WordPress Site Hacked? What to Do in the First 24 Hours

Finding out your site has been hacked is stressful, and the urge is to start deleting things. Slow down. The order you do things in matters, because a rushed cleanup usually leaves a backdoor behind and the site is reinfected within days. Here is what to do, step by step.

Step 1: Confirm what you are seeing

Not every strange thing is a hack. Analytics often shows visits to odd addresses such as /ml.php or random product-style URLs. Those are usually bots looking for known hacker files, and if the addresses return a "not found" page, nothing is there.

Signs of a real compromise:

• Files you did not put there, especially PHP files with random names.
• Admin users you did not create.
• Visitors redirected to other sites.
• Spam pages or foreign-language titles under your domain in Google.
• A warning from your host or from Google Search Console.

Step 2: Contain it

1. Put the site in maintenance mode if visitors are being redirected or shown spam.
2. Do not delete anything yet.
3. Take a full copy of the files and database as they are. You may need it to find out how the attacker got in.

Step 3: Find the backdoors

Attackers leave a way back in. Common forms are small file manager or shell scripts hidden in places nobody looks. Check for:

• Core files that should not exist. Comparing WordPress against its official checksums lists any extra or changed file in the core folders.
• Loose PHP files directly inside the plugins folder, the uploads folder, or deep inside admin and includes folders.
• Recently changed files you did not change.
• Modified index.php, wp-config.php and .htaccess files.
• Unknown administrator accounts and unfamiliar scheduled tasks.

Step 4: Check every site on the hosting account

This is the step most people miss. On shared hosting, all the sites in one account can usually read and write each other's files. If one forgotten site is infected, it will reinfect the one you just cleaned. Check all of them, including old test and staging copies.

Warning: Do not restore last night’s backup and stop there. If the backdoor was already in place when that backup ran, you restore the hack along with the site.

Step 5: Clean up

• Remove the malicious files. Moving them out of the public folder first, instead of deleting, lets you examine them later.
• Replace WordPress core with a fresh copy of the same version.
• Reinstall plugins and themes from their official sources. Do not trust the copies on the server.
• Delete plugins and themes you do not use.
• Check posts, pages and the database for injected links or scripts.

Step 6: Change every credential

Assume the attacker read your configuration file. Change:

1. The database password.
2. Every WordPress administrator password.
3. Your hosting and FTP passwords.
4. The WordPress security keys, which logs out every existing session.

Then turn on two-factor login.

Step 7: Check the damage in search

Open Google Search Console. Look at the security issues report, and search for your domain to see whether spam pages were indexed. Once the site is clean, request a review if a warning was shown.

Step 8: Stop it happening again

Find the way in if you can. It is most often an outdated plugin, a weak password, or a leftover file. Then follow our guide on how to secure a WordPress site and keep up with a maintenance routine.

When to get help

If you cannot find the source, the infection keeps returning, or the site matters to your income, bring in someone who does this regularly. Our WordPress malware removal service covers the cleanup, the hardening and the search engine follow-up. Book a call or use our contact page.