WordPress Site Hacked? What to Do and How to Recover

If your WordPress site has been hacked, contact your hosting provider, restrict access if visitors are at risk, and preserve a copy before you start changing files. Recovery means removing the malicious content and closing the access that allowed it in. Before reopening, you also need to check that the website still handles the jobs your customers use it for.

This guide is for business owners running a self-hosted WordPress website. It explains what to do first, where technical help becomes necessary, and what to ask before calling the problem resolved.

First, establish what actually happened

An unexpected redirect, an administrator account nobody created, or a hosting alert about malicious activity needs investigation. Save the affected URLs, any existing screenshots or warning messages, and the time you first noticed the problem. Include recent changes to plugins, themes or access permissions. These details give whoever investigates a useful starting point.

A broken page, failed login or spam comment alone does not establish that someone has hacked your site. Wordfence notes that failed updates and ordinary spam can look alarming without indicating a compromise. Treat the symptom seriously, but check the cause before deleting anything.

Contact your host and protect visitors

Tell your host exactly what you observed. Ask them to help contain the incident, preserve available logs and identify which backups exist. If the site redirects visitors to harmful pages or appears to compromise checkout, ask the host to restrict public access while someone investigates.

Pause campaigns that send people to affected pages. Give customers an alternative contact route if the website normally handles enquiries or bookings. These are practical business decisions you can make while the technical investigation proceeds.

Ask for a copy of the current files and database before cleanup. Label it as compromised and keep it separate from recovery backups. Wordfence recommends preserving both so you have a fallback if cleanup damages the installation.

Secure the accounts that control the website

Changing your WordPress password is only part of regaining control. Review hosting, SFTP and database access as well as administrator accounts. Reset affected credentials, revoke existing sessions and investigate unfamiliar users. WordPress recommends resetting access across the environment and changing its authentication keys to invalidate existing login sessions. Have your developer handle configuration changes if you do not manage those files yourself.

Use a trusted device for this work. WordPress’s hardening guidance points out that an infected computer can undermine otherwise sound website security. Enable two-factor authentication wherever your providers support it.

Understand what a WordPress malware scanner can tell you

A remote scanner can help identify malicious content visible on public pages. It cannot inspect everything stored on the server. Sucuri explicitly states that its SiteCheck scanner cannot detect server-side threats that do not appear in the pages it visits.

A WordPress malware scanner running inside the installation can provide additional evidence. Wordfence, for example, can compare supported WordPress core, theme and plugin files against their original repository versions. Review its findings before repairing or deleting files; a change may need investigation rather than automatic removal.

A clean remote scan is useful evidence, but it is not enough on its own to declare the website clean.

Choose between restoring a backup and cleaning the site

Restore only from a backup you have checked

A backup from before you noticed the hack may still contain the infection. Check the recovery copy before relying on it, and address the vulnerability or compromised access before returning the restored site to service.

For a WooCommerce store, also identify what happened after that backup. Replacing today’s database with an older copy can overwrite newer orders, customer records and inventory changes. 24WP’s staging guide explains the same data-loss problem when an older database replaces a live store.

Ask your developer a concrete question: “How will you preserve the legitimate orders and customer changes made since this backup?”

Clean the installation when a suitable restore is unavailable

WordPress malware removal can involve replacing infected files with trusted copies, cleaning malicious database content, removing unauthorized accounts and finding hidden backdoors. A backdoor is access an attacker can use to return after the visible damage disappears. Other sites in the same hosting environment may also need inspection.

This work requires someone who can distinguish malicious changes from legitimate custom code. If you cannot confidently review PHP files and database changes, hand over the cleanup rather than trying unfamiliar fixes on your business website.

Check security and business functions before reopening

Ask the person handling recovery to explain what they found, what they removed, and what they changed to reduce the chance of another compromise. If they could not establish the original entry point, that uncertainty should appear in the handover.

Then test the parts of the website customers actually use:

• Submit an enquiry and confirm it arrives.
• Check login and password-reset flows.
• For a store, test cart, shipping and checkout using an appropriate test payment method.
• Confirm that order notifications and important integrations work.

24WP’s guidance on staging emphasizes testing complete customer journeys. A homepage that loads successfully tells you little about whether a payment or enquiry reaches the business.

Deal with Google security warnings separately

If Google flagged the site, open the Security Issues report in Search Console. Investigate all reported issues; the example URLs are samples, not necessarily a complete list of affected pages.

After fixing and testing the whole site, request a review and describe the changes. Google says these reviews can take days or weeks. Removing malware does not mean the warning will disappear immediately, and warning removal does not establish that previous search visibility has returned.

Reduce the chance of another incident

Keep WordPress, plugins and themes updated, use trusted software sources, and give each account only the access it needs. Maintain backups separately and check that you can restore them. These measures reduce risk; no maintenance routine makes a website impossible to compromise.

Include forgotten installations in the review. Wordfence warns that an outdated copy in a public directory such as /old/ can provide a route back into an otherwise maintained website.

Questions business owners ask

Can I fix a hacked WordPress site myself?

You can gather evidence, contact your host and coordinate recovery. Manual cleanup requires the ability to understand the affected code and server configuration. Google recommends getting help when that work exceeds your technical experience.

Will reinstalling WordPress remove all malware?

Not necessarily. Malicious content may also exist in plugins, themes, uploads or the database. Recovery needs to cover the affected installation rather than assuming that replacing core files resolves everything.

What should a WordPress malware removal service explain before I agree?

Ask what the investigation covers, whether database cleanup and backdoor removal are included, how they will preserve current business data, and what checks they perform afterward. Also ask what happens if the infection returns. Get the scope and price in writing.

Get help with your WordPress website

If you need technical help, contact 24WP about your website. Include the site address, the symptoms, when they started, and any message from your host. Mention whether you can access the dashboard and whether backups are available. Do not put passwords in the initial enquiry.

Sources

WordPress.org: FAQ — My site was hacked

Wordfence: How to clean a hacked WordPress site

WordPress: Hardening WordPress

Sucuri SiteCheck: Scanner scope and limitations

Sucuri: How to remove malware and clean a hacked WordPress site

24WP: WordPress staging site — what it is and why you need one

Google Search Console: Security Issues report