WordPress Site Hacked? Here’s Exactly What to Do (2026 Guide)

This guide will walk you through exactly what to do when your WordPress site has been hacked: how to confirm it, how to clean it, how to recover it, and — most importantly — how to make sure it never happens again.

DetectHow Do I Know If My WordPress Site Has Been Hacked?

Before you panic, it helps to confirm the hack. Here are the most common signs that your WordPress site has been compromised:

Visible signs:

• Your homepage has been defaced with strange messages or images
• Visitors are being redirected to spam, gambling, or adult websites
• Google Search Console shows a "This site may be hacked" warning
• Google Search results show your pages with strange titles or descriptions in other languages
• Your site displays a warning like "Deceptive site ahead" in Chrome

Hidden signs (backend):

• Google Search Console flags pages you never created (random .htm files, spammy URLs)
• Your hosting provider has suspended your account for suspicious activity
• You notice new WordPress admin users you didn't create
• Plugins or themes have been modified without your knowledge
• Your site sends spam emails to thousands of people
• Your site loads very slowly or crashes frequently

Technical signs:

• Unfamiliar PHP files in your public_html folder (e.g., godsend.php, random numbered .htm files)
• Modified wp-config.php or .htaccess files with injected code
• New folders with random names inside wp-content/uploads

If you're seeing any of these signs — your site has almost certainly been hacked, and you need to act now.

First 10 MinutesStep 1: Don't Panic — But Act Immediately

Time matters when your WordPress site is hacked. Every hour your site stays compromised:

• More visitors are exposed to malware
• Google crawls more spam pages and deepens the penalty
• The hacker can install additional backdoors
• Your domain reputation gets worse

Here is what to do in the first 10 minutes:

1. Take your site offline temporarily — Put your site in maintenance mode or ask your host to suspend it briefly to stop visitors from being exposed to malware
2. Change all passwords immediately — WordPress admin, hosting account, FTP, and database password
3. Do not delete anything yet — You need to assess the damage first before cleaning

DiagnoseStep 2: Identify How Your WordPress Site Was Hacked

Understanding how the hacker got in is essential to making sure they can't get back in. The most common entry points are:

Outdated WordPress Core, Plugins, or Themes

This is responsible for the majority of WordPress hacks. Every plugin and theme is potential code running on your server. When developers discover security vulnerabilities, they release patches. If you don't update, attackers exploit the old vulnerability.

Weak or Reused Passwords

Hackers run automated brute-force attacks — trying thousands of username and password combinations per minute against your wp-login.php page. If your password is weak or reused from another site, they will eventually get in.

Compromised FTP or Hosting Credentials

If your computer has a keylogger or your FTP credentials are stored insecurely, attackers can steal them and directly upload malicious files to your server.

Nulled Themes and Plugins

Free "premium" themes and plugins downloaded from unofficial sources almost always contain hidden malware. Installing them is essentially inviting a hacker in through the front door.

PHP File Upload Vulnerabilities

Some plugins allow file uploads without properly checking the file type, letting attackers upload malicious PHP scripts disguised as images.

Insecure Hosting Environment

Shared hosting environments with poor server isolation can allow a compromise on one site to spread to other sites on the same server.

PreserveStep 3: Back Up Your Hacked Site

This might feel counterintuitive — why would you back up a hacked site? Because:

• You need a reference copy to understand what was changed
• Your hosting provider's backups may only go back a few days
• If the cleanup goes wrong, you need something to restore from

Ask your hosting provider for all available backup snapshots, and note the dates. You're looking for a backup from before the hack occurred.

CleanStep 4: Clean Your Hacked WordPress Site

There are two approaches to cleaning a hacked WordPress site:

Option A: Restore From a Clean Backup (Fastest and Safest)

If you have a clean backup from before the hack, restoring it is the fastest and most reliable recovery method. A clean restore wipes all the malicious files and database changes in one step.

To do this through your hosting panel:

1. Log in to your hosting control panel (cPanel, hPanel, etc.)
2. Go to Files → Backups
3. Select Files Backup and choose a date from before the hack
4. Select your public_html folder and restore
5. Then restore your Database Backup from the same date to remove injected spam posts and pages

After restoring, immediately change all passwords before the hacker can exploit the same vulnerability again.

Option B: Manual Cleanup (If No Clean Backup Exists)

If you don't have a clean backup, you'll need to manually clean the infection. This is more complex but entirely possible:

Clean WordPress core files:

Download a fresh copy of WordPress from wordpress.org and replace all core files — especially wp-admin/ and wp-includes/. Do NOT replace wp-config.php or wp-content/.

Scan and clean wp-content:

Go through your plugins, themes, and uploads folders looking for:

• PHP files inside the uploads folder (there should be none — PHP files don't belong there)
• Recently modified theme files with strange code
• Unfamiliar plugin folders
• Random .htm or .php files with numeric names

Check and clean your database:

Use phpMyAdmin or a plugin like WP-Optimize to search your database for malicious code. Look for:

• <script> tags in post content
• iframe injections
• Base64-encoded strings (they look like: eval(base64_decode(...)))
• Spam posts or pages you didn't create

Check for backdoors:

Hackers almost always install backdoors — hidden files that let them regain access even after you clean the obvious malware. Common backdoor file names include: godsend.php, shell.php, c99.php, r57.php, or random numeric filenames like 39632216583.htm. Search your entire server for these.

Remove unauthorized admin users:

Log in to WordPress → Users → All Users and delete any accounts you don't recognize, especially ones with Administrator roles.

SecureStep 5: Harden Your WordPress Site After a Hack

Cleaning the infection is only half the job. If you don't fix the vulnerability that let the hacker in, they will be back within days.

Update Everything Immediately

• WordPress core to the latest version
• All plugins to their latest versions
• All themes (including inactive ones) to their latest versions
• Delete any plugins or themes you don't actively use

Change All Passwords

• WordPress admin account password
• All other WordPress user passwords
• Hosting account password
• FTP password
• Database password (update wp-config.php after changing this)
• Email account password associated with the domain

Enable Two-Factor Authentication

Add 2FA to your WordPress admin login. Even if someone steals your password, they can't log in without your phone. Plugins like WP 2FA or Google Authenticator make this easy.

Install a WordPress Security Plugin

Plugins like Wordfence, Sucuri, or MalCare add:

• Real-time malware scanning
• Firewall to block malicious requests
• Login protection and brute-force prevention
• File change detection

Protect wp-login.php

Limit login attempts, add CAPTCHA, change the login URL, or restrict it to specific IP addresses. Most brute-force attacks target the default /wp-admin/ URL.

Disable XML-RPC

Unless you specifically need it, disable XML-RPC — it's a common attack vector. Add this to your .htaccess:

<Files xmlrpc.php>
Order Deny,Allow
Deny from all
</Files>

Set Correct File Permissions

• Folders: 755
• Files: 644
• wp-config.php: 600

Move wp-config.php Up One Directory

Moving wp-config.php one directory above public_html makes it inaccessible from the web.

Use a Web Application Firewall (WAF)

A WAF like Cloudflare filters malicious traffic before it ever reaches your server. It's one of the single most effective defenses against WordPress hacks.

Recover TrustStep 6: Remove the Google Blacklist Warning

If Google has flagged your site as dangerous, you need to request a review after cleaning. Here's how:

1. Log in to Google Search Console
2. Go to Security Issues in the left sidebar
3. Review the flagged URLs and confirm you have cleaned them
4. Click Request a Review
5. Describe what you found and what steps you took to fix it

Google typically reviews requests within 72 hours. Once approved, the "This site may be hacked" warning will be removed from search results.

Also check Bing Webmaster Tools for a similar security flag, as Bing has its own blacklist system.

ReindexStep 7: Request Removal of Spam URLs From Google's Index

If the hacker injected hundreds of spam pages into your site (as often happens with .htm injection attacks), those URLs may still be in Google's index even after you clean them.

Use Google Search Console → Removals to request the removal of any spam URLs that were indexed. This speeds up the process of getting your SEO back to normal.

You can also use the URL inspection tool to confirm that specific pages are no longer indexed.

TimelineHow Long Does WordPress Hack Recovery Take?

Recovery time depends on the severity of the hack:

Repeat HacksWhy Does My WordPress Site Keep Getting Hacked?

If your site gets hacked repeatedly, the most common reasons are:

You didn't find all the backdoors. Hackers rarely install just one backdoor. If you miss even one, they'll use it to reinfect the site within days.

You didn't fix the vulnerability. Cleaning the infection without updating the plugin or theme that was exploited just means the same attack will work again.

Your passwords are weak or reused. A hacked email account can lead to a hacked hosting account, which leads to a hacked website.

You're on insecure shared hosting. If your neighbor on the same server is compromised and the host has poor isolation, your site can be infected too.

You're not monitoring your site. Without active security scanning, new malware can be installed and sit undetected for weeks.

True CostThe Real Cost of a Hacked WordPress Site

Many people underestimate the full cost of a WordPress hack:

• Lost revenue — Every hour your site is down or redirecting visitors is lost sales
• Emergency repair costs — Professional hack cleanup typically costs $200–$500 per incident
• SEO damage — Google penalties from a hack can take months to recover from
• Reputation damage — Customers who see "This site may be hacked" warnings lose trust permanently
• Data breach liability — If customer data is exposed, you may face legal consequences

PreventionHow Professional Website Maintenance Prevents WordPress Hacks

The vast majority of WordPress hacks are entirely preventable with proper maintenance. A professional website maintenance service:

At Website Maintenance Services, our security monitoring and maintenance plans have helped hundreds of businesses protect their WordPress sites from exactly the kind of attacks described in this guide. We handle everything — updates, backups, monitoring, hardening, and emergency response — so you never have to face that sinking "my WordPress site has been hacked" feeling.

FAQFrequently Asked Questions About Hacked WordPress Sites