My WordPress site was hacked: what to do, step by step

A hacked site doesn’t always announce itself. Sometimes everything looks normal to you, while your visitors are redirected to shady sites or Google shows a warning next to your name. The good news: a hacked WordPress site can almost always be recovered. The bad news: deleting the suspicious file is not enough.

Warning signs

• Visitors land on another site, often only on mobile or when coming from Google, which makes the problem hard for you to see.
• Google shows “This site may be hacked” in its results, or a red warning screen.
• Unknown pages appear in Google: search for site:your-domain.com.
• New administrator accounts, plugins or files you didn’t add.
• Your host suspends the site, or your emails start being rejected.

1. Don’t delete everything right away

The reflex is to delete whatever looks suspicious. First make a full copy of the current state, files and database. It will help you understand how the attacker got in, and recover content if the cleanup goes wrong.

2. Limit the damage

Notify your host. If your visitors are being redirected to malicious sites, put the site in maintenance mode during the cleanup.

3. Change every access

• The passwords of all WordPress administrator accounts.
• Hosting, SFTP and database access.
• The email linked to the administrator account.
• The security keys in wp-config.php: replacing them logs out every open session, including the attacker’s.

Take the opportunity to turn on two-factor authentication and remove unnecessary administrator accounts.

4. Find the way in

Most hacks come through a plugin or theme that is out of date or abandoned by its author; a weak or reused password; or a paid theme or plugin downloaded from an unofficial site (a “nulled” copy). If the way in stays open, the attacker will come back.

5. Clean up

Two approaches, often combined:

• Restore a clean backup from before the hack. It is the fastest method, as long as you have a backup that is old enough: yesterday’s backup may already contain the malicious code.
• Reinstall what can be reinstalled: WordPress core, plugins and theme, from their official sources. The WP-CLI command wp core verify-checksums compares core files with the originals. Then inspect what can’t be reinstalled: the wp-content/uploads folder, where a .php file has no business being, and the database (users, options, injected content).

6. Close the hole

Update everything, remove unused plugins and replace abandoned ones. A cleanup without fixing the hole only delays the next hack.

7. Regain Google’s trust

In Google Search Console, the Security issues report shows what Google detected. Once the site is clean, request a review to have the warning removed.

Also check for hidden redirects: with Redirect Audit, test your domain with the Googlebot identity, then mobile. A hacked site sometimes redirects only those visitors.

8. Quebec’s Law 25, if personal information is involved

If the site holds personal information (forms, customer accounts, WooCommerce orders), the hack may be a confidentiality incident. For businesses subject to Quebec’s Law 25, the company must then:

• take reasonable measures to reduce the risk of harm;
• assess whether the risk of harm is serious. If so, it must promptly notify the Commission d’accès à l’information and the people concerned;
• record the incident in its register, even without a serious risk. The register must be kept for at least five years.

This is not legal advice: consult a lawyer if needed. See also Quebec’s Law 25: what your WordPress site needs.

Why sites often get hacked again

• The original hole was not fixed.
• A backdoor stayed hidden: a file, an administrator account or a scheduled task.
• The restored backup was already infected.

Prevent rather than clean up

Regular updates, frequent backups stored off the server, a web application firewall, protection against repeated login attempts and monitoring that alerts you quickly when something goes wrong.

At cabana.dev, every hosting plan includes a web application firewall, Fail2Ban against brute-force attacks, uptime monitoring every minute and backups up to every hour. The malware cleanup option adds continuous monitoring and automatic malware removal.

References: WordPress — FAQ My site was hacked · WordPress — Hardening WordPress · WP-CLI — verify-checksums · Google — Security issues report · CAI — Confidentiality incidents (French).