Hacked WordPress Site: What to Do, and in What Order

Contents8 sections

Your site shows a page that isn’t yours, Google warns your visitors that it is dangerous, or your host has suspended it. The first reflex is often to delete everything and reinstall. You then lose the traces that show how the attacker got in, and the hole stays open.

The steps below go from the first hour to the removal of Google’s warning. They follow WordPress’s official documentation, Google’s guides for hacked sites and the reflex sheet from Cybermalveillance.gouv.fr, France’s public cybersecurity assistance service. The rules on personal data and police reports cover Europe and Japan. Sources are listed at the end of the article.

01The signs of a hacked WordPress site

In its 2024 report, Sucuri scanned 70.8 million sites and found 1,176,701 infected. Of these, 74.7% contained malware or redirects, and 38.4% held spam aimed at search engines. Defaced pages, the hack everyone can see, made up only 0.8% of infected sites.

• Malware and redirects74.7%
• Search engine spam38.4%
• Credit card theft1.7%
• Unwanted ads1.5%
• Defaced page0.8%

Source: Sucuri, SiteCheck Malware Trends Report 2024 (70.8 million scans, 1,176,701 infected sites).

How to read this chart. A single site can have several infections, so the total is over 100%.

What you can see

The WordPress documentation lists the signs that leave no doubt:

• Google or Bing flags the site as dangerous, with a note in the results or a full-screen warning page in the browser.
• Your host has taken the site down.
• Your visitors’ antivirus software blocks the site.
• Someone tells you your site is being used to attack other sites.
• Users you did not create appear in WordPress.
• The hack shows when you open the site: a changed page, messages or images that aren’t yours.

What you can’t see

Hidden spam is harder to spot. Google describes a common case with a strange name: the “Japanese keyword hack”. It hits sites all over the world, whatever their language. The attacker adds pages in Japanese to your site, generated automatically in folders with random names, with links to stores selling fake brands. They show up in Google, but not necessarily for you. The attacker can serve the spam only to Google’s crawler and show you a normal page or a 404 error: this is called “cloaking”.

To check, type “site:yoursite.com” into Google and go through a few pages of results. Addresses you don’t recognize, or titles in another language, are a bad sign. In Search Console, the “Security issues” report lists what Google has found, and the URL Inspection tool shows a page as Google sees it. An email announcing a new owner of your site in Search Console should also alarm you: attackers sometimes add themselves to change your settings.

Another quiet sign: your emails land in your customers’ spam folders. A hacked site can be used to send spam. The server’s IP address then ends up on blocklists, and your own emails are blocked too if they leave from the same server.

02First steps, in order

Note what you see, then copy the site as it is

Before touching anything, write down what you see, the time, and your latest changes: a plugin installed, a theme edited, a setting. The WordPress documentation makes this the first step. These notes are the basis of the incident report, whether you fix the site yourself or a professional does.

Then make a full copy of the hacked site, files and database, without cleaning anything. Backing up an infected site seems odd, but WordPress, Google and Cybermalveillance all advise it. This copy keeps the traces of the attack, and you can go back to it if the cleanup breaks something.

Alert your host and put the site in maintenance mode

Tell your host. On shared hosting, a hack can affect other sites on the same server, and your host can also confirm whether it really is a hack or just an outage. Ask for the server logs as well: they will help you understand how the attacker got in. Cybermalveillance advises taking the site offline if you can, or asking your host to take the necessary measures. A maintenance page, or a password on the whole site, keeps your visitors away from a booby-trapped page during the cleanup.

Change every access, and log everyone out

Before changing passwords, run a full antivirus scan on your computer. WordPress points out that attacks often start from the owner’s computer, when a Trojan steals the FTP or wp-admin logins. If it is still there, it will steal the new passwords too. Some viruses can hide from the antivirus you have installed: try another one if you can.

Then change every password that opens the site: WordPress, your host’s control panel, FTP or SFTP and the database (MySQL). This applies to every user, starting with administrators. Choose long, unique passwords generated by a password manager, and turn on two-factor authentication wherever it exists.

You also need to close the sessions already open. To do so, replace the secret keys in the wp-config.php file with new ones from the official WordPress generator. Everyone is logged out, including you.

If the attacker changed your administrator password, go through the database. Your host often provides phpMyAdmin: change your account’s email address in the users table (wp_users by default), then click “Lost your password?” on the login page.

Personal data: report it within 72 hours

Don’t wait for the cleanup to end before thinking about personal data. A WordPress site often stores some: customer accounts, WooCommerce orders, newsletter subscribers, contact form messages when the site saves them. If the attacker could reach them, that is a personal data breach. In the European Union, the GDPR (Article 33) requires you to notify your data protection authority without undue delay and, where feasible, within 72 hours of becoming aware of it, unless the breach is unlikely to put people at risk. In France, that authority is the CNIL, which advises notifying when in doubt. If the risk to people is high, you must also inform them.

In Japan, the Act on the Protection of Personal Information (APPI) has required a report to the Personal Information Protection Commission since April 2022 when a leak results from an unauthorized act such as a hack, whatever the number of people involved. A preliminary report is due within about 3 to 5 days of discovery, and the full report within 60 days for this kind of leak. The people affected must also be informed promptly.

Even without a notification, the GDPR requires you to document every breach. Your first-hour notes are the starting point.

03Restore a backup or clean up?

With a clean backup

If you have a backup from before the hack, restoring it puts the site back the way it was, and it is the shortest path. You still need to know when the hack began. A quiet hack can go unnoticed for a long time, and yesterday’s backup may already be infected. The further back your backup history goes, the better your chances of finding a clean one.

Restoring doesn’t close the way in: a vulnerable plugin comes back with the backup, and a stolen password still works. Right after restoring, update WordPress, the theme and the plugins, change the passwords and look for the way in (part 4). Otherwise, the attacker can come back the same way.

No backup: the full cleanup

Start with a scan. A plugin such as Wordfence or Sucuri Security looks for malicious code from inside the site, and an online scanner such as Sucuri SiteCheck or VirusTotal looks at the site from outside, like a visitor. The two complement each other.

Then replace the WordPress core, meaning the wp-admin and wp-includes folders: delete them, then upload those from a fresh copy of the same version as your site. WordPress advises doing this over FTP or SFTP, not with the reinstall button in the dashboard. That button overwrites existing files but leaves in place the ones the attacker added. Do the same for the theme and plugins, downloaded from their official source.

The .htaccess file, at the root of the site, is one of the most often modified, whatever the type of attack, and other folders may contain one too. Replace it with a clean version. Also check index.php, and the theme’s header.php, footer.php and functions.php files: once modified, they affect every page of the site. In the rest of the files, look for those that have no business being there, those changed recently, or those full of unreadable code (base64_decode, eval).

In WordPress, delete the users you did not create. In Search Console, remove unknown owners and their verification file. Finally, check your sitemap: it should list only your own pages.

The cleanup has to be complete, in one go. A single forgotten backdoor, a small file that lets the attacker back in, is enough for them to return.

04Find the way in

Cybermalveillance sums it up this way: identify the source of the intrusion, and take steps so it can’t happen again. The server logs and your first-hour notes help here.

Plugins, the first lead

WordPress runs 39.6% of all websites (W3Techs, October 2026), and a flaw in a popular plugin affects every site that uses it. Patchstack counted 11,334 new WordPress vulnerabilities in 2025, 42% more than in 2024. 91% were in plugins, not in WordPress itself, and 46% had no fix when they were made public.

So go back over your list of plugins. Spot the ones that weren’t up to date, the ones their author no longer maintains and the ones you no longer use. Time matters: according to Rapid7, the first attacks come within 5 hours (median) for a heavily exploited flaw. An update done “at the end of the month” gives attackers weeks.

Other leads

Then check for weak or reused passwords, and “nulled” plugins or themes: pirated paid versions, handed out for free outside the vendor’s site, that nobody controls. Think too of the infected computer that leaked your logins. On shared hosting, ask your host whether other sites on the server are affected.

The server itself: PHP

WordPress runs on PHP, the language installed on the server, and a flaw in PHP affects every site it runs. On shared hosting, your host installs the PHP fixes. Ask whether the latest ones are in place, and check which PHP version is selected in your control panel: a version the PHP project no longer supports gets no more fixes.

It happened in October 2026, with two critical flaws nicknamed PHP2Shell, fixed on October 21. What happened, and how to check your site: PHP2Shell: is your WordPress site affected?

05After the cleanup: Google and the police

Change the passwords a second time

Once the site is clean, change all the passwords again. WordPress specifically asks for this if you only changed them when you found the hack. You can also change the database user and password, and update them in wp-config.php. Then update WordPress, the theme and the plugins.

Ask Google to remove the warning

If Google flagged your site, open the “Security issues” report in Search Console and request a review. The site must be verified there. Describe the problem, what you fixed and the result. Wait until every page is clean and the hole is closed: Google warns that a request sent too early extends the time your site is flagged as dangerous. Don’t send a new request before you get the answer to the first one.

Problem flagged	Time given by Google
Phishing	About a day
Malware	A few days
Spam added by the attacker	Up to several weeks

Source: Google, Request a review · Google, Security issues report, checked on October 21, 2026.

Google isn’t the only one keeping a blocklist. WordPress advises also adding the site to Bing’s and Norton’s webmaster tools, and checking that your visitors’ antivirus software no longer blocks it.

Report it to the police

Hacking a site is a criminal offense. In France, Cybermalveillance.gouv.fr advises filing a complaint at a police or gendarmerie station, or in writing to the public prosecutor, with all the evidence you have, including your notes, the copy of the hacked site and the server logs. The French criminal code (articles 323-1 to 323-7) provides, depending on the case, 2 to 7 years in prison and fines of €60,000 to €300,000. In Japan, the National Police Agency lists each prefecture’s cybercrime desk and has a national online form for reports.

06Fix it yourself or call a professional

WordPress says so itself: finding and removing everything the attacker left behind is the hardest part, and how to go about it depends on how comfortable you are with the technical side. Understanding how they got in is often out of reach for a site owner, for lack of knowledge or data. With a clean backup and a little practice, you can follow these steps yourself. The WordPress.org forums, under the “hacked” and “malware” tags, are a good resource on a tight budget. In France, Cybermalveillance.gouv.fr lists IT security professionals; in Japan, JPCERT/CC accepts requests about defaced websites.

If you hand over the cleanup, ask these questions before signing:

1. Do you look for the way in, or only for the malicious code?
2. Do you check both the files and the database?
3. Do you update WordPress, the theme and the plugins after the cleanup?
4. Do you send the review request to Google?
5. What happens if the site is hacked again after your work?
6. Will I get a report of what was done?

For a price benchmark: at Sucuri, a website security company, protection plans with cleanup cost $229 to $549 a year. Our WordPress maintenance, from $75 a month, covers all the upkeep of the site: tested updates, off-site backups, firewall, monitoring and a report every month. Hack repair is included at no extra cost. For a site we don’t look after yet, urgent repair (diagnosis, cleanup and back online) is quoted.

07Keep it from happening again

Your host protects its server, not your WordPress. In a large-scale test by Patchstack, standard hosting protections stopped only 12% of attacks targeting known WordPress vulnerabilities. Prevention comes down to a few habits:

• Update WordPress, the theme and the plugins as soon as a fix comes out, after a backup.
• A PHP version that is still supported, with its latest fixes: check with your host.
• Remove the plugins you no longer use, and the ones their author no longer maintains.
• Keep backups off the server, over several weeks, so you have a clean one the day you need to restore.
• Long, unique passwords, one account per person, and two-factor authentication for administrators.
• A firewall with virtual patching, which blocks a known flaw before the plugin is fixed, including among the 46% of flaws published without a fix.
• Monitoring that warns you when a file changes or when Google flags the site.

That is the job of WordPress maintenance. What it costs, item by item, is detailed in our guide to WordPress website cost.

Conclusion: keep the traces, then close the door

With a hacked WordPress site, the order of the steps matters. Note and copy before cleaning, change the logins and report to your data protection authority if data may have been read. Restore or clean up, find the hole, then change the passwords a second time. After that come Google’s review and the police report.

Is your site hacked, or are you not sure? Tell us what is happening: we step in urgently, on a quote if you are not a client yet.