Skip to content

Guide · Security · 6 min read

My WordPress site has been hacked: what to do, and in what order?

In short: don’t delete anything in a hurry, and don’t settle for erasing what you can see. A serious clean-up always follows the same order: protect the site, change every access, clean up, then find and close the security hole the attack came through. Then come Google, and the data protection authority if customer data is involved.

See the 6 steps Assess my website

A hack is handled in the right orderFirst protect the site with a copy and a maintenance page, then clean the files and the database, then close the security hole it came through. Every access must be changed, from a clean computer. Wiping what you can see is not enough.A HACK IS HANDLED IN ORDERSecureStep 1copy, maintenanceCleanStep 2files, databaseCloseStep 3the entry pointChange every access, from a clean computerKEY TAKEAWAYWiping what you can see is not enough:close the hole it came through.A hack is handled in the right orderFirst protect the site with a copy and a maintenance page, then clean the files and the database, then close the security hole it came through. Every access must be changed, from a clean computer. Wiping what you can see is not enough.A HACK IS HANDLEDIN ORDERSecureStep 1copy, maintenanceCleanStep 2files, databaseCloseStep 3the entry pointChange every access,from a clean computerKEY TAKEAWAYWiping what you can seeis not enough: closethe hole it came through.

The signs that should alert you

  • Your visitors are sent to other websites, sometimes only when they arrive from Google or on a phone.
  • Pages you never created appear in Google, often in a foreign language or for dubious products.
  • Google, your browser or your antivirus shows a warning.
  • Your host warns you, or suspends the site.
  • Unknown administrator accounts appear in WordPress.
  • Your emails end up in spam, or your server sends messages you did not write.

A single one of these signs is enough to act. And a site that looks normal to you can behave quite differently for your visitors.

The first 30 minutes

You have just discovered the hack? Here is what to do right away, even before looking for help:

  1. Delete nothing. Write down what you saw, with the time, and take screenshots.
  2. Make a full copy of the site in its current state, files and database.
  3. Change the most sensitive passwords: your hosting and your email, from a clean computer.
  4. Protect your visitors. If the site redirects them or offers them files, put it in maintenance mode.
  5. Warn the person who looks after your site, or call a professional for the next steps.

6 steps to recover

  1. Keep a copy of the hacked site. Before touching anything, make a full copy, files and database, stored separately. It will help you understand what happened, and serve as evidence if you file a complaint.
  2. Protect the site. If it redirects your visitors or offers them files to download, put it in maintenance mode while it is cleaned. A site closed for a few hours is better than a site that traps your customers.
  3. Change every access. Hosting, database, file transfer, WordPress accounts and email addresses linked to the site: all of them, without exception, from a clean computer. Also renew WordPress’s security keys, which logs everyone out, including the intruder.
  4. Clean up. Replace the WordPress, plugin and theme files with clean copies downloaded from the official sources. Delete unknown files, then check the database: administrator accounts, content and settings added by the attacker. A clean backup from before the attack can also serve as a starting point.
  5. Find and close the security hole. Outdated plugin, stolen password, theme downloaded from a dubious site, access left open: as long as the way in has not been found and closed, nothing stops the attacker from coming back the same way. Update everything, remove what is no longer used and turn on two-factor authentication.
  6. Notify those who need to know. In Google Search Console, Google’s free tool for site owners, the “Security issues” report lets you request a review once the site is clean. If customer data may have been accessed or stolen, notify the data protection authority, in principle within 72 hours: the CNIL in France, the ICO in the United Kingdom, the APDP in Monaco.

Why erasing what you see is not enough

Redirects and spam pages are only the visible part. To keep control, attackers usually leave backdoors behind: hidden files, discreet administrator accounts, lines of code slipped into existing files. If you only erase what you can see, the hack comes back.

What you see is only a small part of a hackWhat you see: redirects, spam pages, Google warnings. What stays hidden: backdoors, hidden accounts, modified files. At the root: the original security hole, which must be closed.1What you seeredirects, spam2Hiddenbackdoors3At the rootsecurity holeWhat you see is only a small part of a hackWhat you see: redirects, spam pages, Google warnings. What stays hidden: backdoors, hidden accounts, modified files. At the root: the original security hole, which must be closed.1What you seeredirects, spam2Hidden backdoors3At the rootsecurity hole
What you see is only a small part of the hack: the clean-up must go all the way to the original security hole.

The 6 mistakes that bring the hack back

  • Erasing only what you see

    The backdoors stay in place, and the attacker comes back whenever they want.

  • Restoring a backup without changing anything

    The security hole is still in the backup: the site will be hacked again the same way.

  • Keeping the same passwords

    If a password was stolen, it still works. Change them all, everywhere they were used.

  • Installing plugins of dubious origin

    Paid plugins and themes offered for free on unofficial sites often contain malicious code.

  • Forgetting the other sites on the same hosting

    If several sites share the same hosting account, an infected site can contaminate the others: they must all be checked.

  • Not telling Google

    The warning can stay displayed until Google has checked the site: request a review as soon as it is clean.

So it never happens again

  • WordPress, plugins and theme are updated regularly.
  • Everyone has their own account, with a unique password and two-factor authentication.
  • Unused plugins and themes are deleted, not just deactivated.
  • Plugins come only from official sources.
  • An automatic backup is stored away from the server, and you know how to restore it.
  • Someone monitors the site and its security alerts.

Your site has been hacked?

I change every login, clean the site, then find how the attacker got in, shut that door and apply the missing updates. And you talk directly to the person who writes the code.

Let’s talk about your website See takeover and maintenance

Reply within one business day

Frequently asked questions

How can I tell if my site is really hacked?

Rely on the signs described above. Google Search Console’s “Security issues” report and your host’s alerts are also good indicators. If in doubt, have the site checked.

Is a security plugin enough?

It helps spot suspicious files, but it does not find everything and does not close the security hole. A manual check is still needed.

Is restoring a backup enough?

It is a good starting point if it dates from before the attack. But the security hole is still there: without updates and new logins, the site will be hacked again.

Must I tell my customers?

If their personal data may have been stolen, you must in principle notify the data protection authority and, in the most serious cases, the people concerned. A lawyer can help you assess the situation.

Will I lose my search rankings?

A Google warning can scare your visitors away, and spam pages muddle your rankings. Once the site is clean, remove the pages added by the attacker and request a review in Search Console.

Should I file a complaint?

It is advisable, especially if data or money is at stake. In France, the public website cybermalveillance.gouv.fr guides you through the process; elsewhere, contact the police or your national cybersecurity agency.

How much does a clean-up cost?

It depends on the extent of the hack and the state of the site. I never quote without looking first. Describe the situation: I reply within one business day, then send you a clear, itemised quote.

Sources

Keep reading