Finding out your site has been hacked is stressful. Acting calmly and in the right order makes recovery much easier. Here is how to spot the signs and what to do next.
Common warning signs
Not every hack is obvious. Some are quiet and go unnoticed for weeks. Look out for these signals:
- Visitors are redirected to unfamiliar websites
- Your browser or search engine shows a warning about your site
- Strange pages or links appear that you did not create
- You cannot log in, or you see admin users you do not recognize
- Your host sends a suspension or malware notice
- Your site suddenly becomes very slow
- Your emails are marked as spam or fail to send
Step 1: Stay calm and do not delete everything
It is tempting to start deleting files at once. Do not. You could remove evidence you need or break the site further. First, take a backup of the current state, even though it is infected, so you have a point to work from.
Step 2: Change your passwords
Change passwords for WordPress admin accounts, hosting, database and any file transfer accounts. Use unique, strong passwords. If you can, do this from a device you trust.
Step 3: Check users and recent changes
Review the list of users in your dashboard and remove any you do not recognize. Look at recently modified files and plugins, since attackers often hide code in places people rarely look.
Step 4: Scan and clean
Use a reputable security scanner to locate infected files. Cleaning properly means replacing WordPress core files with fresh copies, reinstalling plugins and themes from trusted sources, and searching the database for injected code. Hidden backdoors are common, so a surface cleanup often is not enough.
Step 5: Find out how they got in
If you do not close the entry point, the problem will return. The usual causes are:
- An outdated plugin or theme with a known flaw
- A weak or reused password
- Pirated plugins or themes containing malicious code
- An insecure hosting account
Step 6: Harden the site
After cleaning, add protections. Turn on two-factor login, limit login attempts, keep software updated and remove anything unused. Set up regular off-site backups so you can recover quickly next time.
Step 7: Ask for a review if you were flagged
If a search engine or browser marked your site as unsafe, you can request a review once it is clean. This usually removes the warning, though it can take some time.
Prevention is cheaper than recovery
Regular updates, strong passwords and good backups prevent most attacks. If you are dealing with an infection now and want help, our malware removal service handles the cleanup and the hardening afterward.