Fazley Rabbi"Customers say our website is sending them to a betting site." "Google shows spam pages in another language under our name." "There is an admin user we never created." These are signs that your WordPress site has been hacked. It feels alarming, but it is fixable. What matters is doing things in the right order: get back control, remove everything the attacker left behind, and close the hole they came through.
Signs your site has been hacked
- Visitors, sometimes only on mobile or only when arriving from Google, are redirected to spam, gambling or adult sites.
- Unfamiliar pages appear in Google results for your domain, often in other languages.
- Admin users, plugins or files you did not add.
- A browser or Google warning that the site may be hacked or harmful.
- Your hosting provider suspends the account or reports malware.
- Email from your domain starts bouncing or landing in spam because the server has been sending junk.
The first hour
- Do not delete everything in a panic. You need evidence to find out how they got in.
- Take a full backup of the current state, files and database, and label it as hacked. It is for investigation, not for restoring.
- Change every password: hosting control panel, FTP or SFTP, database, every WordPress administrator, and the email accounts linked to them. Do this from a clean device.
- Remove admin users you do not recognise, and check whether any existing user's role was changed.
- Tell your hosting provider. They may have logs, and can tell you whether other sites on your account are affected.
- Put up a maintenance page if the site is actively harming visitors.
Cleaning it properly
- Find the entry point. Common causes are outdated plugins or themes, "nulled" (pirated) themes and plugins from unofficial sites, weak or reused passwords, and old, forgotten installations on the same hosting.
- Replace the WordPress core files with a fresh copy from WordPress.org.
- Reinstall plugins and themes from official sources, and delete anything you do not use. Never reinstall a nulled copy.
- Check the uploads folder for PHP files that should not be there, and inspect configuration files, .htaccess and scheduled tasks for anything added.
- Search the database for injected scripts, spam links and unknown users.
- Or restore a clean backup from before the hack, if you are sure it is clean, then update everything immediately. Restoring without closing the hole usually means being hacked again.
- Scan again with a reputable security scanner, and check from a phone on mobile data, since some infections only show there.
- Clean up in Google. In Google Search Console, check the Security issues report and request a review once the site is clean. Let the spam URLs return a "not found" response.
Keeping it from happening again
- Keep WordPress, plugins and themes updated, and remove what you do not use.
- Use only legitimate themes and plugins from official sources.
- Give every admin a strong, unique password and two-factor authentication, and keep the number of admins small.
- Keep automatic off-site backups, and test restoring them now and then.
- Use a security plugin or firewall, and hosting that keeps sites isolated from each other.
- Make one person responsible for checking updates and backups every month.
What you can do yourself, and when to call an expert
Changing passwords, removing unknown users, talking to your host and checking Search Console are things you can do today. Finding hidden backdoors, cleaning the database and hardening the server take experience; a quick, partial clean often leaves something behind, and the hack comes back. That cleanup is part of my software and website development work, and an ongoing maintenance and backup plan is the best protection afterwards.
The smallest useful first step
Right now, from a clean device, change your hosting and WordPress admin passwords and turn on two-factor authentication. Then take the hacked-state backup and stop changing files until the cause is clear. If you need help with the cleanup, get in touch.