Your WordPress site is hacked. Here is exactly what to do in the first hour (and what not to do).

11,334 new vulnerabilities were found in the WordPress ecosystem in 2025 - a 42% increase over 2024. If your site gets hacked, panic is normal. But the actions you take in the first hour determine whether recovery takes hours or weeks. Here is the exact sequence, based on real cleanup work.

Step 1: Isolate (do this first)

Before you change anything, put the site in maintenance mode. This stops the hack from spreading, stops Google from flagging your site as compromised in search results, and stops visitors from seeing malicious content.

If you have a maintenance plugin (like SeedProd or WP Maintenance Mode), enable it. If not, add this to your .htaccess file to redirect all visitors to a static page:

RewriteEngine On
RewriteCond %{REMOTE_ADDR} !^YOUR_IP_ADDRESS$
RewriteRule .* /maintenance.html [R=503,L]

This lets only you (from your IP) access the site, while everyone else sees a 503 Service Unavailable response. Google treats 503 as temporary and will not penalize your rankings.

Step 2: Preserve evidence (before you delete anything)

The instinct is to delete the malicious files immediately. Do not. You need to understand how the attacker got in, or they will be back tomorrow.

• Screenshot everything: the hacked homepage, any error messages, the browser console, any suspicious admin users.
• Save access logs: download your server access logs (from cPanel, or /var/log/nginx/access.log on a VPS). Look for suspicious POST requests, unusual user agents, or logins from unexpected IPs.
• Note the symptoms: is it redirecting to another site? Showing spam links in the footer? Sending phishing emails? The symptom tells you what type of hack it is.

Step 3: Change all passwords (yes, all of them)

The attacker may have stolen credentials. Change, in this order:

• WordPress admin password (for every admin user)
• Database password (in wp-config.php)
• Hosting control panel password (cPanel, Plesk, etc.)
• FTP/SFTP password
• SSH password (if applicable)
• API keys for any connected services (SMTP, payment gateways, etc.)

Use a password manager (Bitwarden, 1Password) to generate strong, unique passwords. Do not reuse any password.

Step 4: Remove rogue admin users

Hackers often create a backdoor admin account so they can get back in even after you change passwords. Check Users → All Users in WordPress admin. Look for:

• Admin accounts you did not create
• Accounts with unusual usernames (random strings, numbers)
• Accounts created recently (sort by registration date)

Delete any rogue admin accounts. But first, check what they changed - look at their activity in the database (wp_users table, user_registered column).

Step 5: Scan and remove malware

Now you can remove the malicious code. Two approaches:

Option A: Security plugin scan (for simple hacks)

Install Wordfence or Sucuri Security (both have free versions). Run a full scan. The plugin will identify:

• Modified core files (compare against official WordPress repository)
• Known malware signatures in themes and plugins
• Suspicious PHP code (eval, base64_decode, gzinflate)
• Backdoor files (often named like wp-config-sample.php or hidden in /wp-content/uploads/)

Delete or restore every flagged file. Wordfence can repair core files automatically by downloading clean copies from WordPress.org.

Option B: Manual cleanup (for stubborn hacks)

If the plugin scan does not catch everything (or the hack returns), you need to go manual:

• Download a fresh WordPress copy from wordpress.org and replace all core files (wp-admin/, wp-includes/, root PHP files) except wp-config.php.
• Reinstall all plugins and themes from their official sources. Do not keep any downloaded-from-suspicious-source plugins.
• Check .htaccess for malicious redirects (a common trick: one line that redirects mobile visitors to a spam site).
• Check wp-config.php for injected code (often at the top or bottom, using eval or base64_decode).
• Check functions.php in your theme - this is the most common place for backdoor code.

Step 6: Restore from backup (the nuclear option)

If the hack is deep, or you cannot find all the backdoors, the cleanest option is to restore from a known-clean backup. This is why backups matter.

The problem: if your last backup is from before the hack, you lose recent content. If your backup was taken after the hack, it contains the malware. You need a backup from before the hack started - which means you need to know when the hack started (check access logs for the first suspicious activity).

Step 7: Harden (so it does not happen again)

Cleaning the hack is not enough. If you do not fix how they got in, they will be back. Common entry points:

• Outdated plugins or themes - update everything. Delete plugins you do not use (do not just deactivate them - delete the files).
• Weak passwords - enforce strong passwords for all admin users.
• Nulled (pirated) plugins or themes - these often contain pre-installed backdoors. Never use them.
• Exposed wp-config.php - add deny from all in .htaccess to protect it.
• No SSL - without HTTPS, credentials can be intercepted. Use Let's Encrypt (free).
• Default wp_ database prefix - if you installed with the default prefix, attackers know your table names. (Changing this after the fact is complex - do it on the next migration.)

Install a Web Application Firewall (WAF). Cloudflare's free plan blocks many automated attacks. Wordfence and Sucuri include firewall features in their premium tiers.

Step 8: Request review from Google

If Google flagged your site as compromised (you will see a "This site may be hacked" warning in search results, or a red screen in Chrome), you need to request a review in Google Search Console:

• Go to Search Console → Security Issues
• Confirm you have cleaned the hack
• Click "Request a review"
• Google will re-scan your site, usually within 24-72 hours

If you skip this step, the warning stays in search results and your traffic drops to zero - even after the hack is gone.

The mistake that makes it worse

Deleting the visible hack without finding the entry point. The attacker returns within 48 hours.

Most site owners see the hack, delete the spam links or the redirect, and think it is fixed. But if a backdoor file is still in /wp-content/uploads/ or a rogue admin account still exists, the attacker comes back. The cleanup is not done until you have found how they got in and closed that door.

If your site is hacked and you need it cleaned properly - including finding the entry point and hardening so it does not recur - message @wpservicelab on Telegram with "HACKED" in the first line. Emergency same-day cleanup available.