My WordPress Website Has Been Hacked – What Now?

If the site is actively redirecting visitors, distributing malware or exposing a broken checkout, it may be safer to restrict access or place a temporary holding page while the investigation happens. If the domain is controlled, a basic business presence can often be restored quickly even while the original site is being cleaned.

Keep a copy of the compromised files/database before destructive changes. It may contain evidence of what happened and can help identify injected code or modified files. Also locate the most recent known-good backup, if one exists.

A compromise can involve hosting accounts, database users, FTP/SFTP credentials, administrator users, scheduled tasks, .htaccess/server rules, plugins/themes or injected database content. Cleaning only the visible page can leave the attacker a route back in.

Replace compromised core files where appropriate, remove malicious code/users, update vulnerable software, delete abandoned plugins/themes, change relevant credentials and review server/PHP configuration. If the vulnerable component is no longer supported, replace it rather than putting the old weakness back online.

Change WordPress administrator passwords and any affected hosting/database/FTP credentials. Review active users and API/application passwords. Use unique passwords and multi-factor authentication where available.

Some hacked sites are straightforward to clean. Others are old, abandoned or built on poor code and become a false economy. If a clean rebuild is safer and cheaper than repeatedly patching an unsupported site, we will say so.

Once the site is back online, monitor uptime, security logs, Search Console and unexpected file changes. Check forms, payment flows and SEO/indexing as well as the homepage. If spam URLs were created, they may continue appearing in search until Google recrawls the cleaned site.

A clean backup can restore the website quickly, but if you put it back onto the same vulnerable plugin, compromised account or insecure server configuration, the site can be reinfected. Restoration and remediation are separate jobs: recover the known-good content, then remove the route that allowed the compromise.

If the compromise involved customer data, payment information or other personal data, the business may have legal or contractual notification obligations. Technical cleanup is not a substitute for privacy, payment-provider or legal incident handling. Where there is any chance personal data was exposed, get appropriate professional advice rather than assuming a malware scan closes the matter.