WordPress Site Hacked: What a Contractor Should Do in the First Hour

A customer calls to say your website sent them to a strange page. Or the browser shows a red warning before your home page. Or your hosting company emails that the account is suspended. However you find out, the first hour matters, and the order you do things in matters more than speed.

Signs it is a hack and not a glitch

• Visitors are redirected to another site, sometimes only on phones or only when they arrive from Google.
• The browser shows a warning such as “Deceptive site ahead” before the page loads.
• Google shows pages for your domain that you never created, often for pills, gambling or foreign-language text.
• There are administrator accounts in WordPress that nobody recognizes.
• Your hosting company has suspended the site for malware.

The first hour, in order

1. Write down what you see. Take screenshots and note the time. Whoever cleans the site will need this, and symptoms sometimes disappear and return.
2. Do not delete anything. Deleting files at random destroys the evidence of how the attacker got in, and usually leaves the hidden part in place.
3. Tell your hosting company. Ask two questions: do they have a backup from before the problem started, and what date is it? Ask them not to remove any backups.
4. If visitors are being redirected, take the site offline. A temporary maintenance page is better than sending your customers to a scam. Your host can do this in a minute.
5. Change the passwords, from a different device. Start with the hosting account, then every WordPress administrator, then FTP or SFTP and the database. Include the email account those logins recover to.
6. Find the newest clean backup. It has to be from before the first symptom, which may be earlier than the day you noticed.

Why restoring a backup is not enough

Restoring puts back a clean copy of the site. It also puts back whatever let the attacker in. If nothing else changes, the site is usually infected again within days.

After a restore, these steps close the door:

• Update WordPress, the theme and every plugin.
• Remove plugins and themes that are not in use. Inactive code can still be attacked.
• Delete administrator accounts nobody can vouch for, and change all passwords again.
• Check the same hosting account for old, forgotten websites. One abandoned site can reinfect the others.

How it usually happened

• An outdated plugin or theme with a known security hole. This is the most common route into a WordPress site.
• A weak or reused administrator password.
• A pirated copy of a paid theme or plugin, which often arrives with malware already inside.
• A neglected second site on the same hosting account.

Check what Google sees

Once the site is clean, open Google Search Console and look at the Security issues report. If Google flagged the site, request a review there so the warning is removed. Then search Google for site:yourdomain.com and look for pages you did not create. They drop out of the results over time once they no longer exist.

Making it unlikely next time

• Updates applied every week, with a check afterwards that the site still works.
• A daily backup stored away from the web server.
• A firewall, malware scanning and limits on login attempts.
• As few administrator accounts as possible, each with its own strong password.