WordPress site hacked? Here's what to do first.

If your WordPress site has been hacked, the first thing to know is that it's fixable. WordPress is very popular, which makes it a common target, and most hacks follow familiar patterns.

What to do, in order: don't delete anything yet, contact your host, change every password, take a backup of the hacked site, scan it, clean it or restore a clean backup, update everything, remove admin users you don't recognize, and request a review in Google Search Console if Google flagged you.

Below is each step in plain English, plus how to tell you've been hacked and how to stop it happening again.

Signs your WordPress site has been hacked

Some hacks are obvious. Others stay hidden for months because they're designed to. Watch for:

• Google warnings. A warning next to your site in search results, or a full-page browser warning when people try to visit.
• Strange pages in Google. Search site:yourdomain.ca and look for pages you didn't make, often in another language or selling things you don't sell.
• Redirects. Visitors (often only on phones, or only from Google) get sent to a different website.
• Admin users you don't recognize in your WordPress dashboard.
• A message from your host saying your account is suspended or sending spam.
• A Search Console email about security issues on your site.
• A suddenly slow site or files changed on dates when nobody was working on it.

Step 1: Don't panic-delete

The natural reaction is to start deleting strange files or wipe the whole site. Don't. Deleting the wrong file can break the site, and wiping everything destroys the evidence of how they got in.

If you never find the way in, they can simply come back.

Step 2: Contact your host

Call or open a ticket with your hosting company. Tell them the site is hacked and ask what they can see.

Many hosts can scan your account, show recent file changes, and tell you if other sites on your account are affected. They may also have clean backups from before the hack.

If you don't know who your host is, or don't have the logins, that's a problem worth fixing for good. See who owns your website and domain.

Step 3: Change every password

Assume every login connected to the site is compromised. Change them all, from a computer you trust:

• Every WordPress admin account
• Your hosting control panel
• FTP or SFTP accounts
• The database password (your host can help, and the site's config file needs updating to match)
• The email account tied to your WordPress admin and hosting

Use long, unique passwords, and turn on two-factor login wherever it's offered.

Step 4: Back up the hacked site

It sounds odd, but take a full backup of the site as it is now, files and database. If the cleanup goes wrong, you can get back to where you started. It also keeps a copy of what the hackers changed, which helps whoever is cleaning it find the way in.

Step 5: Scan the site

Use a reputable security scanner, your host's malware scan, or both. A scan will usually flag infected files, injected code and known bad plugins. It won't catch everything, so treat it as a starting point, not the final word.

Step 6: Clean it, or restore a clean backup

You have two choices:

• Restore a backup from before the hack. This is often the fastest fix, if you know when the hack happened and have a backup from before then. You'll lose any changes made since.
• Clean the site. Replace WordPress core files, themes and plugins with fresh copies, remove injected code and unknown files, and check the database for spam content and rogue users. This takes skill and time.

Either way, the restored or cleaned site still has the same weakness that let them in. That's why the next two steps matter.

Step 7: Update everything

Update WordPress, every plugin and your theme. Delete plugins and themes you're not using, rather than just turning them off. Outdated plugins are a common way in.

The Canadian Centre for Cyber Security's website security guidance says the same: keep a regular process for patching your content management system, web apps and plug-ins, and use multi-factor authentication on logins.

Step 8: Remove admin users you don't recognize

Hackers often create their own admin account so they can get back in later. Go to Users in your dashboard and check everyone with Administrator access. Remove anyone you don't recognize, and lower the access level for people who don't need full control.

Step 9: Request a review if Google flagged your site

If Google has put a warning on your site, open the Security Issues report in Google Search Console. Google's help on the Security Issues report says to fix the problem on every page first, because fixing only some pages won't get you a partial return. Then select Request Review and explain what was wrong, what you changed and the result.

Don't send a request while one is still pending. Google says reviews for malware take a few days, reviews for spam hacks can take several weeks, and warnings should clear within about 72 hours once a site is confirmed clean.

How to stop it happening again

Many WordPress hacks aren't personal. They're automated bots looking for known holes in old software and easy passwords. A few habits close most of those doors:

• Keep everything updated. WordPress, plugins and theme, checked at least every week or two.
• Keep backups off the server. Daily, automatic, and stored somewhere other than your hosting account. Test that they restore.
• Turn on two-factor login for every admin.
• Use fewer plugins. Every plugin is code someone else has to keep secure. If you don't need it, delete it.
• Only give people the access they need. Most editors don't need to be administrators.
• Pick good hosting. Cheap shared hosting with no security tools or backups is a false saving.

If that list sounds like a chore, it's exactly what our care plan is for. From $99/month it includes hosting, updates, backups and security, so someone is actually doing it every week. Our post on what website maintenance includes breaks down what that looks like.

When it's time to move

If your site keeps getting hacked, or your host can't help, moving to better hosting with a clean copy of the site is often the best fix. Done properly, a website migration keeps your content and Google rankings intact.

And once the mess is cleaned up, a hacked site is often a slow one, so speed optimization is worth a look too.