WordPress hacked? What to do in the first 24 hours

A hacked WordPress site usually shows one of a few signs. WordPress lists them: Google or Bing has blacklisted the site, your host has disabled it, it is flagged for malware, visitors' antivirus complains, someone says it is attacking other sites, new users appear that you did not create, or you can see the damage in the browser.

A slow page alone does not prove a hack. Write down exactly what you see before you change anything. The more precisely you can describe the symptoms, the better your host, a forum or a specialist can help you.

In the first hour, document, tell your host, copy the site as it is, and lock the doors. Write down the symptoms and times, contact your host, take a backup even though it is infected, and reset every password that reaches the site. Then you can start cleaning without losing evidence or giving the attacker a second way in.

1. Write it downWhat do you see, at what time, and what changed recently, such as a new plugin, a theme edit or a new user? WordPress says this becomes your incident report, useful whether you fix it yourself or hire help.
2. Tell your hostOn shared hosting a hack can reach more than your site. Your host can also tell you whether it is a real hack or a loss of service. Ask about their backup policy while you are there.
3. Copy the site as it isTake one more backup even if it is infected. WordPress recommends it, so that if the cleaning goes wrong you still have the bad copy to look at.
4. Reset every password that reaches the siteThat means WordPress administrators, your hosting panel, SFTP and the database. Change the secret keys in wp-config.php too, which signs out anyone still logged in.
5. Scan your own computerWordPress notes that attacks often start on the owner's computer, where trojans can capture logins. Run a full scan with up-to-date software.

You clean a hacked WordPress site either by restoring a backup from before the hack or by removing the damage by hand. Restoring is faster if you know a clean date. Cleaning by hand means scanning, removing unknown users and files, and replacing core files, plugins and themes with fresh copies from trusted sources.

• Restore a clean backup. Pick the last backup from before the first sign of trouble. Then update everything and reset the passwords again, or the same weakness lets the attacker back in.
• Scan, then remove. WordPress lists remote scanners such as VirusTotal and Sucuri SiteCheck, and scanner plugins. Delete any administrator you do not recognise.
• Replace core files from a fresh copy. Reinstall over SFTP, not with the installer in the WordPress admin, which only overwrites files and leaves behind any extra files the attacker added. The wp-admin and wp-includes folders can be replaced safely.
• Check the usual hiding places. The .htaccess file is the one most often changed. Edits to index.php, header.php, footer.php and functions.php affect every page.
• Reinstall plugins and themes at the same version. WordPress warns that choosing an older or newer version can break the site.

If this is beyond you, hire a specialist. WordPress notes that reputable organisations clean sites for a fee, and the WordPress.org support forums have a tag for hacked sites where the community helps.

The detail behind the table. In the first hour, copy the site as it is and reset every password that reaches it. In hours 2 to 8, replace core files from a fresh copy. After 24 hours, restore a backup to test it.

If Google has flagged your site, clean it first, then ask for a review. The Security Issues report in Search Console shows what Google found. Requesting a review before the problem is fixed only keeps the warning up longer. Reviews can take a few days for malware and up to several weeks for hacked spam.

When you ask for a review, explain what you did. For hacked spam, Google asks for a short explanation of each type, such as updating an outdated plugin. If Google finds the site clean, it removes the warnings within 72 hours.

You may have to tell customers if personal information was accessed or disclosed. The rules depend on where you operate. In Australia, the OAIC says that if the Privacy Act covers your organisation, you must notify affected people and the OAIC when a breach is likely to cause serious harm. Ask a lawyer if you are unsure.

Even where no rule applies, tell customers whose details were on the server what happened, what you have done and what to do next, such as changing a password they reuse elsewhere.

Most WordPress hacks come in through plugins and themes, not WordPress core. Patchstack counted 11,334 new vulnerabilities across WordPress in 2025, 91% in plugins and 9% in themes, with only 6 in core. Nearly half had no fix from the developer when they were made public.

• 11,334

  new vulnerabilities in 2025, up 42% on 2024

  Patchstack, State of WordPress Security in 2026

• 91%

  were in plugins, 9% in themes, 6 in core

  Patchstack, State of WordPress Security in 2026

• 46%

  had no developer fix when they were made public

  Patchstack, State of WordPress Security in 2026

• 113%

  year-on-year rise in highly exploitable vulnerabilities

  Patchstack, State of WordPress Security in 2026

• 5 hours

  weighted median time to first exploit for heavily exploited vulnerabilities

  Patchstack, State of WordPress Security in 2026

• 39.6%

  of all websites run WordPress

  W3Techs, 22 October 2026

To stop a repeat, close the way in and shrink what can be attacked. Find out how the attacker got in, then update WordPress, plugins and themes, delete anything unused, use unique passwords with two-factor sign-in, keep tested backups, and ask your host which PHP version you run. Each step removes one door.

• Find the cause. WordPress calls this forensics: how did they get in? An outdated plugin, a weak password or a forgotten login are common answers. If you cannot tell, treat every plugin as a suspect.
• Update and prune. Every plugin you delete is one less thing to patch. Update the ones you keep as soon as a security release appears.
• Lock down logins. Long, unique passwords, two-factor sign-in, and only as many administrators as you need.
• Keep backups you have tested. A backup you have never restored may not work when you need it. Restore one to a test copy once a quarter.
• Ask about PHP. The server underneath WordPress needs updates too, and your host usually controls them.

Many sites should stay on WordPress, if someone looks after them. WordPress core is well maintained, and most of the risk sits in plugins, themes and the server. If you have a brochure site with plugins and nobody to patch it, a site built as pre-built pages may suit you better, because it has no plugins and no database on the public side.

That is the idea behind Unpress, a modern, secure CMS, which we build and host. It removes whole types of attack: there is no database to inject into and no plugin to exploit on the public site. It does not make a site immune to every attack, and forms and outside scripts still need care. How Unpress keeps a site secure explains what it covers and what it does not. If you want to move, we do it for you, and our SEO work protects your rankings through the move.