- Admin
- October 12, 2026
- 0 Comments
- SEO
When a WordPress website is hacked, the order of your next steps matters more than speed. Deleting files too early can destroy useful evidence. Changing one password while leaving others unchanged keeps a door open. This guide explains how to confirm the hack, what to do first, how to clean the site, and how to ask Google to review it afterwards.
Short answer: Write down what you see, back up the infected site, contact your host, and change every password and the secret keys. Then replace core files with fresh copies and check plugins, themes, users and key files. After the cleanup, update everything and request a review in Google Search Console.
How to tell your WordPress site has been hacked
Some hacks are obvious, such as a defaced homepage or a browser warning page. Many are not. Google notes that hackers often hide their changes so they only appear to Google, or only to visitors who arrive from search results. So your site can look normal when you open it yourself.
The table below shows common signs and a safe way to check each one.
| What you notice | What it can point to | Safe way to check |
|---|---|---|
| A warning page in the browser, or a warning in search results | Malware, hacked content or deceptive pages flagged by Google | Open the Security issues report in Google Search Console |
| Visitors sent to unfamiliar sites, especially from Google or on mobile | Redirect code in .htaccess, theme files or JavaScript | Use the URL Inspection tool, or cURL with a Google referrer |
| Pages you did not create (pharmacy, gambling, "watch online" text) | URL injection or content injection | Search Google for site:yourdomain.com plus a spam word |
| Unknown administrator accounts, or user emails you did not change | A stolen login or a backdoor | Check the Users screen in wp-admin |
| Your host suspends the site or reports abuse | The site is being used to send spam or attack other sites | Ask your host for details and logs |
| Core files that differ from the official version | Modified WordPress files | Run wp core verify-checksums (explained below) |
Avoid opening suspected pages in your normal browser. Google recommends the URL Inspection tool or command-line tools such as cURL instead, because malware can exploit browser weaknesses.
What to do first when your WordPress website is hacked
Do these five things before you start deleting anything.
- Write down what you see. Note the symptoms, the time and time zone, and anything you changed recently, such as a new plugin or a theme edit. WordPress.org calls these signs "indicators of compromise". This record helps you, your host, or any developer you hire.
- Back up the site as it is now. Even an infected copy is useful. If the cleanup goes wrong, you can go back. If you need to find how the attacker got in, you can study it.
- Contact your host. If you are on shared hosting, a hacked neighbouring site can put your site at risk too. Your host may also have access logs and older backups.
- Lock access. Change passwords for wp-admin, SFTP or FTP, your hosting control panel and the database. Include every other person who has access. Replace the secret keys in
wp-config.phpso anyone currently logged in is signed out. Also scan your own computer, because stolen logins often start there. - Consider taking the site offline for a short time. If visitors are being redirected or served malware, ask your host about maintenance mode or a temporary suspension. This is a practical judgment, not an official rule, and it depends on how much traffic and revenue the site carries.
How to find and remove the infection
The exact steps depend on the symptoms and on your technical comfort. WordPress.org says this is the most demanding part of the process, so work in this order.
Replace the WordPress core files
Download the same WordPress version your site uses from wordpress.org. Upload the /wp-admin and /wp-includes folders using SFTP. WordPress.org advises against the "reinstall" button in wp-admin, because it often only overwrites existing files, while hackers often add new ones.
To see which core files were changed, use WP-CLI:
wp core verify-checksums
wp core verify-checksums --include-rootThe command compares your files with checksums from WordPress.org. The second version also warns about items in the root folder that do not belong to WordPress. It checks core files only. It cannot tell you whether your plugins, themes, or uploads are clean.
Check the files attackers change most often.
WordPress.org points to .htaccess as one of the most commonly changed files. It can sit in the root folder and in other folders. Also check index.php and the theme's header.php, footer.php and functions.php, because changes there affect every page request.
Google suggests searching your files and page output for terms such as eval, base64_decode and unescape. A match is a reason to look closer, not proof of a hack. Some legitimate plugins use these functions.
Review plugins, themes, uploads and users
- Reinstall plugins and themes from their original source, using the same version your site was running. Update them after the site is clean.
- Delete any plugin or theme you do not use.
- Remove administrator accounts you do not recognise.
- Look inside
/wp-content/uploads/for PHP files. This folder normally holds images and documents, so PHP files there deserve a close look. This is a practical observation, not a rule from the sources above.
Know when to bring in help.
Google says that fixing a malware issue requires the ability to read code and, in some cases, server settings. If that is not your skill set, hiring someone is a sensible choice. Ask them for a written list of what they found and the most likely way the attacker got in. If the same problem returns after a cleanup, the entry point was probably not closed.
After the cleanup: update, reset again, and ask Google to review.
- Update everything. Update WordPress core, plugins, and themes. WordPress.org notes that once a fix is released, the details needed to attack older versions are usually public.
- Change passwords again. WordPress.org specifically says to do this after the site is confirmed clean, even if you changed them when you found the hack.
- Remove spam pages. Delete any pages you did not create and confirm they no longer load.
- Request a review in Google Search Console. Open the security issues report, fix all listed issues across the whole site, and test your fixes. Then select Request Review. Describe what was wrong, what you did to fix it, and the result.
Reviews can take from a few days to a few weeks. Do not resubmit while a request is pending. Google also warns that submitting before the problem is fixed can slow the next review, or get your site marked as a repeat offender.
Security issues report or manual action?
Search Console has two reports that can both be involved after a hack.
- Security issues list signs that your site was hacked or could harm visitors, such as malware or phishing. Pages can show a warning label in search results or a browser warning page.
- Manual action lists mostly spam-policy problems. Affected pages are usually ranked lower or left out of results, with no visible warning.
For example, Google's guidance on sneaky mobile redirects tells owners who did not add the redirects to first check the Security issues report for a hack. Check both reports.
Ranking recovery after a hack is not guaranteed, and its speed varies. If some pages stay out of Google after the review, see our guide on why Google may not be indexing your pages.
Clean it, restore a backup, or rebuild?
Your choice depends on what backups you have and how the site was built.
| Option | Fits when | Watch out for |
|---|---|---|
| Clean the existing site | You can find the changed files, and the site has heavy custom work | A missed backdoor will bring the hack back. You need someone who can read code |
| Restore a pre-hack backup | You know roughly when the hack happened and have a backup from before it | You lose newer content. The weak plugin or password that let the attacker in is still there until you update and reset |
| Rebuild on a fresh install | The site is small, parts of it are no longer maintained, or the infection keeps returning | It takes more time. Do not copy the old wp-content folder across without checking it |
The WordPress handbook gives a useful example of why older backups matter. Imagine a site is hacked on May 1 but the problem is noticed on May 12. A backup from before May 1 helps you rebuild. A backup from after it helps you study how the attacker got in. Keep several snapshots, not only the latest one.
How WordPress sites usually get hacked, and how to lower the risk
Google lists three common routes: a directory left with open permissions, outdated software such as an old CMS version, and hacked third-party plugins. The WordPress handbook adds that attacks usually fall into two groups: crafted requests that target known flaws in outdated software, and password guessing. It also says hosts look after the server, but the website application is the owner's responsibility.
A practical prevention list:
- Keep WordPress, plugins and themes updated, and delete the ones you do not use. If nobody on your team has time for this, a WordPress maintenance service is one way to cover it.
- Install plugins and themes only from WordPress.org or well-known companies.
- Use long, unique passwords and two-step authentication. Use SFTP instead of plain FTP.
- Set file permissions to 755 for folders and 644 for files. The handbook suggests 400 or 440 for
wp-config.php. Confirm what your host allows. - Add
define( 'DISALLOW_FILE_EDIT', true );towp-config.php. This removes the dashboard file editor. The handbook notes it will not stop an attacker from uploading files. - Keep tested backups, taken regularly and stored away from the server.
- Watch for file changes and review logs.
The handbook is clear about the limit here: security is about reducing risk, not removing it. No checklist makes a site unhackable.
Getting help after a hack
If you want help keeping a WordPress site updated after a cleanup, you can contact the ASK Digital Agency team from Gurugram and describe what happened. A good starting message includes your hosting provider, the symptoms you noticed, and any Search Console warnings. Even with outside help, the first steps in this guide, backing up and locking access, are still worth doing yourself right away.
A hacked WordPress site recovers in a fixed order: contain it, back it up, clean it, update it, then ask Google to review it. The most common reason hacks return is that the entry point was never closed, so spend as much effort on the update and password steps as on the cleanup itself. If you have not checked the Security issues report in Search Console yet, start there today.
