My WordPress Site Was Hacked – What Now? A Step-by-Step Recovery Guide

Your site redirects to a casino, pages in Japanese have appeared in Google and your host has suspended the account. The first reaction is panic – and that's exactly when the mistakes that make cleanup harder happen. Here's what to do, in order.

Signs your site has been hacked

• Redirects – visitors (often only on mobile, or only from Google) end up on other sites.
• Spam pages in Google – search site:yourdomain.com and look for pages in Japanese, about pharmaceuticals, casinos or replicas.
• Warnings – "This site may be hacked" in search results or a red screen in Chrome.
• Search Console – a notice under "Security issues".
• Unknown administrators in WordPress or new files you didn't upload.
• Your host reports malware or suspends the site for sending spam.
• In a store – customers report unrecognised charges on their cards after ordering from you.

What to do in the first hour

1. Don't delete at random. Removing suspicious files without a plan often breaks the site and destroys the traces that reveal how the attacker got in.
2. Take a copy of the current state – files and database. This is the "crime scene"; you'll need it for analysis.
3. Change every password – hosting panel, FTP/SFTP, database, all WordPress administrators and the email tied to these accounts.
4. For a store – stop taking card payments on the site until you're sure checkout is clean. Cash on delivery can stay on.
5. Contact your host – they often have logs and scanners that show when and from where the attacker got in.

How to clean a hacked WordPress site

1. If you have a clean backup

Restore a backup from before the attack – malicious code sometimes sits unnoticed for weeks, so check the dates. Then go straight to closing the hole (below), or you'll be hacked again.

2. If you don't have a backup

• WordPress core – replace the wp-admin and wp-includes folders with clean copies from wordpress.org. With WP-CLI, wp core verify-checksums shows which files were modified.
• Plugins and themes – delete and reinstall from the official source. Remove anything you don't use. "Nulled" (pirated) plugins and themes are one of the most common sources of infection.
• The uploads folder – it should only hold images and documents. Any .php file in wp-content/uploads is suspicious.
• wp-config.php and .htaccess – check for unknown code, redirects and included external files.
• The database – unknown admins, injected scripts in posts, widgets and settings.
• Security keys – change the salts in wp-config.php. This logs out every user, including the attacker.
• Scanning – Wordfence (plugin) and Sucuri SiteCheck (external scanner) help find what's left.

3. For WooCommerce: check checkout

The most dangerous attack on a store is a card skimmer – hidden JavaScript on the payment page that sends card details to the attacker. The site works normally and nothing looks wrong. Check which scripts load on checkout and from where, as well as your payment plugin settings.

How to remove Google's warning

1. In Search Console, open Security & Manual Actions › Security issues and see what Google found.
2. Make sure every listed URL is clean. Spam pages should return a 404 or 410 error.
3. Click "Request review" and describe what you cleaned and how you closed the hole.
4. Resubmit your sitemap so Google crawls the clean pages.

The review usually takes from a day to a few weeks. Spam pages drop out of the results gradually.

Personal data and GDPR

An online store holds customers' names, addresses, phone numbers and emails. If there's a risk this data leaked, GDPR requires you to notify your data protection authority within 72 hours of becoming aware, and in high-risk cases the affected customers too. Document what happened and what you did. Consult a lawyer for your case.

How to stop it happening again

• Updates for WordPress, the theme and plugins – most breaches come through old versions with known vulnerabilities.
• Daily off-site backups, kept for at least 30 days, with tested restores.
• Two-factor login for administrators and unique strong passwords.
• A firewall (WAF) and login attempt limits.
• Only the admins you need – editors don't need full rights.
• Good hosting with account isolation and current PHP. See how to choose WooCommerce hosting.
• Monitoring – an alert the moment the site goes down or changes.

Is your site hacked right now? Get in touch – I'll clean it, close the hole and help remove Google's warning.