My WordPress site has been hacked: first steps

The short answer

Take a breath. A hacked WordPress site is common, fixable, and rarely as bad as it looks in the first hour. Do not delete files or restore random backups yet, because you can destroy the evidence of how they got in.

From a computer you trust, change your WordPress password and your email password, then contact support. On WP Alpha, malware cleanup is included on every plan, so the fastest route is to open a live chat or use the urgent escalation form.

What it means

“Hacked” means someone has put code or an account onto your site that you did not authorise. In most cases nobody chose your business specifically. Automated programs scan the web around the clock looking for a known weakness, and when they find one they install the same payload everywhere it fits.

The symptoms you notice depend on what that payload does. Common signs:

• Visitors are sent to another website, sometimes only from Google results or only on phones.
• Google shows a warning such as “This site may be hacked” or “Deceptive site ahead”.
• Pages you never wrote appear in search results, often for pharmaceuticals, gambling or designer goods.
• Your site sends spam, and your email provider or host warns you.
• An administrator account you do not recognise appears, or your password stops working.
• The site slows down or shows errors for no obvious reason.

Malware, the general term for this unwanted code, usually hides in several places at once so that removing one copy does not remove the infection. That is why a proper cleanup matters more than quick fixes.

Common causes

• An outdated plugin or theme. By far the most common route. A security hole is published, bots start probing for it within hours, and any site that has not updated is open.
• A weak, reused or leaked password. If your WordPress password also protected an account that was breached elsewhere, bots will try it. Without two-factor authentication (a second check, usually a code from your phone), a correct guess is enough.
• Abandoned or pirated software. Plugins that have not been updated in years, or “nulled” premium themes downloaded free, frequently ship with holes or with malware already inside.
• A neighbouring site. If several sites share one hosting account, an infection in an old forgotten site can spread to the others.
• An infected computer. Malware on your laptop can steal saved FTP and WordPress passwords.

How to fix it

1. Record what you see. Take screenshots of the redirect, warning or strange page, and note the exact web addresses and the time. Support will ask for this. (Same on any host.)
2. Change passwords from a clean device. Change your WordPress password under Users > Profile, your management console password, your SFTP password, and the password on the email account that receives WordPress notices. If you reused that password anywhere, change it there too.
3. Check for unknown administrators. Go to Users > All Users and filter by Administrator. Delete any account you do not recognise, and when WordPress asks, attribute their content to your own account. Also open Users > Profile for each real admin and revoke any Application Passwords you did not create.
4. Check your settings. Under Settings > General, confirm the WordPress Address, Site Address and Administration Email are still yours. Attackers sometimes change the email so password resets go to them.
5. Update everything, then re-install core. Go to Dashboard > Updates, update WordPress, plugins and themes, then click Re-install Now to replace the core files with fresh copies. This removes malware hidden inside WordPress’s own files without touching your content.
6. Clear out plugins and themes you do not use. Under Plugins > Installed Plugins, delete (not just deactivate) anything unused or unfamiliar. Do the same under Appearance > Themes, keeping only your active theme and one default theme.
7. Look in the uploads folder. Using File Manager in the management console (Plesk with WP Toolkit), open wp-content/uploads and look for any file ending in .php. That folder should only hold images and documents. A PHP file there is almost certainly malware.
8. Rotate the security keys. In wp-config.php there is a block of lines starting with AUTH_KEY, called salts, which sign every login cookie. Replace them with new values from the WordPress secret key generator. This logs out every session, including the attacker’s.
9. Hand over to the cleanup team. Tell support what you found and what you changed. If they offer to restore a backup, help them pick a date from before the first symptom.
10. Afterwards, request a review in Google Search Console if Google flagged the site, and consider telling customers if their details could have been exposed.

On WP Alpha

Malware cleanup is included on every WP Alpha plan. You do not need to buy a cleanup service or find a freelancer: contact support on live chat, or use the urgent escalation form if the site is actively redirecting visitors or showing a Google warning.

Every site is scanned daily by Imunify, so an infection is often caught before you notice it. Backups run every two hours and are kept for 30 days, and a restore of anything from a single file to the whole site can be queued from the management console (Plesk with WP Toolkit). That makes it practical to roll back to a clean copy when the infection date is known.