Finding out your site has been hacked is stressful. The good news is that WordPress sites can almost always be cleaned and secured. Act quickly and follow these steps.

Common signs of a hack

• Visitors are redirected to strange websites
• Unknown admin users or pages appear
• Google shows a “This site may be hacked” warning
• Your host suspends the account for malware
• Spam links appear in search results for your site

Step 1: Don’t panic, and don’t delete everything

Take a full backup of the current state first. It helps find out what happened.

Step 2: Change every password

Change WordPress admin, hosting, FTP/SFTP and database passwords. Remove any user accounts you don’t recognise.

Step 3: Scan and clean

Use a trusted security scanner to find infected files. Replace WordPress core, themes and plugins with fresh copies, and carefully clean the database.

Step 4: Find and close the hole

Most hacks come from outdated plugins, weak passwords or nulled themes. Fix the cause, or the attacker will return.

Step 5: Request a review from Google

Once clean, request a review in Google Search Console to remove warnings.

Step 6: Harden your site

Add a firewall, two-factor login, daily backups and regular updates to stop it happening again.

Need urgent help? We clean hacked sites and secure them for the future — see our maintenance & security service.

Further reading

• Hardening WordPress (WordPress.org)
• Google Search Console