How to detect and recover a hacked WordPress site

If your WordPress site redirects visitors to unfamiliar pages, displays content you did not publish or has unknown administrators, investigate promptly. The priorities are to protect visitors, understand what happened and recover a trustworthy installation.

This guide helps you organize the response even if you are not technical, including what to ask your hosting provider or a specialist. Making the site look normal again is not enough if the attacker’s entry point remains open.

How to tell if your WordPress site has been hacked

These signs warrant investigation, particularly when several appear together.

• Redirects to unrelated domains or advertising you did not authorize.
• Unknown pages, links or content, including spam in search results.
• Administrator accounts, plugins or settings changes nobody on the team recognizes.
• Warnings from browsers, visitors’ antivirus software or your hosting provider.
• Unexpected file changes or suspicious outgoing activity.

Slowness, downtime and login problems can also result from configuration errors, updates or insufficient resources. They do not prove a compromise on their own. Record the affected URLs, messages and when the problem started to help with diagnosis.

What might be happening on the website

An incident can involve several activities. Malware may introduce backdoors or redirects; SEO spam adds pages or links; phishing uses the site to deceive visitors; and a stolen account lets someone act with its owner’s permissions.

These effects do not always reveal the cause. The entry point could have been a vulnerable component, compromised credentials or a hosting issue. Identifying it helps establish what must be fixed to prevent recurrence.

What to do first after a suspected compromise

1. Contact your host or technical lead. Describe the symptoms and ask for help preserving logs and limiting malicious activity.
2. Preserve evidence. Save screenshots, alerts and a timeline. Ask for a copy of the affected files and database for investigation, kept separate from backups considered clean.
3. Contain the incident. Agree on isolation or temporary access restrictions with your provider. A maintenance-mode plugin may hide pages without blocking the attacker’s other access routes.
4. Secure access. From a trusted device, review hosting, WordPress and connected-service accounts, and coordinate revocation of compromised sessions and credentials.

Avoid deleting files at random or immediately restoring over your only available copy. This could remove useful evidence or overwrite recent orders and other changes. The official WordPress guide for compromised sites is an initial reference for documenting the problem and seeking help.

How to assess the scope of the incident

Combine the hosting investigation with checks of files, the database, users and logs. An external scanner only sees part of what the website exposes publicly; it may miss a backdoor that produces no visible content. A result with no alerts does not certify that the entire installation is clean.

Recent changes can guide an investigation, but an unfamiliar filename or timestamp is not enough to classify a file as malicious. Compare components with legitimate copies and distinguish authorized modifications from suspicious activity.

If Google displays a warning, check the Security Issues report in Search Console. Listed URLs may be examples rather than a complete inventory of affected pages.

How to recover the site if you can still log in

Access to the dashboard makes some checks easier, but it does not establish that the environment is trustworthy. Coordinate with whoever is investigating the incident and record the actions taken.

1. Review users, permissions and unfamiliar access before removing accounts confirmed to be unauthorized.
2. Identify affected components and replace compromised files with legitimate versions; also check database content and settings.
3. Fix the entry point and remove any persistence mechanisms discovered.
4. Rotate affected credentials and invalidate relevant sessions. Credentials changed while the environment was still compromised may need changing again after cleanup.
5. Test essential functions and maintain monitoring before closing the incident.

A plugin may assist an investigation, but installing several does not amount to a complete cleanup. Our WordPress security plugin comparison explains the roles and limitations of these tools.

What to do if you cannot access the dashboard

Contact your host through its usual support channel and verify account ownership. Ask for access to logs, isolation options and help regaining control. You do not need to start by editing passwords in phpMyAdmin or deleting unfamiliar files.

If recovery requires SFTP, database or server configuration work, involve someone with the relevant experience. Keep a record of what was replaced, which access was revoked and which cause was corrected.

When to restore a backup

A backup created before the first visible symptoms may already contain the infection. Check its origin and whether it represents a clean state before using it. Where possible, test it in an isolated environment.

Restoring a database can overwrite orders, user registrations or posts created after the backup. Agree how recent data will be preserved, and fix the vulnerability or compromised access before exposing the site again.

Our WordPress backup guide can help you prepare for recovery. Backups help recover data, but they do not explain how the attacker gained access.

What to check before declaring recovery complete

• The identified cause is fixed and affected components have trustworthy versions.
• Users, permissions, sessions and credentials have been reviewed.
• The known redirects, spam and suspicious changes have not reappeared.
• Logins, forms, emails and payment flows used by the site work correctly.
• A new backup of the recovered state exists and someone is reviewing alerts and logs.

If personal or payment information may have been accessed, also escalate to the appropriate person to assess the impact and any necessary communications.

How to reduce the risk of another compromise

Use supported software, apply security patches, remove unnecessary components and give individual accounts the minimum permissions they need, with two-factor authentication. Review the hosting environment and the devices used to administer the sites as well.

Modular DS helps centralize WordPress maintenance, including updates, backups, known-vulnerability alerts and monitoring. It supports ongoing follow-up after recovery, but it does not replace incident investigation or professional cleanup.

Frequently asked questions

Does an SSL certificate prevent WordPress hacks?

HTTPS protects the connection between the browser and server. It does not fix vulnerable plugins or prevent the use of stolen credentials, so it needs to be combined with other controls.

What is the difference between a security plugin and a firewall?

A plugin may combine scanning, access controls and other functions. A firewall filters requests according to its rules and may run in the cloud or within the hosting environment. Neither guarantees detection and removal of every trace of a compromise.

What if Google marks my website as dangerous?

Check the Security Issues report, resolve the problems across the site and request a review after completing the corrections. Explain the actions taken. Removing the warning depends on the review and is not immediate; Google describes the process in its documentation on deceptive content.

How long does recovery take?

It depends on the scope, available access and backup quality. Bringing a page back online may be quick, but investigation, cleanup and verification are separate work. Ask for an estimate based on the diagnosis rather than a generic guarantee.

Why might the site be hacked again after cleanup?

A backdoor, compromised credential, vulnerable component or problem elsewhere in the environment may remain. Review the cause with your host or a specialist rather than repeating the same restoration without investigating.