WordPress Site Hacked? How to Tell, Clean It Up, and Lock It Down

If your WordPress site is hacked, work in this exact order: confirm the compromise, put the site into maintenance mode so it stops harming visitors, preserve a copy as evidence, remove the malware or restore from a known-clean backup, and then close the hole that let the attacker in and harden everything around it. That last step is the one most people skip — and it is why a hacked WordPress site so often gets re-infected within weeks of being "fixed." Cleaning the symptom without closing the entry point is not remediation; it is a pause.

The signs a WordPress site is hacked range from obvious to nearly invisible. The obvious: your browser or Google shows a red "deceptive site" warning, the homepage is defaced, visitors are redirected to a pharmacy or gambling site, or your host suspends the account. The subtle and more common: unfamiliar admin users appear, new PHP files show up in wp-content or the site root, spammy pages get indexed under your domain ("japanese keyword hack"), outbound spam email starts flowing from your server, or search results for your brand show gibberish titles. Many owners find out not from their site but from a customer, from Google Search Console flagging "Security issues," or from a sudden traffic collapse. If you suspect it, assume it — verification is cheap and re-infection is expensive.

In the first hour, containment matters more than diagnosis. Put the site into maintenance mode or take it offline so it stops serving malware to visitors and stops damaging your search reputation with every crawl. Change every password that touches the site — WordPress admin, hosting/cPanel, FTP/SFTP, database, and the email accounts tied to them — and force a logout of all sessions. Preserve a full copy of the site and database before you delete anything: it is your evidence and your fallback. Then check Google Search Console for a Security Issues report, because if Google has flagged you, cleanup and a review request are both required to restore your listings.

WordPress sites get hacked through a small number of well-worn doors, and knowing which one matters because it is the door you have to close. The most common by far is an outdated plugin or theme with a known vulnerability — attackers scan the web for the vulnerable version within hours of disclosure, which is exactly what a maintained site patches away. Next are weak or reused admin passwords with no two-factor, brute-forced or bought from an unrelated breach. Then nulled (pirated) themes and plugins that ship with backdoors pre-installed, shared or insecure hosting where a neighbor's compromise spreads, and outdated PHP or server software. Notice the pattern: nearly every one traces back to something a maintained site keeps closed by default.

Cleaning a hacked WordPress site has two valid paths. The fast, reliable one — if you have a known-clean backup from before the compromise — is to restore that backup, then immediately update everything and change all credentials, because the vulnerability that let them in is still present in an old backup. The manual path, when there is no clean backup: replace WordPress core with a fresh copy from wordpress.org, reinstall every plugin and theme from scratch (never trust the existing files), then scan the wp-content/uploads folder and site root for stray PHP files, which have no business living in an uploads directory. Critically, the malware is usually not only in the files — it is in the database too, as injected admin users, malicious scheduled tasks (wp-cron), and scripts hidden in wp_options or post content. A files-only cleanup that ignores the database is the single most common reason a "cleaned" site reinfects itself. Our companion guide to WordPress malware removal covers the file-and-database cleanup in depth.

Getting removed from Google's blocklist is its own step, separate from cleaning the site. Once the site is genuinely clean, open Google Search Console, go to Security Issues, confirm you have fixed each flagged item, and click Request Review — Google typically re-checks within a few days for malware and up to a couple of weeks for deceptive-content flags. If your domain got onto other blocklists (your host's, a browser's, or an email blocklist because the server sent spam), each has its own delisting request. Do not request the review until the site is actually clean; a failed review resets the clock and makes Google slower to trust the next request. This is where a rushed DIY cleanup costs the most — in lost days of being marked dangerous to every searcher.

Locking it down so it does not happen again is the difference between an incident and a pattern. The durable posture: keep WordPress core, themes, and plugins updated on a schedule with staging-tested updates; enforce strong passwords and two-factor on every admin account; run a tuned web application firewall and server-side malware scanning with active removal; take encrypted backups on a short interval with a tested restore path; remove unused plugins and themes entirely (dormant code is still an attack surface); and keep PHP and server software current. Our WordPress security hardening checklist walks through each control, and a disaster recovery plan is what turns the next incident into a five-minute restore instead of a five-day crisis.

Call a professional when the stakes or the complexity exceed a comfortable DIY: the site takes payments or stores customer data, you cannot find a clean backup, the malware keeps returning after you remove it, your host has suspended the account, or the site is down and every hour costs you customers. A professional cleanup finds every infected file and every database injection, closes the entry point, handles the blocklist delisting, and — the part that actually protects you — puts ongoing maintenance in place so the same gap cannot reopen. The honest math: a professional cleanup plus a maintenance plan almost always costs less than a second infection, the reputation damage of a blocklist interval, and the hours you would spend fighting it alone.

Inspirable cleans hacked WordPress sites and keeps them clean. Our team finds and removes the malware across both files and database, closes the vulnerability that allowed the compromise, handles the Google blocklist review, and then hardens the site on SOC 2 Type II infrastructure with a tuned firewall, malware scanning, encrypted backups every 5 hours, and staging-tested updates so it does not happen again. A hacked site is the moment maintenance stops being optional — which is why every cleanup rolls into a WordPress care plan from $49.99/month that keeps the door shut. If your site is compromised right now, do not wait it out: get emergency help or call our USA-based team at 844-455-2800.