WordPress Hacked? Signs, Cleanup and How to Catch It Early

A hacked WordPress site rarely announces itself. Sometimes Google shows a red warning or your host suspends the account. More often, the signs are small: a new admin user nobody created, spam pages in Google results, visitors on phones being redirected to another site. The longer it goes unnoticed, the harder the clean-up and the bigger the damage to your search rankings.

This guide covers the signs your WordPress site has been hacked, what to do in the first hour, how to clean it step by step, and how to catch the next attempt early.

Signs your WordPress site has been hacked#

• Unknown administrator accounts under Users, or an admin email you did not set.
• Redirects to spam, gambling or fake pharmacy sites, often only for mobile visitors or visitors coming from Google, so you never see it yourself.
• Spam pages in Google. Search for site:yourdomain.com and look for pages in other languages or about products you do not sell (the "Japanese keyword hack" and pharma hacks).
• Browser or Google warnings: "Deceptive site ahead" or "This site may be hacked" in search results.
• New or changed files, especially .php files inside wp-content/uploads, or unfamiliar files in the site root.
• Unknown scripts in your pages, typically injected into the header or footer.
• Your host suspended the site or reports high outgoing email (your site is sending spam).
• Changed settings: the site address, permalinks or "Discourage search engines" changed without anyone doing it.
• Sudden slowness or high CPU, sometimes from injected crypto miners or spam scripts.

What to do in the first hour#

1. Do not panic, and do not delete things at random. You need evidence to find how they got in.
2. Take a backup of the hacked site as it is now: files and database. It is evidence, and a fallback if the clean-up goes wrong.
3. Change every password: all WordPress administrators, hosting control panel, SFTP, database and the email account tied to the admin.
4. Log everyone out by changing the security keys in wp-config.php (generate new ones at api.wordpress.org/secret-key/1.1/salt/).
5. Put up maintenance mode or ask your host to isolate the site if it is redirecting visitors or serving malware.
6. Tell your host. Many hosts have a security team and server logs that show how the attacker got in.

How to clean a hacked WordPress site#

Option 1: restore a clean backup (fastest, if you have one)#

If you know roughly when the hack happened, restore a backup from before it. Then update everything and change all passwords, because the hole they used is still there in the old copy. Keep orders or posts created since the backup aside so you can add them back. Our WordPress backup guide covers restores.

Option 2: clean it yourself#

1. Scan the site with a security plugin such as Wordfence or Sucuri, or use your host's malware scanner, to list infected files.
2. Replace WordPress core files: from Dashboard > Updates, click Re-install, or upload a fresh copy of wp-admin and wp-includes. Never overwrite wp-content or wp-config.php this way.
3. Reinstall every plugin and theme from clean copies (WordPress.org or the vendor), rather than trying to clean them line by line.
4. Check wp-content/uploads for .php files. Uploads should only contain media; delete any PHP there.
5. Check wp-config.php and .htaccess for code you did not add, such as long encoded strings or redirect rules.
6. Check the database: unknown administrators in the users table, and injected scripts in posts, widgets and the wp_options table (search for "<script" and "eval(").
7. Remove unknown admin users, and reset every remaining user's password.
8. Find and fix the entry point: usually an outdated plugin with a known vulnerability or a reused password. Our guide to WordPress vulnerabilities shows how to check.

Option 3: hire a clean-up service#

If the site makes money or the hack keeps coming back, professional clean-up services (Sucuri, Wordfence, Patchstack, many managed hosts) remove malware and close the hole, often within a day.

After the clean-up#

• Request a review in Google Search Console if Google flagged the site (Security & Manual Actions > Security issues), and remove spam URLs with the Removals tool.
• Check your key pages and checkout work, since reinstalling plugins can change things. If something broke, see our guides to the WordPress critical error and a WordPress plugin conflict.
• Watch for the hack coming back for the next few weeks. Reinfection usually means a backdoor was missed.

How to stop it happening again#

• Keep WordPress, plugins and themes updated, and remove what you do not use.
• Use strong, unique passwords and two-factor login for every admin, and keep the number of admins small.
• Keep off-site backups, and test that you can restore them.
• Use a firewall, from your host, Cloudflare or a security plugin.
• Monitor your site for the changes a hack makes, so you hear about it in minutes.

Know within minutes if your site is changed#

Hacks are changes: a new admin, an injected script, a redirect, a spam page. Spotting them early is the difference between a quick fix and weeks of cleaning up search results. The free MyKavo WordPress plugin watches for exactly that:

• Silent-disaster alerts (free). A new administrator, a changed admin email, a changed site address or permalinks, or "Discourage search engines" switched on: a red notice on every wp-admin screen. Paid plans also get an instant email or Slack alert from MyKavo.
• Script monitoring. MyKavo tracks the third-party scripts on your monitored pages and alerts you when an unknown one appears.
• Page changes with before-and-after screenshots. New content, changed titles, redirects and pages that start returning errors are flagged and ranked by severity.
• Known security issues. Every plan sees how many installed plugins have a known vulnerability; paid plans see which plugin and the version that fixes it.

Summary#

Look for unknown admins, redirects, spam pages in Google, PHP files in uploads and unknown scripts. If you are hacked: back up the hacked site, change every password and security key, then restore a clean backup or reinstall core, plugins and themes from clean copies and remove anything that should not be there. Find and fix the entry point, ask Google to review the site, and set up monitoring so the next attempt is caught in minutes.