My WordPress Site Was Hacked: First Hour Steps

My WordPress site was hacked. What do I do first?

Stay calm and do not delete anything yet. First, take a copy of the site and its database so evidence is preserved. Then change passwords for your hosting account, WordPress admins and database. Tell your host. Finally, put up a maintenance page if visitors are being redirected or warned.

Most hacked sites can be cleaned. Rushing makes it worse, because deleting files at random can break the site or hide how the attacker got in. Work through the list below in order.

What should I do in the first hour?

Focus on stopping the damage and keeping a record. You are not fixing the root cause yet. You are containing the problem so customers are safe and a professional, or you, can clean it properly. Change passwords, save logs and copies, and tell your host.

• • Save a copy. Download the files and a database export, even though they are infected. Label it "infected, do not restore".
• • Change passwords. Hosting, WordPress admins, FTP or SFTP, and the database. Do it from a device you trust.
• • Log out everyone else. In WordPress, the Users screen lets you end other sessions for a user. Remove admin accounts you do not recognize, but note their names first.
• • Contact your host. Ask whether they see malware on the account and whether other sites share it.
• • Show a maintenance page if visitors see spam, redirects or browser warnings.
• • Pause ads and email campaigns that send people to the site.

How do I know if my WordPress site has been hacked?

Look for changes you did not make. Common signs are redirects to other sites, strange pages in Google results, a browser or Google warning, new admin users, a host suspension notice, or a site that is suddenly slow. Sometimes there are no visible signs at all.

The GoDaddy annual cybersecurity report found 834,661 infected sites across more than 34 million scans in 2025. By type, 41.5 percent was malware, 35.2 percent SEO spam and 21.7 percent malicious redirects. Many owners learn about it from a customer, not from their own site.

Should I take my hacked WordPress site offline?

If visitors are being redirected, shown spam, or you collect payments or personal details, yes, at least temporarily. A maintenance page protects your customers while you fix the problem. If the site looks normal and you only suspect a problem, keep it up briefly while you take the backup.

Ask your host about a "suspend" or "maintenance" option, or add a maintenance page that returns a temporary status. It is a short pause, not a permanent decision. Search engines tolerate a few days of downtime far better than a long stretch of spam.

Is it safe to restore a backup after my WordPress site was hacked?

Only with care. A backup from before the hack can bring the site back fast, but it also brings back the same weakness, so the attacker can return. Restore only a backup you know predates the break-in, then update everything and change every password.

If you do not know when the hack happened, a restore may reinstall the infection. Backups also do not catch a hidden admin user created in the database after the backup date. Treat a restore as step one of a cleanup, not the whole cleanup.

How did hackers get into my WordPress site?

Most often through an outdated plugin or theme. Patchstack's State of WordPress Security in 2026 counted 11,334 new vulnerabilities in 2025, with 91 percent in plugins and 9 percent in themes. It reported a median of about 5 hours to mass exploitation for the worst ones.

Other routes are stolen or reused passwords, an old admin account, and in this season, the server's own PHP. If you are still on PHP 8.1 or older, read our guide on PHP2Shell for WordPress owners and run the PHP version checker.

Can I fix a hacked WordPress site myself?

You can try, if the site is simple and you are comfortable in your hosting panel. Install a scanner, update everything, remove unknown users and reset passwords. The risk is missing a backdoor, a hidden file that lets the attacker back in, which is why many sites get hacked again.

A professional cleanup compares files against clean copies, checks the database, and looks for the entry point. Here is how the two paths compare.

How long does it take to clean a hacked WordPress site?

A simple site often takes a day or two. A store, a membership site or several sites on one hosting account takes longer, because every site and every shared folder must be checked. Waiting for Google to clear a warning can take extra days after the site is clean.

Our Emergency Cleanup starts within 4 business hours, and most jobs finish in 24 to 48 hours. It is $495 for one site and covers malware and backdoor removal, spam redirects, an admin and user audit, a salts reset and a clean report. We include a free re-clean for 30 days.

What happens after the site is clean?

After cleanup, the work is closing the door: updating everything, removing abandoned plugins, turning on two-factor login and keeping a firewall and backups running. Without that, the same hole stays open. Our WordPress security service includes a hardening package at $895.

If the site keeps getting hacked after cleanup, that is a different problem, covered in why WordPress sites get hacked again. To see how pricing varies, read how much WordPress malware removal costs. For ongoing protection, see our website care plans.

Next step

Not sure if you are hacked? Check the PHP version with our free PHP version checker, then book a call. We will tell you honestly whether you need a cleanup or just an update.

This article is general information, not legal or compliance advice. Written by Eliran Yihye, founder of Cuanto Labs, on October 27, 2026.