WordPress Site Hacked? Here's Exactly What to Do (2026 Emergency Guide)

The email usually reads something like: "Google says my site is dangerous and customers are calling." By the time a hack is visible — redirects to spam sites, Google warnings, pharma spam in search results — it's been there for weeks. The good news: almost every hacked WordPress site is recoverable. The bad news: most people make it worse before they call me.

Here's the exact sequence I follow on every hacked-site job. Do it in this order.

Step 0: Don't do the obvious wrong things

• Don't delete random files. You'll break the site without removing the hack — malware hides in places you won't look.
• Don't just reinstall WordPress core. Core is rarely where the malware lives. It's in plugins, themes, uploads, and the database.
• Don't change all passwords yet. If there's a backdoor, the attacker just reads the new passwords. Clean first, then rotate credentials.
• Do take the site offline or into maintenance mode if it's redirecting visitors to spam. Every hour it stays up, Google trusts you less.

Step 1: Contain (30 minutes)

Put the site in maintenance mode. If your host offers it, ask them to confirm whether the server is compromised or just the site — on shared hosting, that distinction matters. Take a full backup of the infected site before cleaning (yes, infected — you want a snapshot in case something goes sideways).

Step 2: Find the entry point

Nine times out of ten, it's one of these:

• An outdated plugin or theme — the #1 cause, by a mile. Check what's out of date and check those against known vulnerability databases (wpvulndb.com).
• A nulled (pirated) plugin or theme — I find these constantly. "Free" premium plugins are the most expensive software you'll ever install.
• Weak admin credentials — "admin" username, reused password, no 2FA.
• An old backup or staging copy left publicly accessible.

Finding the entry point matters because cleaning without closing it means you'll be cleaning again next month. I always tell clients: the cleanup is the easy part; the entry point is the actual job.

Step 3: Clean properly

1. Scan with Wordfence or Sucuri (free tiers work for diagnosis).
2. Replace all core files, themes, and plugins with fresh copies from wordpress.org or the vendor. Don't try to surgically remove malware from plugin files — replace them.
3. Check wp-content/uploads for PHP files (there should be none — uploads should only contain media).
4. Check the database: wp_users for unknown admin accounts, wp_options for suspicious entries, posts for injected spam links.
5. Look for backdoors: files with names like wp-logln.php, class.api.php, or anything recently modified that you don't recognize.

Step 4: Harden so it doesn't happen again

• Update everything, delete unused themes and plugins (inactive code is still attack surface).
• Strong unique passwords + 2FA on every admin account. Non-negotiable.
• Limit login attempts, change the login URL or add CAPTCHA to it.
• File permissions: 644 for files, 755 for directories. Never 777.
• Daily off-server backups going forward — this is the lesson the hack was trying to teach you.

Step 5: Get Google to trust you again

If Google flagged the site ("Deceptive site ahead"), clean first, then request a review in Google Search Console under Security Issues. Reviews typically take 1–3 days. Don't request it before the site is actually clean — a failed review resets the clock.

When to hire this out

Honestly? Most of the time. Malware cleanup done wrong leaves backdoors, and a backdoor you missed means the whole thing repeats. If the site earns money, if customer data is involved, or if you've already tried cleaning once and it came back — get a professional. I charge a flat fee for hacked-site recovery: full cleanup, entry point identified and closed, hardening, and the Google review handled.

Get your site cleaned now

Hacked sites get worse with time — Google penalties deepen and reinfection spreads. Don't wait.

• Emergency? WhatsApp me now (fastest response): Chat on WhatsApp
• Share your project brief: fysalyaqoob.com/contact#contact-form
• Prevent the next one: WordPress maintenance plan — $100/mo