WordPress site hacked? What to do first, step by step

You have just found out your WordPress site has been hacked. Maybe a customer rang to say your link sent them to a gambling page. Maybe Google is showing a warning, your host switched the site off, or you cannot log in to your own admin area. Your stomach drops and you want it fixed in the next ten minutes.

Slow down for one minute. The order you do things in matters more than the speed. Do them in the wrong order and you can wipe the evidence, lock yourself out, or clean the site only for it to be infected again tomorrow.

Not sure it is a hack at all? Read Is my website hacked? How to tell, in plain English first. If you already know, here is what to do.

Step 1: Stay calm and write down what you see

The WordPress project’s own help page for hacked sites opens with exactly this advice: take a step back, because a clear head recovers a site faster. It then asks you to document what you are seeing, what time you noticed it, and what changed recently, such as a new plugin or a theme edit.

Take five minutes. Write down:

• What looks wrong, and which pages.
• When you first noticed it, and the time zone.
• What anyone did to the site in the last few weeks: new plugins, updates, a new person with a login.
• Screenshots of anything strange.

This note is your incident report. Whoever helps you, your host, your developer or us, will ask for it, and it saves hours.

Step 2: Tell your host straight away

On shared hosting, your site often sits on the same server as other people’s sites, and a hack can spread. The WordPress project advises checking with your host early, both because they may need to act and because they can tell you whether this is really a hack or a different fault.

Ask your host:

• Can you see anything strange on the server around the time I noticed this?
• Do you keep backups, and from which dates?
• Has the site been suspended or flagged on your side?

Step 3: Keep a copy of the damaged site before you change anything

It feels backwards to save an infected site. Do it anyway. The WordPress guide recommends taking one more snapshot before you start cleaning, even if it is infected, so that if the cleaning goes wrong you still have something to go back to and look at. It is also the evidence that shows how the attacker got in.

Ask your host or developer to make a full copy of the files and the database, and to keep it somewhere that is not on the live site. Do not send it to anyone you do not trust, because it holds your customers’ data.

Step 4: Lock the doors, then change every password

Changing passwords is the step everyone knows about, and it is only one part of a bigger job. The WordPress guide points out that the real aim is to control who has access to everything, not only the WordPress login.

List every way into the site, and change them all:

• Every WordPress user, with extra care for administrators. Remove anyone you do not recognise.
• Your hosting account and any control panel.
• File transfer logins (FTP or SFTP) and the database login.
• The email account tied to the admin user, because whoever controls it can reset the rest.

Two things people miss. First, ask your developer to sign everyone out of WordPress on every device, so that anyone already logged in is thrown out. Second, use long, unique passwords and switch on two-factor authentication, which asks for a second proof such as a code from your phone. A password manager makes unique passwords painless, and we explain how in our comparison of password managers.

One more from the WordPress guide: scan the computer you use to manage the site too. It says the infection often begins on the owner’s own laptop, where malware can quietly record the logins you type.

Step 5: Find and remove what was planted

This is the hard part, and where most people should get help. A hack is rarely a single bad page. Attackers commonly leave several ways back in: extra admin accounts, changed core files, and code tucked inside a theme or plugin. The WordPress guide says the exact steps depend on the type of infection and on your technical skill.

What a careful clean-up covers, in plain terms:

• Replacing WordPress itself, your theme and your plugins with fresh copies from their official sources, rather than trusting the files already on the server.
• Looking for files that should not exist, and for changes in files that should be untouched.
• Checking the database and scheduled tasks, since some infections put themselves back after you delete them.
• Removing unknown admin users.

If you have a clean backup from before the hack, restoring it can be quicker. Be careful: if the hole the attacker used is still open, they will simply come back. Ask whoever restores it, “How did they get in, and has that door been closed?”

We cannot tell you exactly which files to delete or which settings to change on your site. Every infection is different, and a wrong guess can break the site or leave the backdoor open. That is the part to hand to someone who has done it before.

Step 6: Update everything and close the door they used

Once the site is clean, update WordPress, every plugin and every theme, and delete the ones you do not use. Old software is a common way in, and a clean site running the same old plugin is an open invitation.

This is also the moment to find out how it happened. The WordPress guide calls this forensics: working out which route the attacker used so they cannot use it again. It admits that many owners lack the data or knowledge to do this alone. If you cannot say how they got in, ask your developer or security provider to look. A recent example of why updates matter is in our post on the WordPress update after the PHP flaw.

Then change the passwords a second time. The WordPress guide recommends this on purpose: the first change happened while the attacker may still have had a foothold, and the second one happens on a clean site.

Step 7: Deal with Google, email and your customers

A hack leaves a trail outside your site.

• Google. If Google has flagged your site, you can ask for a review once it is clean. Google’s guidance says to use the Security Issues report in Search Console and to request a review after you have fixed everything. Ask for the review only when you are sure the site is clean.
• Email. Hacked sites are often used to send spam, which can get your server blocked, so your own emails start landing in spam folders. If that happens, ask your host to check.
• Customers. If personal information may have been exposed, tell the people affected, plainly and quickly. Data protection law in many countries sets rules about this, so check what applies to you.

When to stop doing it yourself

Call in help if any of these is true:

• You cannot log in at all.
• The site keeps getting infected after you clean it.
• You run a shop, take payments or hold customer details.
• You cannot explain how the attacker got in.

The UK’s National Cyber Security Centre guidance for small businesses tells organisations facing a live attack to get help straight away. The longer an infected site stays live, the more trust it costs you.

Want us to check yours?

Start with the free website security checker. It looks at your site the way a visitor’s browser does and shows what a stranger can see. It does not clean an infected site, but it is a good first look.

If you think your site is already compromised, our website security service looks at it the way an attacker would, fixes what is wrong in a safe order, and tests it again with you.

• Email hello@wpfoss.com
• WhatsApp +254 118 271 160
• Tell us what you need

Sources and further reading

• FAQ: My site was hacked, WordPress.org Documentation, last updated 26 July 2026. Source for staying calm, documenting, checking with your host, keeping a snapshot, changing every access point, scanning your own computer, replacing core files, changing passwords again and forensics.
• Preventing and monitoring abuse on your site, Google Search Central. Index of Google’s guidance on malware and unwanted software.
• Malware and unwanted software overview, Google Search Central. Reference for the Security Issues report and the review request.
• Small Business Guide: Response and Recovery, UK National Cyber Security Centre. Source for preparing a response to a cyber incident and seeking help quickly during a live attack.