If you have just discovered your WordPress site is hacked, the next 60 minutes are crucial. Attackers strike any vulnerable site, regardless of its size or popularity, and automated bots regularly scan the internet looking for outdated plugins or weak passwords. Indeed, WordPress powers more than 40% of all websites, making it an appealing target for hackers. While this situation can feel overwhelming, you can take immediate, practical steps to minimize damage, restore functionality, and protect your site from future attacks.
Below is a curated list of actions you should take right away. Even if you have never handled a hacked WordPress site before, these steps will help you contain the breach and set up defenses to keep your website secure long-term.
Confirm the hack
Your first move is to verify that your WordPress site is truly compromised. You might notice unusual pop-ups, see unauthorized redirects, or find random files in your wp-content directory. Sometimes, you will receive a warning from Google or visitors might report malicious activity on your site.
Look for visible warnings
- Sudden drop in traffic or a “deceptive website warning” message: Google may have blocklisted your site if it detects malicious content or wordpress redirect spam.
- Defaced homepages, random ads, or unusual pop-ups: If the main page looks drastically different than usual, it could indicate unauthorized changes.
- Mysterious redirections: Users might end up on spammy or phishing sites.
Check for behind-the-scenes indicators
- Unrecognized admin accounts: See if there are unfamiliar users with high-level permissions in the Users tab.
- Notification emails from your hosting provider or security plugin about suspicious files or malicious attempts.
- Repeated wordpress logs out issues or forced logouts that you did not instigate.
It is helpful to keep a record of all suspicious activities. This documentation can later help in diagnosing the type of hack and preventing future vulnerabilities. For additional signs, you might reference a guide on wordpress malware signs, which outlines hidden red flags that can point to breaches.
Disable public access
When you are sure your site is hacked, your primary goal is limiting further damage. Removing temporary public access can prevent hackers from escalating the breach or planting deeper malware. If you are comfortable with server settings, you can place the site in maintenance mode or password-protect it temporarily.
Put the site in maintenance mode
You can use plugins that display a maintenance page, allowing you to work behind the scenes without exposing visitors to malicious code. Some hosting panels also have an option to “pause” the website.
Protect the wp-admin directory
- Restrict outside IP addresses if your hosting provider offers an IP allowlist.
- Consider disabling the XML-RPC feature if you do not need remote publishing to cut off a common attack route. (Reddit) You can learn more about that in disable xmlrpc wordpress.
Taking the site out of immediate public view buys you time to investigate and clean up the hack securely.
Change all passwords
Weak or reused passwords are a top reason WordPress sites get hacked. Attackers use brute-force scripts to scramble through thousands of possible credentials until they find one that works. If your site is compromised, assume that all stored passwords are compromised too.
Update critical access points
- WordPress admin: Change passwords for all user accounts. Avoid common usernames like “admin.” (avoid admin username)
- Hosting control panel & FTP/SFTP: Use your hosting admin panel to reset website file access.
- Database credentials: Check your wp-config.php file and update the database password in your hosting panel.
- Email accounts: If your domain-based emails are compromised, attackers could gain re-entry.
Use strong, unique passwords
A secure password is typically at least 12 characters long, avoiding dictionary words or personal information. Pair complex passwords with two-factor authentication (2FA) for added security. (WPBeginner) Consider an additional step to limit login attempts, so that repeated incorrect passwords trigger a temporary block.
Scan for malicious code
Automated scans are an excellent starting point to identify suspicious files, hidden scripts, or database anomalies. Hacked sites often include backdoors meant to funnel spam traffic or exploit vulnerabilities.
Choose a reliable security tool
WordPress security plugins like Jetpack, WordFence, MalCare, and Sucuri are widely used. Each plugin detects potential malware or irregularities differently:
- WordFence is a popular free plugin that scans for known malware signatures, but its free version only checks 60% of your site. (Malcare)
- MalCare runs daily scans on its own servers, lowering the load on your site, and offers one-click cleanup in its premium version. (WPBeginner)
- Sucuri often does a good job at blocking hacking attempts, but some tests show that its free malware scanner might only check public parts of your site. (Malcare)
Inspect code strings manually
Automated scans often catch the bulk of suspicious content, but it is wise to manually look for:
- Files in unexpected locations (e.g., random .php files in /wp-content/uploads).
- Newly created directories with strange names.
- Modified theme or plugin files containing unfamiliar code, such as obfuscated strings or repeated base64 encoding.
You can also scan wordpress malware with specialized tools or through your hosting provider.
Remove suspicious files
After identifying rogue scripts or altered files, you need to clean them up carefully. Leaving even a small piece of malicious code behind can lead to your WordPress site getting reinfected.
Deactivate all plugins first
Temporarily disable plugins and switch to a default WordPress theme (e.g., Twenty Twenty-Four). This isolates the potential source of malicious code. Then:
- Examine plugin folders for extra .php files.
- Compare official plugin files to those on your server.
- Delete or replace any suspicious plugin folder.
Delete or replace corrupted core files
Use a fresh copy of WordPress to overwrite questionable core files. If your wp-config.php has been tampered with, back it up first and then restore a secure version. Always keep an original reference of your site’s structure to guide you during cleanup.
Scan and confirm removal
Run another scan once you finish cleaning. Some hackers place multiple backdoors in different directories so do not stop hunting after you remove the first malicious script. You can also schedule daily scans to ensure no malicious files reappear.
Review user accounts
One of the most common ways attackers maintain access is by creating hidden admin-level accounts. Even if you are the site’s only administrator, you might see new users that you do not recognize.
Limit privileged roles
- Verify every Administrator, Editor, and Author. Delete accounts that should not exist.
- Downgrade suspicious accounts to Subscriber if you are unsure who created them.
- Familiarize yourself with wordpress user roles security to manage permissions correctly.
Check for leftover test accounts
If you used a test or staging site in the past, you might have leftover accounts. Clean up any test user or old developer accounts if they are no longer in use. Doing this tightens the circle of individuals who can modify your WordPress files or database.
Restore from backups
A clean backup from a date prior to the hack is often the most reliable way to purge hidden malware. However, restoring an old backup might cause you to lose recent website changes. You will have to decide which backup is recent enough to keep your critical data but old enough to avoid reintroducing the hack.
Acquire backups
- Hosting backups: Many managed WordPress hosting plans keep daily or weekly backups.
- WordPress.com or plugin backups: Some tools like Jetpack or UpdraftPlus generate automated backups you can roll back to. WordPress.com even offers hack removal services for hosted sites. (WordPress.com)
- Manual backups: If you periodically download full site backups, look for a version from before any suspicious changes.
Test before going live
If possible, restore the backup to a local or staging environment and scan it for malware using your chosen security tool. Test crucial site features, forms, and e-commerce functionality to confirm everything works. When you finalize the restored version, put it live so visitors can access a clean site.
For more details about safeguarding your data, review wordpress backups, which covers both automated and manual backup strategies.
Set up security plugin
Installing a robust security plugin is paramount after a hack. Even if you had one before, ensure it is fully configured with the latest definitions and features.
Compare top options
- MalCare is praised in 2025 for thorough one-click malware cleanup, real-time bot blocking, and a custom firewall that does not hog your site’s resources. (Malcare)
- Cloudflare’s security suite works as a firewall, DDoS mitigator, and traffic inspector at the edge, making it tough for bad actors to even reach your hosting server. (WPBeginner)
- WordFence remains a free favorite for scanning and exploit detection, though its free version does not always catch 100% of infected files, especially hidden in premium plugins.
- Sucuri blocks many common threats, but some evaluations claim it struggles to detect certain hidden malware.
With any plugin, set up alerts for suspicious activity. You can also explore additional resources about wordpress firewall plugins and how to monitor wordpress security effectively.
Harden WordPress
Once your site is clean, a few extra measures can greatly reduce future risks. Hackers often exploit known vulnerabilities in outdated themes or rely on brute-force attacks. Locking down your site’s entry points helps keep them away.
Keep everything updated
- Themes and plugins: Old versions can expose vulnerabilities. Update frequently to patch security issues. (WPBeginner)
- WordPress core: You can enable wordpress auto updates for core releases and security patches.
- PHP version: Running older PHP versions can introduce new vulnerabilities. Regularly check php version vulnerabilities.
Strengthen file and server settings
- Disable file editing in wp-config.php to stop attackers from editing plugin and theme files.
- Hide directory browsing to prevent prying eyes from seeing your file structure (directory browsing wordpress).
- Use an SSL certificate to switch http vs https wordpress for encrypted communications.
Restrict plugin use
Downloaded a batch of “free” premium themes or plugins? Some “nulled” or pirated products contain stealthy malware. Only trust reputable sources. Check out the risks of nulled themes risks and free plugin risks to understand how hidden exploits can undermine your site’s security.
Frequently asked questions
Below are 15 common questions about dealing with a hacked WordPress site. Each response offers a concise explanation to guide you through quick recovery and future prevention.
1. How do I know if my WordPress site is hacked?
Common warning signs include unusual redirects, new administrator accounts, or defaced pages. You may also see warnings from Google or find spammy links scattered across your content. For deeper insights, check for wordpress malware signs.
2. Should I immediately take my site offline?
Yes. Temporarily disabling public access or activating maintenance mode prevents further damage and protects visitors from malicious code. This step buys you time to investigate the hack.
3. Why do hackers target WordPress so often?
WordPress powers a large percentage of all websites, making it an attractive target. Automated bots look for vulnerabilities like outdated plugins wordpress or weak passwords. Even small sites are not spared.
4. Do I need to change all my passwords?
Absolutely. Hackers often harvest credentials during attacks. Change passwords for WordPress admin, FTP/SFTP, hosting accounts, and database logins. Strong, unique passwords are key to avoiding repeated breaches.
5. How do I remove malicious files?
First, scan your site using plugins like MalCare or WordFence. Then manually delete or replace suspicious files. Core WordPress files should be restored from official sources, and plugin folders replaced from clean backups.
6. What if I cannot remove the malware manually?
If manual removal is too complex or your expertise is limited, professional security services can help. Many hosting providers offer cleanup assistance, and premium plugins like MalCare provide one-click malware removal.
7. Can I restore a previous backup safely?
Yes, restoring a backup from before the hack is one of the fastest ways to purge hidden infections. Ensure the backup is free of malware by testing in a staging environment if possible, then re-scan after you go live.
8. Will a security plugin prevent all hacks?
Security plugins significantly reduce risks, but nothing guarantees 100% protection. Pair your security plugin with regular updates, strong passwords, backups, and best practices outlined in this list. Explore more in wordpress security checklist.
9. How do I secure my login page?
Use strong passwords, limit tries with limit login attempts, enable two-factor authentication, and sometimes rename the wp-login URL. You can also block bad bots wordpress to curb brute-force attacks.
10. Are free themes and plugins safe?
Plugins and themes from reputable sources typically pass security checks. However, cheap wordpress themes) or pirated “nulled” themes often contain hidden malware. Stick to official marketplaces to minimize risks.
11. Should I disable XML-RPC?
If you do not use remote publishing, disabling XML-RPC can help block wordpress brute force attacks that exploit that protocol. Refer to disable xmlrpc wordpress for specific steps.
12. Do I need a WordPress firewall?
A firewall can dramatically reduce malicious traffic before it reaches your server. Setting up a Web Application Firewall (WAF) using Cloudflare or another provider is a powerful deterrent. See wordpress waf setup for more details.
13. How do I protect my uploads folder?
Ensure that users cannot run PHP files from the uploads directory. Explore secure file uploads wordpress to learn how to adjust file permissions and server settings for safer handling of media files.
14. Can outdated PHP or WordPress versions lead to hacks?
Yes. Unpatched software is the easiest doorway for attacks. Update WordPress core, themes, plugins, and server-side software like PHP to help prevent vulnerabilities. (WPBeginner)
15. How often should I scan my site?
Weekly scans catch most hacks early. Daily or real-time scanning is even better if your site handles sensitive data. Combine regular scans with logs analysis and a consistent backup schedule to maintain tight security.
By following these recommendations, you can quickly contain a hack and fortify your website. In the first hour, focus on limiting damage, removing malicious code, and protecting your passwords. Then, move onto installing robust security measures and learning from the experience so it does not happen again. Regular updates, backups, and proactive defenses are the most reliable shields against future breaches.
