Skip to content

Guide · Security · 6 min read

My WordPress site has been hacked: what to do, and in what order?

In short: don’t delete anything in a hurry, and don’t settle for erasing what you can see. A serious clean-up always follows the same order: protect the site, reset every login, clean up, then find and close the security hole the attack came through. If customer data is involved, the data protection authority must in principle be notified within 72 hours, without waiting for the clean-up to finish. Once the site is clean, ask Google to review it.

See the 6 steps Assess my website

A hack is handled in the right orderFour steps: put the site somewhere safe, with a copy then a maintenance page; change every login, without exception; clean the files and the database; close the security hole, or the attack starts again. Wiping what you can see is not enough.Security alert on your websiteA HACK IS HANDLED IN ORDER1Secure the sitecopy, then maintenance2Change the loginsall, no exceptions3Cleanfiles and database4Close the holeor it starts againKEY TAKEAWAYWiping what you can see is not enoughA hack is handled in the right orderFour steps: put the site somewhere safe, with a copy then a maintenance page; change every login, without exception; clean the files and the database; close the security hole, or the attack starts again. Wiping what you can see is not enough.Security alerton your websiteA HACK IS HANDLEDIN ORDER1. Secure the sitecopy, then maintenance2. Change the loginsall, no exceptions3. Cleanfiles and database4. Close the holeor it starts againKEY TAKEAWAYWiping what you can seeis not enough

The signs that should alert you

  • Your visitors are sent to other websites, sometimes only when they arrive from Google or on a phone.
  • Pages you never created appear in Google, often in a foreign language or for dubious products.
  • Google, your browser or your antivirus shows a warning.
  • Your host warns you, or suspends the site.
  • Unknown administrator accounts appear in WordPress.
  • Your emails end up in spam, or your server sends messages you did not write.

A single one of these signs is enough to act. And a site that looks normal to you can behave quite differently for your visitors.

The first 30 minutes

You have just discovered the hack? Here is what to do right away, even before looking for help:

  1. Delete nothing. Write down what you saw, with the time, and take screenshots.
  2. Make a full copy of the site in its current state, files and database.
  3. Change the most sensitive passwords: your hosting and your email, from a clean computer.
  4. Protect your visitors. If the site redirects them or offers them files, put it in maintenance mode.
  5. Warn the person who looks after your site, or call a professional for the next steps.

6 steps to recover

  1. Keep a copy of the hacked site. Before touching anything, make a full copy, files and database, stored separately. It will help you understand what happened, and serve as evidence if you report the attack to the police.
  2. Protect the site. If it redirects your visitors or offers them files to download, put it in maintenance mode while it is cleaned. A site closed for a few hours is better than a site that traps your customers.
  3. Reset every login. Hosting, database, file transfer, WordPress accounts and email addresses linked to the site: all of them, without exception, from a clean computer. Also renew WordPress’s security keys, which logs everyone out, including the intruder. Then change the passwords again once the site is clean: as long as a backdoor remains, the new ones can be intercepted.
  4. Clean up. Replace the WordPress, plugin and theme files with clean copies downloaded from the official sources. Delete unknown files, then check the database: administrator accounts, content and settings added by the attacker. A clean backup from before the attack can also serve as a starting point.
  5. Find and close the security hole. Outdated plugin, stolen password, theme downloaded from a dubious site, access left open: as long as the way in has not been found and closed, nothing stops the attacker from coming back the same way. Update everything, remove what is no longer used and turn on two-factor authentication.
  6. Notify those who need to know. In Google Search Console, Google’s tool for site owners, the “Security issues” report lets you request a review once the site is clean. If customer data may have been accessed or stolen, notify the data protection authority: the CNIL in France, the APDP in Monaco. In both France and Monaco, the clock starts when the breach is discovered: this notification must in principle be made within 72 hours.

Why erasing what you see is not enough

Redirects and spam pages are only the visible part. To keep control, attackers usually leave backdoors behind: hidden files, discreet administrator accounts, lines of code slipped into existing files. If you only erase what you can see, the hack comes back.

What you can see of a hack, and what stays hiddenWhat you can see: redirects, spam pages, the Google warning. What stays hidden: backdoors, hidden accounts, modified files, and above all the original security hole.WHAT YOU CAN SEERedirectsSpam pagesGoogle warningWHAT STAYS HIDDENBackdoorsHidden accountsModified filesThe original holeWhat you can see of a hack, and what stays hiddenWhat you can see: redirects, spam pages, the Google warning. What stays hidden: backdoors, hidden accounts, modified files, and above all the original security hole.WHAT YOU CAN SEERedirectsSpam pagesGoogle warningWHAT STAYS HIDDENBackdoorsHidden accountsModified filesThe original hole
What you see is only a small part of the hack: the clean-up must go all the way to the original security hole.

The 6 mistakes that bring the hack back

  • Erasing only what you see

    The backdoors stay in place, and the attacker comes back whenever they want.

  • Restoring a backup without changing anything

    The security hole is still in the backup: the site will be hacked again the same way.

  • Keeping the same passwords

    If a password was stolen, it still works. Change them all, everywhere they were used.

  • Installing plugins of dubious origin

    Paid plugins and themes downloaded without paying from unofficial sites often contain malicious code.

  • Forgetting the other sites on the same hosting

    If several sites share the same hosting account, an infected site can contaminate the others: they must all be checked.

  • Not telling Google

    The warning can stay displayed until Google has checked the site: request a review as soon as it is clean.

So it never happens again

  • WordPress, plugins and theme are updated regularly.
  • Everyone has their own account, with a unique password and two-factor authentication.
  • Unused plugins and themes are deleted, not just deactivated.
  • Plugins come only from official sources.
  • An automatic backup is stored away from the server, and you know how to restore it.
  • Someone monitors the site and its security alerts.

Your site has been hacked?

I change every login, clean the site, then look for how the attacker got in so I can shut that door, and apply the missing updates. And you talk directly to the person who writes the code.

Let’s talk about your website See takeover and maintenance

Reply within one business day

Frequently asked questions

How can I tell if my site is really hacked?

Rely on the signs described above. Google Search Console’s “Security issues” report and your host’s alerts are also good indicators. If in doubt, have the site checked.

Is a security plugin enough?

It helps spot suspicious files, but it does not find everything and does not close the security hole. A manual check is still needed.

Is restoring a backup enough?

It is a good starting point if it dates from before the attack. But the security hole is still there: without updates and new logins, the site will be hacked again.

Must I tell my customers?

If their personal data may have been stolen, you must in principle notify the data protection authority and, in the most serious cases, the people concerned. A lawyer can help you assess the situation.

Will I lose my search rankings?

A Google warning can scare your visitors away, and spam pages muddle your rankings. Once the site is clean, check that the pages added by the attacker are really gone and request a review in Search Console.

Should I report it to the police?

It is advisable, especially if data or money is at stake. In France, the public website cybermalveillance.gouv.fr guides you through the process; elsewhere, contact the police or your national cybersecurity agency.

How much does a clean-up cost?

It depends on the extent of the hack and the state of the site. I never quote without looking first. Describe the situation: I will send you a clear, itemised quote. Reply within one business day.

Sources

Keep reading