — you cannot log into WordPress because the password has been changed, or you see admin accounts in your Users list that you did not create.

• Defacement — your homepage or other pages have been replaced with content from the attacker. Usually accompanied by a message claiming credit for the hack.

Knowing which you are dealing with tells you how urgent the fix is and what to do first. If you need professional malware removal or wordpress emergency support while you work through this, WPOPS can take over.

Step 1 — Do Not Panic and Do Not Start Deleting Things

The instinct when a site is hacked is to start deleting files or making changes. Resist this. Deleting files without understanding what you are removing can make recovery harder, destroy evidence of how the attack happened, and occasionally make the site worse.

The exception: if your site is actively serving malware to visitors right now — redirecting them to phishing pages or serving malicious downloads — take it offline immediately. In your hosting control panel, enable password protection on the entire site or temporarily redirect all traffic to a maintenance page. Stopping the active harm to your visitors is the priority over everything else.

Step 2 — Confirm Access

Request temporary access for cleanup purposes.

• SiteGround: abuse@siteground.com

• Hostinger: abuse@hostinger.com

• Bluehost: abuse@bluehost.com

• GoDaddy: abuse@godaddy.com

Step 3 — Take a Full Backup Before Touching Anything

Even a hacked site is a backup worth having. Download a complete backup of your files and database before making any changes.

Why: if you accidentally delete the wrong files during cleanup, you need a restore point. A backup of a hacked site is better than no backup at all.

In your hosting control panel, find the backup section and download the most recent full backup. If that is unavailable, connect via SFTP and download the entire public_html folder, then export the database from phpMyAdmin.

Step 4 — Scan Everything

Install Wordfence (free) if you can still access your WordPress admin — it compares your files against official WordPress repository versions and flags anything that has been modified.

• eval(base64_decode

• document.write(unescape

• iframe src=

• Any external URLs in option values you do not recognise

Step 5 — Remove All Malware

Delete every malicious file found. For infected plugin and theme files, do not edit out the injected code — download fresh copies from the official WordPress repository or developer and replace the files entirely.

For WordPress core file infections — download the same WordPress version from wordpress.org/download/releases and replace the infected files. Do not replace wp-content (your themes, plugins, uploads) or wp-config.php.

For database injections — use phpMyAdmin to run SQL queries to remove injected content. For the Japanese SEO hack, this means deleting thousands of injected post rows with a targeted DELETE query.

For backdoor files in uploads — delete every PHP file in wp-content/uploads without exception.

Step 6 — Change Every Password and Credential

After removing the malware, change everything:

• WordPress admin password — update every admin account. Delete any accounts you did not create.

• Database password — generate a new one in your hosting control panel and update DB_PASSWORD in wp-config.php.

• WordPress security keys — generate new ones at api.wordpress.org/secret-key/1.1/salt/ and replace the existing block in wp-config.php. This logs out all active sessions including any attacker who may still be logged in.

• Hosting account password — change it.

• SFTP/FTP password — change it.

Step 7 — Update Everything and Remove Unused Plugins

Before contacting your host or submitting a Google review request, update WordPress core, all plugins, and all themes to current versions.

Remove every plugin you are not actively using — deactivated plugins retain their files and remain exploitable. Remove nulled or pirated plugins entirely. These are pre-infected with backdoors by definition and are one of the most common entry points for WordPress hacks.

If a recent update caused problems before the hack, see our guide when a plugin update broke your site.

Step 8 — Harden the Installation

Before going back online, close the doors the attacker used.

• Install a WordPress firewall — Wordfence free tier blocks known malicious IPs and brute-force login attempts. Cloudflare's free plan adds an additional layer at the DNS level.

• Set correct file permissions — folders at 755, files at 644, wp-config.php at 600.

• Enable two-factor authentication — on your WordPress admin account and your hosting account.

• Disable PHP execution in uploads — create a .htaccess file in wp-content/uploads that prevents PHP files from executing.

• Limit login attempts — Wordfence includes this by default.

Step 9 — Contact Your Host and Google if Needed

If your hosting account is suspended, email the abuse team with a summary of what was removed and a request for reinstatement. Keep it direct and factual — what was found, what was removed, what was updated, request to review and reinstate.

For SiteGround suspended accounts, see our dedicated reinstatement guide. For Hostinger suspended accounts, we have a parallel walkthrough.

If Google flagged your site, submit a review request in Google Search Console under Security Issues. Describe what was removed. Google typically clears warnings within 24-72 hours after confirming the site is clean.

Step 10 — Find the Entry Point

Knowing the entry point tells you whether the hack is fully resolved or whether the vulnerability is still exploitable.

• Outdated plugin with a known vulnerability — the most common by far. Check your plugin update history. If a plugin was out of date when the attack happened, that is almost certainly the entry point.

• Nulled or pirated plugin or theme — if you installed software from an unofficial source, it was likely pre-infected.

• Weak or reused admin password — brute-force attacks against WordPress login pages are automated and constant. If your password was weak or reused from another service that was breached, this is the likely entry point.

• Shared hosting cross-contamination — less common on reputable hosts, but possible if another site on the same shared server was compromised and account isolation is weak.

How to Stop This From Happening Again

If this is not your first hack, or if you have cleaned the same infection twice, the problem is not bad luck. WordPress sites that get hacked repeatedly have a consistent pattern: outdated plugins, no monitoring, and no staging environment for testing updates.

An outdated plugin is the entry point for most WordPress attacks. Attackers scan millions of sites daily looking for vulnerable versions. The only defense is patching before the vulnerability is publicly known and actively exploited.

Three things break the cycle:

Staged plugin updates — every update tested on a staging copy before it touches your live site. If a plugin has a known vulnerability, it is patched on staging before attackers can exploit it on your live site.

Daily off-site backups — stored separately from your hosting account. If the worst happens, restore to a clean point in minutes rather than hours of manual cleanup.

Continuous security monitoring — active scanning that catches infections before they escalate to a Google warning or hosting suspension.

These are included in every care plan from WPOPS care plans from $49/month. Ongoing wordpress maintenance costs less than one serious hack in lost traffic, downtime, and recovery time.

Frequently Asked Questions

What should I do first if my WordPress site is hacked?

Do not start deleting files. First, identify what type of hack you are dealing with (spam redirects, hosting suspension, Google warning, content injection). If the site is actively harming visitors, take it offline first. Then confirm your hosting access is still available, take a full backup of the hacked site, and begin scanning files and database for malicious code.

How do I know if my WordPress site has been hacked?

Common signs include: visitors being redirected to spam or adult content pages (especially from Google or mobile); Japanese characters in your Google search results; a red Google warning page when visiting your site; content on your pages you did not write; admin accounts in WordPress Users you did not create; your hosting provider suspending your account for malware; or Google Search Console showing security issues.

Can I clean a hacked WordPress site myself?

Yes, for straightforward infections — infected plugin files and simple database injections. The process requires SFTP access, phpMyAdmin access, and confidence working with WordPress file structure. Complex infections with multiple backdoors, database injections spread across many tables, or infections on multiple sites on the same hosting account are significantly harder and carry a high risk of incomplete cleanup if done without experience.

Why does my WordPress site keep getting hacked after I clean it?

The most common cause is a missed backdoor file — usually in wp-content/uploads or disguised as a core WordPress file. The second most common cause is an unpatched vulnerability that was not closed after the cleanup. A proper cleanup requires replacing all infected files with fresh official versions, verifying no PHP files exist in the uploads folder, and identifying and patching the entry point the attacker used.

How long does it take to clean a hacked WordPress site?

A straightforward infection — infected plugin files, no database injections, single site — typically takes 2-4 hours. Complex infections with database injections, multiple backdoors, or multiple sites on the same hosting account take longer. Hosting account reinstatement after a suspension typically takes 24 hours. Google warning removal typically takes 24-72 hours after a clean site review is submitted.

What is the most common way WordPress sites get hacked?

Outdated plugins are the most common entry point by far. Attackers scan millions of WordPress sites daily looking for sites running vulnerable plugin versions. When they find one, the exploit is automated. Other common entry points include nulled or pirated plugins and themes, weak or reused admin passwords, and brute-force login attacks. Keeping plugins updated is the single most effective preventive measure.