If your WordPress site is hacked, act fast: put the site in maintenance, change every password, restore a clean backup, clean and scan, then close the hole. Here’s the step-by-step, without panicking.
The signs of a hack
- Redirects to shady sites (casino, pharmacy, etc.).
- Fake posts or pages you never published.
- A Google warning “This site may be hacked” in the results.
- A slow or unreachable site, or unknown admin logins.
The 6 emergency steps
- 1. Put the site in maintenance to protect your visitors.
- 2. Change every password: WordPress admin, hosting, FTP, database.
- 3. Back up the current state (even infected) for analysis before acting.
- 4. Restore a clean backup from before the hack if you have one.
- 5. Scan and clean with a security plugin (files, database, suspicious accounts).
- 6. Update everything and delete unused or pirated themes/plugins.
Clean without breaking everything
Don’t delete files at random: you risk breaking the site. Target the backdoors (recently modified files, obfuscated code, unknown admin accounts). When in doubt, restoring a clean backup beats tinkering.
Prevent it happening again
A cleaned but unsecured site gets hacked again. Then apply the habits detailed in secure your WordPress site, and set up automatic backups.
When to call a pro
If you have no clean backup, if the infection keeps returning, or if Google has already blacklisted your site, call a professional: a bad cleanup can make things worse.
FAQ
Is my hacked site lost for good?
No. With a clean backup and a proper cleanup, it can almost always be recovered.
How long to restore everything?
From a few hours to a few days depending on severity and whether a backup exists.
Will Google keep showing “hacked”?
Once cleaned, you can request a review in Search Console to lift the warning.
Hacked and need help now? MboaGeek cleans up and gets your site back on track.
