WordPress Site Hacked? Steps to Recover and Secure It Fast

If your WordPress site is hacked, act fast and in order. Stop visitor harm, regain clean access, remove or restore away the malware, close how they got in, then harden so the same door does not reopen.

Related: 7 signs of a hack, malware removal guide, hire cleanup.

First: confirm it is a compromise

Common signs (several together matter more than one alone):

• You cannot log in, or login redirects somewhere weird
• Homepage defacement, spam links, or ads you did not add
• Redirects to scam or phishing sites (sometimes only for logged-out or mobile visitors)
• New admin users, unknown plugins, or odd scheduled tasks
• Search Console or browser warnings about malware
• Sudden traffic drops or spam emails sending from your domain

Not every glitch is a hack. A failed plugin update can look scary too. If several signs show up together, treat it as a compromise.

Emergency checklist (do this in order)

1. Limit the blast radius

• Put the site in maintenance mode, or take it offline if visitors are being harmed
• Contact your host about lockdown, snapshots, and logs
• If the site sends spam, pause outbound mail until you clean it
• Use a clean device if you suspect credential theft on your usual computer

2. Get access somehow

If wp-admin is dead, use hosting panel, SFTP/SSH, or the host’s emergency recovery. You need file and database access to restore or remove malware.

3. Prefer a clean backup restore

1. Estimate when the breach started
2. Restore files and database from before that point
3. Immediately update core, plugins, and themes
4. Delete unused plugins and themes
5. Rotate all passwords and application passwords
6. Scan again before celebrating

If you restore a backup that already contained the malware, you relaunch the problem.

4. If you have no clean backup, clean carefully

• Remove unknown admins and shady plugins
• Compare WordPress core files to official copies
• Scan for malware and suspicious PHP in uploads, themes, and plugins
• Check .htaccess, wp-config.php, and must-use plugins
• Hunt backdoors and unexpected scheduled tasks
• Reset salts/keys and all passwords afterward

This is slower and easier to get wrong. If the site matters, hire cleanup help.

5. Close the entry point

A restore without a fix is a rewind button for the attacker. Common causes:

• Vulnerable plugin or theme
• Weak or reused password
• No 2FA on admin accounts
• Old WordPress core
• Nulled software

Find it. Remove or patch it. Then harden login and scanning so you notice the next attempt earlier.

6. Assume the environment was exposed

Treat credentials, FTP/SFTP, hosting panel, and database passwords as compromised (assume breach). Rotate them after cleanup, not only at the first panic moment.

7. Harden before you call it done

• Unique passwords and 2FA for admins
• Login protection / fewer login attempts
• Firewall in front of WordPress
• Malware and vulnerability scanning on a schedule
• Backups that are off-site and restore-tested

What people miss

Cleaning visible redirects without removing persistence is how the same infection returns within hours. If malware comes back on a schedule, audit hosting cron and WP-Cron: malware that kept coming back.

Short FAQ

Should I restore from backup or clean files by hand?
Restore from a known-clean backup when you can. Manual cleanup is for when no clean restore exists, or when you need forensics first.

Do I need to take the site offline?
If visitors see redirects, phishing, or malware warnings, yes, at least maintenance mode. A short outage beats actively harming customers.

When should I hire help?
Stores with payment data, reinfection after DIY cleanup, locked hosting accounts, or infections you cannot locate. Start at consultation.

Is updating plugins enough after a hack?
No. Updates matter, but you still need clean files or a clean restore, rotated credentials, and the entry point closed.

What tool helps after I am back online?
Security Ninja covers firewall, malware scanning, vulnerability checks, security tests, events, and 2FA. Start with Free tests if you are rebuilding the baseline.

Going forward, assume another scan hits tomorrow. Keep updates current, keep the plugin list short, and keep backups you have actually restored. More: backup plan, security checklist, do I need a security plugin?.