WordPress powers over 40% of all websites — which makes it the most targeted CMS on the internet. Most hacks are automated: bots scan for known vulnerabilities in outdated plugins and exploit them within hours of a vulnerability being published. Here's how to know if your site has been compromised, and what to do in the first hour.
7 signs your WordPress site has been hacked
- →Google Search Console shows a security issue — "Site may be hacked" or "Harmful content detected"
- →Your site redirects visitors to a different website (a pharmacy, a gambling site or a suspicious download)
- →Google Search results show pages you didn't create — often in foreign languages or with spammy keywords
- →Your hosting provider has suspended your account or sent an abuse notice
- →Admin user accounts you don't recognise appear in Users → All Users
- →Your browser or antivirus flags your site as dangerous when you visit it
- →Your site is blacklisted by email providers, causing your business emails to bounce
What to do in the first hour
Speed matters. Every hour your site stays compromised, attackers have more time to establish persistent access, inject more malware, and cause more damage to your Google rankings.
WordPress security hardening — prevent re-infection after a hack →Put the site into maintenance mode
Prevent visitors from reaching a compromised site. Use a maintenance mode plugin or temporarily rename your .htaccess file. This protects your visitors while you clean.
Change all passwords immediately
Change your WordPress admin password, your hosting control panel password, your FTP/SFTP credentials and your database password. Do this from a device you're confident is clean — not a device that might be compromised.
Check for new admin accounts
Go to Users → All Users and delete any accounts you don't recognise. Attackers almost always create a backdoor admin account. If the account was created by a plugin, the plugin file may also need to be removed.
Download a clean backup
If your hosting provides automated daily backups, download the most recent one that pre-dates the compromise. This is your fallback if the cleanup doesn't work. If you're on a WordPress Care Plan, your agency will have this.
Scan with a security plugin
Install Wordfence Security (free tier is sufficient for initial scanning) and run a full site scan. It will identify modified core files, suspicious code and known malware signatures. Wordfence can't catch everything, but it finds the most common injection patterns.
Check all plugin and theme files
Attackers inject code into plugin and theme files. Look for recently modified files in /wp-content/plugins and /wp-content/themes. Any plugin or theme you don't recognise should be deleted entirely — not just deactivated.
Request a Google review
Once you've cleaned the site, go to Google Search Console → Security Issues, confirm the fix and request a review. Google typically processes these within 1–3 days. Until the review is complete, some browsers may still show warnings.
The most common entry points
Understanding how attackers got in helps you prevent it happening again. In order of frequency:
- →Outdated plugins with known, publicly-disclosed vulnerabilities (most common by far)
- →Weak or reused admin passwords — brute-forced or credential-stuffed
- →Nulled or pirated themes and plugins with backdoors pre-installed
- →Compromised hosting credentials (cPanel, Plesk, FTP)
- →Vulnerable PHP version — older PHP versions have unfixed security issues
After the cleanup: what changes to make permanently
Cleaning a hacked site without changing the entry point means it will be compromised again within days. After cleanup:
- →Enable automatic security updates for WordPress core and plugins
- →Set up two-factor authentication for all admin accounts
- →Change your wp-admin login URL to a non-default path
- →Remove plugins you don't actively use — every installed plugin is an attack surface
- →Upgrade to PHP 8.2 or above if you're on an older version
ImportantIf your site was hacked via a plugin vulnerability, that plugin must be updated or removed before the site goes back live — not just cleaned. Re-uploading a site with the same vulnerable plugin is one of the most common reasons hacked sites get re-infected within hours of cleanup.