My WordPress site has been hacked — what now?

First thing, because you probably need to hear it before anything else: the site is almost certainly recoverable. A WordPress site hacked caught early is usually back and behaving by the end of the week. Nobody loses their business over this.

The short version of what to do is this. Copy everything before you touch it. Change every password that can reach the site. Tell your host. Then get it cleaned properly instead of patched over, because the way in matters more than the mess left behind.

The first hour

If you do nothing else today, do these four.

• Take a full copy of the site exactly as it stands, files and database, and put it somewhere off the server. Yes, it is infected. It is also the only record of what happened, and it holds everything you have published since your last clean backup.
• Change the passwords on your hosting control panel, every WordPress administrator account, FTP or SFTP, and the database user. Change the password on the email address those accounts reset to as well. That mailbox is often the real front door.
• Tell whoever hosts the site. If they are worth paying, this is their problem too, and they can read things in the server logs that you have no way of seeing.
• Write down when you noticed and what you saw. If the site holds customer records or takes payments, speak to whoever handles data protection for your business before the day is out.

Then stop. Resist the urge to start deleting files to see whether it helps.

Things that make it worse

• Deleting folders at random. You will break the site without removing the backdoor, and afterwards nobody can tell what was infected and what you snapped off in a panic.
• Restoring last night’s backup and calling it finished. If the hole is still open, and it usually is, you have just restored the hole along with the site.
• Installing four security plugins at once. They argue with each other, and they are scanning a site that is already compromised. It is a bit like fitting a lock after the burglar has moved in.
• Shrugging it off because it looks harmless. Hidden spam links, and redirects that only fire for phone visitors arriving from Google, are the most common thing we see. They will get you flagged in browsers and on mail blocklists long before you spot them yourself.
• Paying whoever emails you demanding money to make it go away. That message went to thousands of addresses, sent by a script that has never looked at your website.

How they got in

It is rarely clever. In twenty years of running servers we have seen the same short list over and over.

• An out-of-date plugin with a publicly known flaw. Details get published, scripts start knocking within hours, and a site nobody has updated since spring answers the door.
• A plugin or theme the author walked away from years ago. No updates are coming, so the flaw stays open for as long as the plugin stays installed.
• Weak or reused administrator passwords, found by scripts that try logins all day and never get bored.
• An old admin account belonging to a developer or a member of staff who left years ago, still active, still using the password they picked on their first afternoon.
• A forgotten copy of the site in a subfolder. Something like /old/ or /dev/ or /backup2/, running an ancient WordPress that nobody has thought about, sat on the same hosting account as your live site.

Notice how little of that has anything to do with the server. A perfectly well-run server will still hand over a site through a contact form plugin that nobody patched. It works the other way as well, mind: on a badly run shared server, a break-in on somebody else’s site can walk across to yours.

What a proper clean-up involves

Worth knowing, whether you are doing this yourself or paying somebody, so you can tell the difference between a clean-up and a quick tidy.

• Get the site behind a holding page first. Working on a live compromised site is how people end up reinfected halfway through the job.
• Replace rather than repair. WordPress core, plugins and themes get swapped for fresh copies from source. Anything that has been tampered with is quicker to replace than to read line by line.
• The slow part is everything that cannot simply be swapped: the uploads folder, mu-plugins, wp-config.php, the .htaccess files. An uploads folder is meant to hold pictures, so a PHP file sitting in among the photos is a red flag every single time.
• Databases need the same treatment. Injected scripts inside posts, junk in the options table, administrator accounts you never created, and scheduled tasks set up to reinstall the malware next week.
• Hunting the backdoor is the whole game. A site that gets cleaned and reinfected three days later was never clean. Something was left behind, waiting.
• Finish by rotating the security keys in wp-config.php, which throws every logged-in session out, updating everything, and only then putting the site back in front of the public.

Getting your reputation back

Cleaning the site is only half the work. The other half is telling everyone else you have cleaned it.

• Open Google Search Console, look under Security Issues, and request a review once the site is genuinely clean. Requesting it early and failing puts you further back than doing nothing.
• Browser warnings clear once that review passes. Until it does, most visitors will never reach your homepage.
• If the server was pushed into sending spam, mail from your domain may be getting blocked. Sorting the server’s standing with the mail providers falls to your host, so ask them directly.
• Watch the enquiries. Plenty of people fix a site and carry on wondering why the phone stayed quiet.

A hacked shop is heavier again, with order data and payment trust wrapped up in it. More on that on our WooCommerce hosting page.

Stopping it happening again

Repeat hacks nearly always trace back to the same handful of gaps.

• Updates on a schedule that a named person owns. Not “when I remember”, because nobody remembers.
• Backups kept away from the server and kept long enough to be worth having. Seven days of history is no use when the break-in happened five weeks ago and you only noticed this morning.
• Fewer plugins. Each one is code written by a stranger, running with full access to your database.
• Two or three administrators rather than eleven, and accounts removed the week somebody leaves.
• Blocking the obvious attacks at the server, so they never reach WordPress at all.
• Somebody actually watching. Most compromised sites sit there for weeks before anyone notices.

That list is more or less the job description for managed hosting. On our WordPress hosting we do the updates, keep off-site backups running every day, and watch the servers at all hours. If a site we look after does get hit, clearing up afterwards is part of what you already pay, and there is no invoice waiting at the end of it. A hack does not wait for office hours, so neither do we; out of hours it is usually Olly, our director, reading the alert.

Hacked WordPress site FAQs

If you would rather someone else did it

Ring 01623 650 333 and tell us what you are looking at. We have seen how bad it usually is, which is rarely as bad as it looks at nine on a Sunday night, and we will tell you which of the two it is before you commit to anything. Fully managed UK WordPress hosting starts at £1 a day + VAT, migration included.