Need Custom Website?
If your WordPress site has been hacked, you’re not alone—and you’re not helpless. While it’s a stressful experience, acting fast can help you recover quickly, limit the damage, and protect your reputation. This guide walks you through the exact steps to take when recovering from a WordPress hack.
⚠️ Signs Your WordPress Site Has Been Hacked
Before you panic, confirm the hack. Some common signs include:
- Your homepage is defaced or displays unexpected content
- Google flags your site as unsafe
- You’re unable to log in as admin
- Sudden drops in traffic
- New, unfamiliar user accounts
- Suspicious redirects or popups
- Unusual files or scripts in your hosting account
🚨 Step-by-Step: Recovering from a WordPress Hack
1. Put Your Site into Maintenance Mode
Use a plugin or temporary landing page to limit access to compromised content while you restore your site. This protects visitors and preserves your credibility.
2. Change All Passwords Immediately
- Admin accounts
- FTP/SFTP
- Hosting account
- Database (and update wp-config.php)
Use strong, unique passwords for everything.
3. Scan for Malware
Use tools like:
- Sucuri SiteCheck (free)
- Wordfence
- MalCare
These identify infected files, malicious scripts, or suspicious database entries.
4. Restore from a Clean Backup
If you have a known-good backup (prior to the hack), restore it. Be sure to:
- Backup the current (hacked) version first
- Scan the backup before restoring
5. Remove Infected Files Manually (If Needed)
If no backup is available:
- Use SFTP to access your files
- Delete unfamiliar files or scripts (especially in
wp-contentandwp-includes) - Compare with a clean WordPress install
6. Check for Backdoors
Attackers often create hidden access points, known as backdoors. Search for:
- Base64-encoded text in files
- Strange admin users
- Scripts in theme/plugin folders
7. Update Everything
- WordPress core
- All plugins and themes
- Remove unused plugins/themes entirely
Many hacks exploit outdated code.
8. Reinstall Core Files
Go to Dashboard > Updates > Reinstall Now in WordPress. This replaces compromised core files without deleting content.
🧩 After Cleanup: Hardening Your Site
Once your site is clean, strengthen its defenses:
- Install a Security Plugin: Wordfence, Sucuri, or iThemes Security
- Enable 2FA for all admin users
- Change login URL (with WPS Hide Login)
- Set up a Web Application Firewall (WAF) like Sucuri
- Limit login attempts
- Disable XML-RPC if not used
📩 Notify Google (If Blocklisted)
Use Google Search Console to request a review if your site has been blocklisted:
- Remove infected content
- Click Security Issues > Request Review
- Explain the steps you took to fix the issue
Google will re-crawl and re-evaluate your site.
✅ Final Thoughts
Discovering your site has been compromised can be overwhelming—but it doesn’t have to define your website’s future. The sooner you act, the better your chances of a full recovery with minimal damage.
Investing in ongoing protection with services like Sucuri or Wordfence Premium can prevent future incidents and give you peace of mind.
If recovery feels overwhelming, professional cleanup services (like those included with Sucuri’s paid plans) can help restore your site quickly and safely.
Affiliate Disclaimer: This article may include affiliate links that help support our site at no extra cost to you.
Leave a Reply