A hacked WordPress site is one where someone has gained unauthorised access and changed files, the database or user accounts, usually to redirect visitors, publish spam, steal data or use your server for other attacks. Recovery means containing the damage, cleaning the site or restoring a clean backup, and closing the weakness that let the attacker in. The order matters: cleaning without fixing the cause usually leads to reinfection within days.
Discovering a hack is stressful, especially if customers are calling about strange redirects or your hosting company has suspended the account. Resist the urge to start deleting files at random. Work through the steps below in sequence and keep notes as you go.
How do you know your WordPress site has been hacked?
Common signs include unexpected redirects, spam pages appearing in Google results, unfamiliar admin users, browser or Google warnings, and alerts or suspension notices from your host.
Some infections are obvious; many are deliberately hidden from logged-in administrators. The table below links common symptoms to where you should look first.
| Symptom | What it often means | First place to check |
|---|---|---|
| Visitors from Google or mobile are redirected to other sites | Injected redirect code in files, .htaccess or the database | Test in a private window on mobile data; inspect .htaccess and theme files |
| Search results show pages you never created, often in other languages | Spam pages generated by injected code (often called SEO spam) | A site: search on Google and the Pages report in Search Console |
| Unknown administrator accounts | Attacker access via stolen password or vulnerable plugin | Users list in WordPress admin and the users table in the database |
| Browser shows a “deceptive site” or malware warning | Google Safe Browsing has flagged the site | Security Issues report in Google Search Console |
| Host suspends account or reports high resource use | Server being used to send spam or attack others | Host’s notice, server logs, unknown PHP files |
| Strange new files in uploads or the site root | Backdoor scripts left for future access | PHP files inside wp-content/uploads |
What should you do in the first hour?
Contain the damage and secure access: limit what visitors see, change passwords, and preserve a copy of the infected site before changing anything.
- Put the site into maintenance mode or ask your host to restrict it if it is actively harming visitors, for example by redirecting them to scam pages.
- Change every password connected to the site: hosting control panel, SFTP or FTP, database, all WordPress administrator accounts, and the email accounts that receive password resets. Do this from a device you trust.
- Enable two-factor authentication on the hosting and WordPress admin accounts if it is not already on.
- Take a copy of the hacked site, files and database, and store it separately. It helps you understand what happened and may be needed later. Label it clearly so nobody restores it by mistake.
- Tell your host. They may be able to see logs, identify the entry point or confirm whether other sites on your account are affected.
Should you restore a backup or clean the site?
Restore if you have a clean backup from before the infection and can identify the cause; clean manually if no clean backup exists or you cannot tell when the hack began.
Restoring is faster, but only if the backup truly predates the compromise. Attackers sometimes sit quietly for weeks, so “last night’s backup” may already contain the backdoor. Check file modification dates, log entries and when symptoms started before choosing a restore point. Remember that restoring will lose orders, enquiries and content added since that backup, so note anything you need to re-enter. Our WordPress backup and restore guide explains how to restore safely and why off-site copies matter in exactly this situation.
How do you clean a hacked WordPress site step by step?
Replace everything replaceable with fresh copies, then inspect what cannot be replaced: uploads, the database, configuration files and user accounts.
Replace core, themes and plugins
Download fresh copies of WordPress core, your theme and every plugin from their official sources, and replace the existing folders rather than editing infected files one by one. Delete any plugin or theme you do not use. If you were running a nulled theme or plugin, remove it entirely; pirated software is a well-known source of infections.
Inspect uploads and configuration
The uploads folder should contain media, not PHP scripts. Any PHP file inside it deserves suspicion. Check wp-config.php and .htaccess for unfamiliar code, and look in the site root for files that do not belong to WordPress.
Check the database and users
Remove administrator accounts you do not recognise. Search posts, pages and options for injected script tags, hidden links and unfamiliar URLs. Spam pages may exist as posts with odd titles, and redirects can hide in widget or option values.
Reset security keys and sessions
Generate new security keys and salts in wp-config.php. This logs out every user, including any attacker with a stolen session, and forces fresh logins.
How do you stop it happening again?
Find and fix the entry point, then strengthen the routine that keeps the site safe. Without this step, reinfection is likely.
- Identify the cause: an outdated or abandoned plugin, a weak or reused password, an old developer account, an outdated PHP version or a compromised computer used to log in.
- Update everything and remove unused plugins and themes. A WordPress plugin audit is a sensible follow-up.
- Limit admin accounts to the people who genuinely need them and use lower roles for editors.
- Add monitoring: file change alerts, uptime checks and a firewall from your host or a reputable security plugin.
- Keep off-site backups with enough history to go back before a slow-burning infection.
Our WordPress security checklist covers these measures in more depth, and they belong in your regular maintenance routine.
How do you clear Google warnings and repair search visibility?
Once the site is clean, use Google Search Console to check the Security Issues report and request a review, then deal with any spam pages Google has indexed.
If Google flagged the site, the Security Issues report in Search Console explains what was found and lets you request a review after cleaning. Describe what you fixed honestly. Spam URLs created by the hack should now return a “not found” or “gone” response; you can use the Removals tool to hide urgent ones temporarily while Google recrawls. Submit an updated sitemap and keep an eye on the Pages report over the following weeks. Our Google Search Console guide walks through these reports. Rankings often recover once the site is clean and stable, but the timing is not something anyone can promise.
When should you get professional help?
Bring in an experienced developer if the site handles payments or customer data, if the infection keeps coming back, or if nobody on your team is comfortable working with files and databases directly.
Some clean-ups are straightforward enough for a confident site owner with a clean backup. Others are not, and a half-finished attempt can make matters worse by deleting evidence or leaving a backdoor in place. Situations where outside help is usually worth it include:
- An online store or member area, where customer data, orders and payment flows are involved and mistakes have consequences beyond the website.
- Repeated reinfection, which usually means a backdoor or the original weakness is still there.
- No clean backup, so every file and database table has to be checked by hand.
- Hosting suspension, where the host needs a clear explanation of what was fixed before reinstating the account.
- Thousands of spam pages in Google, which need careful handling in Search Console alongside the technical clean-up.
Whoever does the work, ask for a written summary afterwards: what was found, how attackers got in, what was changed and what remains to monitor. That record helps if the problem returns and makes the case for better upkeep. A hacked WordPress site is rarely just bad luck; it is usually a sign that updates, accounts or backups need a proper owner.
How can DA WebTech help after a hack?
When a business in Ahmedabad or elsewhere comes to DA WebTech with a hacked WordPress site, we contain the problem first, preserve a copy, clean or restore, trace the cause and then put the site on a maintenance routine so it stays clean. We explain what we found in plain language and will tell you honestly if a rebuild would be safer than a clean-up.
If your site is showing signs of a hack right now, contact us with your website address and what you are seeing, and we will advise on the next step.
