Skip to main content
WordPress

Has Your Website Been Hacked? A Step-by-Step Emergency Guide

7 min read
wordpress security malware hack recovery
Table of contents

You open your website and something's not right. There's content you didn't put there, it redirects to strange pages, or Google is outright showing a red "unsafe site" warning. If this has happened to you, first things first: don't panic. It can be fixed. But you need to act fast and methodically.

This guide walks you step by step through the entire process: from identifying the hack to getting it cleaned up and protected so it doesn't happen again.

How to tell if your site has been hacked

Not all hacks are obvious. Sometimes your site appears to work normally, but underneath it's sending spam or redirecting users to gambling sites. These are the most common signs:

  • Strange redirects: your site sends visitors to spam sites, online pharmacies, casinos or phishing pages. Sometimes only on mobile or only for visitors coming from Google.
  • Content you didn't create: new pages with text in other languages, pharmaceutical products or suspicious links. If your plumbing website has a section for "buy cheap Viagra", there's a problem.
  • Google warning in search results: "This site may have been hacked" or "This site may harm your computer". This is the worst sign because your potential customers see it before they even visit.
  • Email from your host: many hosts detect malware and alert you or directly suspend your account. If you receive an email from your hosting provider saying they've detected malicious activity, take it seriously.
  • Unknown PHP files on the server: especially in /wp-content/uploads/. That folder should only contain images and documents, never .php files.
  • Your site is much slower than normal: malware consumes server resources. If your site suddenly takes twice as long to load without you having changed anything, investigate.

If Google is showing a red warning ("This site contains malware" or "Deceptive site"), every minute that passes you're losing visitors and reputation. Your site appears marked as dangerous in search results and in Chrome itself. Act now.

Step 1: Don't delete anything yet

The first impulse is to delete everything and reinstall WordPress from scratch. Don't do it without first making a backup of the current state. You need the "crime scene" to understand how they got in and prevent it from happening again. If you delete everything, you lose the clues.

Before touching anything:

  1. Make a complete backup: server files + database. Your hosting probably has a backup tool. Use that copy as "evidence".
  2. Document what you see: screenshots of affected pages, strange URLs, emails from hosting. Everything can be useful for understanding the scope.
  3. If you can, put the site in maintenance mode: this prevents visitors from seeing compromised content while you clean up.

Step 2: Change ALL passwords

Immediately. Not tomorrow, not after investigating. Now. If the attacker has access, every minute that passes they can do more damage.

Passwords you must change:

  • WordPress: the admin password and the passwords of all users with editor role or higher.
  • Hosting / cPanel / FTP: access to the server where your site lives.
  • Database: the MySQL user that WordPress uses to connect.
  • WordPress authentication keys: the secret keys in wp-config.php that manage sessions. By changing them, all active sessions (including the attacker's) are invalidated.
wp-config.php 
// Regenerate these keys at: https://api.wordpress.org/secret-key/1.1/salt/
define('AUTH_KEY',         'your-unique-key-here');
define('SECURE_AUTH_KEY',  'your-unique-key-here');
define('LOGGED_IN_KEY',    'your-unique-key-here');
define('NONCE_KEY',        'your-unique-key-here');
define('AUTH_SALT',        'your-unique-key-here');
define('SECURE_AUTH_SALT', 'your-unique-key-here');
define('LOGGED_IN_SALT',   'your-unique-key-here');
define('NONCE_SALT',       'your-unique-key-here');

Visit the generator URL, copy all 8 lines and paste them into your wp-config.php replacing the existing ones. This closes any open session.

Step 3: Scan and clean malware

Now it's time to find and remove the malicious code. You have several options:

Option 1: Wordfence plugin (free)

Install Wordfence and run a full scan. It can detect modified files by comparing them with the originals from WordPress.org. It shows you exactly which files have been altered and lets you restore them.

Option 2: Sucuri SiteCheck (online, free)

Go to sitecheck.sucuri.net and enter your site's URL. It's an external scan that detects visible malware, blacklisting and anomalies. It's not as deep as Wordfence, but it's a good initial diagnostic.

Option 3: Manual cleanup (advanced)

If you have technical knowledge:

  • Look for .php files in /wp-content/uploads/. There shouldn't be any.
  • Review WordPress core files (wp-admin/, wp-includes/) comparing them with a clean installation downloaded from wordpress.org.
  • Look for suspicious functions: eval(), base64_decode(), gzinflate(), str_rot13(). These are what malware typically uses to obfuscate itself.
  • Review .htaccess in the root and in /wp-content/. Attackers often add redirect rules here.

Step 4: Update EVERYTHING

One of the most common entry vectors is outdated plugins and themes with known vulnerabilities. After cleaning:

  • Update WordPress to the latest version.
  • Update all plugins without exception.
  • Update the active theme.
  • Delete (not deactivate, delete) plugins you don't use. A deactivated but present plugin on the server is still an attack vector.
  • Delete inactive themes. WordPress only needs the active theme. At most, keep a default theme (Twenty Twenty-Five) as a fallback.

Step 5: Review users

Attackers often create hidden administrator users to maintain access even after you change passwords. Go to Users in the WordPress dashboard and check:

  • Are there users you don't recognise?
  • Does any user have an Administrator role who shouldn't?
  • Are there associated emails that aren't yours?

Delete any suspicious user immediately. If you want to be thorough, check directly in the database in the wp_users and wp_usermeta tables looking for entries with wp_capabilities containing administrator.

Step 6: Request review from Google

If Google is showing a security warning in search results, you need to ask them to review your site once it's clean:

  1. Log into Google Search Console (if you don't have an account, create one and verify your property).
  2. Go to the Security Issues section.
  3. Review the problems Google has detected. Make sure you've resolved them all.
  4. Click Request Review and briefly describe what you did to clean the site.
  5. Wait. Google typically takes between 24 and 72 hours to verify.

Until Google removes the warning, your site will continue showing the red alert in search results and Chrome. This is normal and doesn't mean it isn't clean. Google simply needs time to verify. Don't submit repeated review requests: it only slows down the process.

How to prevent it happening again

Cleaning a hack without strengthening security is like fixing the lock without changing the key. These are the essential prevention measures:

  • Keep WordPress, plugins and themes always updated. Most hacks exploit already known and patched vulnerabilities. If you don't update, you're leaving the door open.
  • Use strong, unique passwords. No "admin123" or your pet's name. A password manager like Bitwarden (free) makes life easier.
  • Enable two-factor authentication (2FA). With a plugin like WP 2FA or Wordfence Login Security. Even if someone gets your password, they can't get in without the second factor.
  • Set up automatic daily backups. If your hosting doesn't include them, use a plugin like UpdraftPlus. Backups to an external destination (Google Drive, Dropbox), not on the same server.
  • Install a web application firewall. Wordfence (free) or Cloudflare (free plan with basic protection) block the most common attacks before they reach WordPress.
  • Remove plugins and themes you don't use. Every plugin is a potential entry point. Fewer plugins = smaller attack surface.
  • Use hosting with proactive security. Not all hosts are equal. Some like SiteGround or Kinsta include malware scanning, server-level firewalls and account isolation.
  • Limit login attempts. By default, WordPress allows unlimited attempts. A security plugin or a Cloudflare rule can block brute force attacks.

How much does recovering a hacked site cost?

It depends on the severity. A professional cleanup with full review, malware removal, security hardening and Google review request costs between 300 and 800 EUR depending on complexity.

The alternative? A maintenance plan that includes updates, backups and security monitoring, from 39 EUR/month. It's the difference between paying the fire brigade or paying for insurance.

At Desatranques WEB we offer malware recovery with a complete cleanup guarantee. We find the problem, remove it and harden your site so it doesn't happen again.

WordPress Security Service

Emergency recovery, malware cleanup and proactive protection. Complete cleanup guarantee.

Conclusion

A hack isn't the end of the world if you act quickly and methodically. The steps are clear: don't delete evidence, change passwords, clean malware, update everything, review users and request Google review.

But the best strategy is always to prevent it from happening in the first place. Up-to-date software, strong passwords, daily backups and a configured firewall. If you don't have the time or knowledge to manage it yourself, outsource it. It's an investment that pays for itself the first time it prevents a disaster.