Blog

Your WordPress site got hacked. Here's what to do in the first hour.

By Phillip Clapham · October 18, 2026

First, make sure it’s a hack. The clear signs: Google or your browser warns people off your site, your host has switched it off, links or redirects show up that you didn’t add, or there’s an admin user you didn’t create. WordPress’s own guide lists those (FAQ: My site was hacked). A site that’s just broken after an update is usually not a hack. That’s a different post.

If it is a hack, here’s the order. Notice what’s not first: cleaning.

The first hour

  1. Write down what you’re seeing and when. Screenshots, the time and timezone, anything you changed recently. You’ll want it whether you fix this yourself or hand it off.
  2. Call your host. On shared hosting you may not be the only site hit, and they can tell you whether it’s a real compromise or just an outage.
  3. Back up the infected site before you touch it. Yes, it’s infected. If the cleanup goes sideways, you’ll want something to go back to, and something to look at later.
  4. Change every password, not just WordPress’s. Every user, SFTP, your host’s control panel, the database. Then swap the secret keys in wp-config.php, which logs out anyone still signed in. And scan the computer you work from. WordPress’s guide says the infection often starts there.
  5. Scan the site with more than one tool. A plugin and an outside scanner see different things.

Cleaning it

This is where DIY gets real. WordPress’s guide says to replace /wp-admin and /wp-includes by uploading fresh copies of the same version over SFTP. Don’t use the reinstall button in the dashboard. The button overwrites files that exist, and a hack adds files that didn’t. After that you work through wp-content (your theme and plugins) file by file, and look hard at .htaccess, which is one of the files hacks change most. Once it’s clean, change the passwords again.

If Google flagged you, the Security Issues report in Search Console is where it says what it found. Click Request Review only after everything is fixed on every affected page. Say what was wrong, what you did and what came of it, and don’t resubmit while one’s pending. Google says a review can take a few days to a few weeks.

When it stops being a DIY job

  • It’s a store, or your domain is sending spam.
  • You can’t get into wp-admin and you don’t want to go poking around in the database.
  • You can’t tell how they got in. Cleaning without knowing is mopping with the tap still running.
  • You cleaned it once and it’s back.

That’s a rescue. Send me the site and I’ll tell you what’s affected and what cleanup takes. There’s more on how I handle these on the rescue page.

After

Update everything and delete what you don’t use. Keep real backups, and test restoring one. Then ask the question I always ask: does this site need WordPress at all? A site with no plugins has a lot less to get into.