How do I recognise that WordPress was hacked?

Typical signs are unwanted redirects to foreign sites (often only for visitors from Google or only on mobile), injected spam or foreign posts, a warning in Google Search Console, unknown administrator accounts, new files with cryptic names, and a sudden spike in resources or traffic at your host. Often several of these symptoms appear together.

What should I do first when WordPress is hacked?

Stay calm and don't panic-delete files. First make a full backup of the current, infected state (files and database) as a reference and evidence. If there's active damage, take the site offline via maintenance mode or a block, change the passwords, and then scope the extent calmly before you clean up.

Can I just remove a hack with a plugin?

A security scanner helps find and scope the infection, but a full cleanup is more than one click. Core, themes and plugins belong reinstalled from clean original sources, the database checked, and above all every backdoor found. If one hidden backdoor remains, the hack returns – which is why a pure plugin scan is rarely the whole solution.

Why does the hack come back after cleanup?

Two reasons: either the original vulnerability (usually an outdated plugin) wasn't closed, or one of several backdoors was missed. Attackers often plant multiple hidden entry points. A cleaned site that leaves the same hole open or keeps a backdoor gets reliably reinfected – which is why closing the cause and finding all entry points is mandatory.

WordPress Hacked? Recognising and Cleaning Up Malware

A hacked WordPress site is unpleasant, but rarely hopeless. The key is a calm, structured approach – panicked deleting often makes it worse. Here’s how to recognise, clean up and secure the site.

How to Spot a Hack

Unwanted redirects to foreign sites, often only for visitors from Google or only on mobile.
Foreign content or spam (e.g. strange posts, injected links in the footer).
A warning in Google Search Console or “This site may harm your computer” in the search results.
Unknown admin users or new files with cryptic names.
A sudden spike in resources or traffic at your host.

Immediate Steps During Active Damage

If the site is actively redirecting visitors or serving malicious code, damage control comes first: take the site offline temporarily via maintenance mode or a server-side block, change all passwords (WordPress admins, hosting, FTP, database), and reset the security keys in wp-config.php – that throws out all of the attacker’s active sessions. Only then does the actual cleanup begin.

1. Back Up First, Then Work

Make a full backup of the current (infected) state – files and database. It sounds paradoxical, but it matters: it serves as a reference if something working is lost during cleanup, and as evidence.

2. Scope the Damage

Use a security scanner (e.g. Patchstack, Wordfence) or look server-side for suspicious files.
Sort recently changed files by modification date via FTP – malicious code often gives itself away with an unusual date.
Check typical hiding places: PHP files in the /wp-content/uploads/ folder (no executable code belongs there), a manipulated .htaccess, hidden entries in mu-plugins.
Determine which known vulnerability was exploited (often an outdated plugin).

3. Clean Up

Replace core, themes and plugins: reinstall the WordPress core, and reinstall themes/plugins from clean original sources instead of “repairing” individual files.
Remove unknown admin users and reset all passwords plus the security keys in wp-config.php (harden wp-config.php).
Check the database for injected content (suspicious options, spam in posts).
Find backdoors: hacks often leave several hidden entry points. Miss one and the hack returns.

4. Secure It So It Doesn’t Come Back

A cleaned site that leaves the same hole open gets reinfected. So this includes:

Updating everything (core, plugins, themes, PHP).
Securing the login and removing unnecessary plugins.
Setting up a clean, tested backup – but never restoring an infected one.
Requesting a re-review via Search Console if Google flagged the site.

Running regular maintenance catches most vulnerabilities before they can be exploited → What WordPress Maintenance Really Covers.

When Customer Data Is Affected

If you run a shop or process personal data and there’s a suspicion it was leaked, a data breach can be notifiable under Article 33 GDPR – often within 72 hours. This isn’t legal advice; the binding assessment belongs to your data protection officer. What matters is taking the suspicion seriously and not letting it slip through the cracks during the technical cleanup.

Honestly: When to Get Help

If you can’t find the source, the hack returns after cleanup, or it’s a shop with customer data – then professional help is the faster and safer route. An incomplete cleanup is more dangerous than none, because it feigns security.

Your site is affected and you want it cleaned up safely and completely: drop us a line – we’ll clean it, close the hole and harden it.