Illustrative web developer at a laptop reviewing website files flagged red and green during a WordPress malware clean-up

Finding out your website has been hacked is stressful, especially if customers are the ones telling you. The good news is that most WordPress compromises follow familiar patterns and can be cleaned up methodically. This guide walks through what to do, in order, so you fix the problem properly rather than just hiding the symptoms.

Signs your WordPress site has been hacked

Visitors are redirected to spam, gambling or fake shop sites, often only on mobile or only when arriving from Google.
Google shows “This site may be hacked” in search results, or Chrome shows a red warning page.
Search results show pages you never created, often in other languages.
New administrator accounts appear that nobody recognises.
Your host suspends the account or warns you about malware or outgoing spam.
The site is suddenly slow, or files you did not change have recent modified dates.

Step 1: Don’t delete everything in a panic

It is tempting to wipe the site and start again, but you lose the evidence of how the attacker got in, and you may restore the same weakness. Take a full copy of the current files and database first and store it somewhere safe and offline. If personal data may have been accessed, you will need that copy to work out what happened.

Step 2: Contain the damage

Put the site into maintenance mode, or ask your host to restrict access, if it is actively harming visitors.
Change every password linked to the site: WordPress administrators, hosting control panel, SFTP/FTP, the database user and any email accounts on the same hosting.
Remove administrator accounts you do not recognise, and check that the remaining admins really need that level of access.
Turn on two-factor authentication for every administrator.

Step 3: Clean the site

Replace WordPress core files with a fresh copy of the same version from WordPress.org. Keep wp-config.php and wp-content, but check them.
Reinstall themes and plugins from their official sources rather than trusting the existing files. Delete anything you do not use, and never use “nulled” (pirated) premium plugins.
Check the obvious hiding places: .htaccess, wp-config.php, PHP files inside wp-content/uploads (there should not be any), and unfamiliar files in the site root.
Check the database for injected scripts in posts, widgets and options, and for rogue admin users.
Scan the site with a reputable security plugin or service, and compare against your clean backup if you have one.

If you have a backup from before the hack and you know when the compromise started, restoring it can be quicker. You still need to update everything and change passwords afterwards, or the attacker can simply walk back in.

Step 4: Update and harden

Update WordPress core, every plugin and every theme to the latest version.
Remove inactive plugins and themes; they can still be exploited.
Use strong, unique passwords and two-factor authentication for all admin logins.
Limit login attempts and keep a web application firewall in front of the site if your host offers one.
Make sure backups run automatically and are stored away from the web server.

Step 5: Tell Google the site is clean

If Google flagged the site, log in to Google Search Console and open the Security Issues report. Once everything is fixed, request a review there. Google explains the process in its Search Console help pages [1]. Also look for spam URLs that were indexed and make sure they now return a 404 or 410.

Step 6: Check your legal duties

If the site holds personal data, such as customer accounts, form submissions or orders, and that data may have been accessed, UK GDPR requires you to report a personal data breach to the ICO within 72 hours of becoming aware of it, unless it is unlikely to result in a risk to people [2]. You can also report cyber crime to Action Fraud [3] (or to Police Scotland if you are in Scotland).

How to stop it happening again

Most compromised WordPress sites have something in common: out-of-date plugins, abandoned themes, weak or shared passwords, or nobody responsible for updates. Recent examples include the form plugin flaw and the Elementor Pro upload flaw. A website maintenance plan with updates, monitoring and tested backups is far cheaper than a clean-up.

When to speak to BMT

If your site is showing warnings, redirecting visitors or has been suspended by your host, our WordPress malware removal service can clean it, close the hole that let the attacker in, and get you off Google’s warning list. Call us on 0161 672 7461 or 01706 391 047, or get in touch online.