When facing a hacked WordPress site, the response comes down to four steps: isolate the site, measure the extent of the infection, clean the files and the database, then restore a healthy version and fix the original vulnerability.
According to Patchstack (2025), 7,966 new vulnerabilities were recorded in the WordPress ecosystem in a single year, 96% of them affecting plugins.
NEXUS SYNERGY, a WordPress agency with more than 150 sites delivered, walks you through the warning signs of a hack, the hour-by-hour action plan and the habits that prevent it from happening again.
A hacked WordPress site is handled in a precise order: put the site into maintenance mode immediately, change every password, run a full scan of the files and database, clean or restore from a healthy backup, then close the entry point. Acting within the first few hours limits the damage to your visitors, your data and your search rankings.
At NEXUS SYNERGY, an agency specialized in building and maintaining WordPress sites, roughly half of our projects are takeovers of existing sites. And on the sites we take over, the number one cause of hacking is always the same: an unmaintained site becomes vulnerable within a few months. This 2026 guide gives you the complete method, from the first suspicious sign to getting off Google's blacklists.
How do you know if your WordPress site has been hacked?
A hack rarely announces itself with a black screen and a skull. Most attacks aim for discretion instead, because an infected site that stays online keeps earning money for its operator. Some signs are obvious. Others require looking under the hood.
The visible signs are the easiest to spot: your homepage is replaced or defaced, your visitors get redirected to shady sites, or ad popups appear that you never installed. The browser may also display a red "deceptive site" warning, and Google may show "This site may be hacked" directly in its search results.
The discreet signs do more damage, precisely because they go unnoticed for weeks. Here is what we check first when taking over a site:
- Indexed spam pages: hundreds of URLs in Asian characters or promoting pharmaceutical products show up in Google Search Console
- Unknown admin account: a user nobody created appears in the list of WordPress administrators
- Modified files: recent PHP files sit in wp-content/uploads or at the root of the site
- Unexplained slowdowns: the server is grinding because it is sending spam or taking part in attacks
- Sudden traffic drop: Google has blacklisted the site or visitors are fleeing the redirects
A monthly check of these five points catches the vast majority of hacks before they get expensive. If even one of these signs is present, treat the site as compromised until proven otherwise.
Hacked WordPress site: the first moves that change everything
The first two hours determine the scale of the damage. A hacked WordPress site that stays online keeps infecting visitors, spreading spam and destroying your reputation with Google. The absolute priority is isolation, not cleanup.
Classic first mistake: deleting everything in a panic. You destroy the clues that would have revealed the entry point, and sometimes healthy data you can never get back. Keep a cool head and follow this order:
- Put the site into maintenance mode: cut public access through your host or an .htaccess file, to protect your visitors
- Change every password: WordPress accounts, FTP and SFTP, database, hosting control panel, email addresses linked to the site
- Notify your host: their support team can freeze the site, provide access logs and check whether other accounts on the server are affected
- Back up the infected state: a full copy of the files and database will be needed for analysis, but must never replace your healthy backups
- Revoke access: log out every active session and delete any exposed API keys
If the site takes payments or stores personal data, the GDPR also requires you to document the incident and to notify your data protection authority within 72 hours in the event of a data breach. Many site owners have no idea, even though the fine can exceed the cost of the hack itself.
Which sign calls for which action? The prioritization table
Not every symptom of a hack carries the same urgency. A malicious redirect exposes every single visitor, while server slowdowns leave you a few hours of breathing room. This table, built from the incidents we handle on the sites we take over, matches each sign to its severity and the first move to make.
| Observed sign | Severity | Immediate action |
|---|---|---|
| Redirects to shady websites | Critical | Put the site into maintenance mode, notify the host |
| Defaced homepage | Critical | Isolate the site, keep a copy of the infected state |
| Red warning from Google or the browser | High | Clean up, then request a review in Search Console |
| Unknown administrator account | High | Delete the account, change every password |
| Unknown PHP files in uploads | High | Scan with Wordfence, compare against original files |
| Spam pages indexed by Google | Medium | Purge the injected content, regenerate the sitemap |
| Slowdowns and server load spikes | Medium | Analyze the logs, check the site's cron jobs |
The reading is simple: at the first critical sign, the site goes offline within the hour. For medium-severity signs, you can confirm the diagnosis with a scan first, because a slowdown can also come from saturated hosting or a badly coded plugin. When in doubt, treat the sign as one level more severe than its theoretical rating.
How do you clean a hacked WordPress site?
The cleanup targets two things: the site's files and its database. An automated scan with Wordfence or Sucuri is the starting point, because these tools compare every WordPress core file against the originals from the official repository and flag any difference. The free version of Wordfence is enough for this diagnosis.
The scan does not do everything, though. According to Sucuri's reports, about 6 in 10 infected sites contain at least one backdoor, a hidden file that gives the hacker access again after the cleanup. This is why a superficial cleanup is so often followed by reinfection within days.
- Reinstall the WordPress core: replace the wp-admin and wp-includes folders with a fresh copy downloaded from wordpress.org
- Check wp-content: inspect the PHP files in uploads, a folder that should contain nothing but media
- Reinstall themes and plugins: delete anything no longer in use, then re-download the rest from official sources
- Audit the database: look for recently created admin accounts, scripts injected into posts and suspicious options via phpMyAdmin
- Check wp-config.php and .htaccess: these two files are favorite hiding spots for malicious code
When we take over an infected site at NEXUS SYNERGY, this audit phase takes between two hours and a full day depending on the extent of the damage. If you are not comfortable with FTP and databases, handing the cleanup to a professional costs less than a site reinfected three times.
Restore your site and get off Google's blacklists
Restoring from a healthy backup remains the most reliable method, on one condition: the backup must predate the infection. Compare the date of the first suspicious files with your archives, then restore the most recent earlier version. Without a clean backup, the manual cleanup described above becomes the only option, and in extreme cases you rebuild the site on a sanitized foundation.
Restoring is not enough if the original vulnerability stays open. Before bringing the site back online, update the WordPress core, every theme and every plugin, then remove any components abandoned by their developers. Only then reopen the site to the public.
Then there is your reputation. A hack leaves traces in search engines, and erasing them takes a few targeted actions:
- Request a review: in Search Console, under "Security issues", once the site is clean. Google removes the warning within a few days
- Purge the spam URLs: delete the injected pages and let them return a 404 or 410 status code
- Regenerate the sitemap: so Google quickly recrawls the legitimate content
- Monitor indexing: keep an eye on coverage reports and abnormal queries for a month
A prolonged hack can wipe out hard-earned rankings, because Google demotes dangerous sites to protect its users. If your organic traffic is slow to recover after the cleanup, an SEO support program helps repair the damage and win back lost positions.
Why do WordPress sites get hacked?
WordPress powers 43.5% of all websites according to W3Techs (2026). That dominance makes it the most profitable target on the web: a hacker who finds a flaw in a popular plugin can attack hundreds of thousands of sites at once, with fully automated scripts. Your site is never "too small to interest a hacker", because bots do not discriminate.
The entry point is rarely WordPress itself. According to the State of WordPress Security report by Patchstack, 96% of the 7,966 vulnerabilities recorded in one year come from plugins, against 4% for themes and a marginal share for the CMS core. In other words, every plugin you install widens the attack surface.
- Outdated plugins and themes: a patched but unapplied flaw remains exploitable, and hackers scan the web for it the moment it is published
- Weak passwords: brute-force attacks test millions of combinations on WordPress login pages
- Pirated themes and plugins: "nulled" versions downloaded outside official sources very often ship with their own backdoor
- Too many accounts: every unnecessary administrator multiplies the risk of compromise
- Neglected hosting: a poorly isolated shared server spreads the infection from one site to the next
On the sites we take over, these causes almost always combine with one aggravating factor: no maintenance. A site left without updates becomes vulnerable within a few months, and it is the number one cause of hacking we see in takeovers. The vulnerability is not a technical fatality, it is a lack of upkeep.
How do you keep a WordPress site from getting hacked again?
Prevention always costs less than disinfection. A well-maintained WordPress site withstands the vast majority of automated attacks, which specifically target abandoned installations. The recipe is a handful of regular habits, not a miracle tool.
- Weekly updates: core, themes and plugins, with a check of the site after each batch of updates
- Daily offsite backups: stored away from the server and tested regularly, otherwise they only exist on paper
- Hardened authentication: two-factor authentication for every administrator and unique passwords stored in a password manager
- Least privilege principle: every user gets the minimum role required, and inactive accounts get deleted
- Web application firewall and scanner: Wordfence or Sucuri on continuous watch, with alerts whenever a file changes
- Regular housekeeping: removal of unused plugins and inactive themes, which remain exploitable even when deactivated
The real challenge is not knowing this list, it is applying it every week for years. That is exactly what a WordPress maintenance contract is for: at NEXUS SYNERGY, plans start at $150 per month and cover updates, daily backups, monitoring and security patches. Our clients under contract never have to search "hacked site what to do" at 11 p.m. on a Sunday, and that is precisely the point.
Frequently asked questions about a hacked WordPress site
How do I know if my WordPress site has been hacked?
Five signs reveal most hacks: redirects to shady websites, spam pages indexed in Google, an unknown administrator account, recent PHP files in wp-content/uploads and a security warning in the browser or Search Console. A scan with Wordfence or Sucuri confirms the diagnosis by comparing your files against the originals from the WordPress repository. Also check Google's results with the site:yourdomain.com command, because injected content often shows up there before any other visible symptom.
How long does it take to clean a hacked WordPress site?
Count anywhere from a few hours to several days depending on the extent of the infection. A restore from a healthy backup is settled in half a day, vulnerability fix included. A full manual cleanup, with an audit of the files, the database and a hunt for backdoors, takes more like one to three days. Getting off the blacklists adds an external delay: Google usually processes a review request within a few days. On the sites we take over at NEXUS SYNERGY, the initial audit phase lasts between two hours and a day.
Should you delete everything and start from scratch after a hack?
No, not in the majority of cases. A clean restore or a methodical cleanup is enough when the infection is contained and the original vulnerability is fixed. A full rebuild is justified in two situations: a site that keeps getting reinfected despite serious cleanups, or a site so outdated that bringing it up to standard would cost more than a redesign. In that second case, the hack becomes the opportunity to start over on solid ground, with a modern architecture and a maintenance plan from day one.
Does a hacked WordPress site hurt Google rankings?
Yes, and sometimes brutally. Google detects malicious content, displays a warning in its results and can demote or deindex compromised pages to protect its users. Injected spam pages also dilute the site's topical relevance, which drags rankings down even after they are removed. Recovery requires a complete cleanup, a review request in Search Console and the purge of parasite URLs. The longer the hack stays online, the slower the climb back, which is why early detection matters so much.
How much does it cost to fix a hacked WordPress site?
Professional malware removal generally runs from a few hundred dollars to more than $1,500, depending on the extent of the infection and the overall condition of the site. The real cost goes beyond the intervention itself: add the revenue lost during downtime, the SEO damage and the internal time spent on it. By comparison, a WordPress maintenance contract starts at $150 per month at NEXUS SYNERGY, with updates, daily backups and monitoring included. Prevention remains the more profitable option of the two.
How do you protect a WordPress site against hacking?
Protection rests on five pillars: weekly updates of the core, themes and plugins, daily offsite backups that get tested, two-factor authentication on every administrator account, a web application firewall with a file scanner, and the removal of unused components. These habits block the bulk of automated attacks, which target known flaws in unmaintained sites. The hard part is consistency: delegated maintenance guarantees these checks happen every week, even when your business keeps you busy elsewhere.
Your site is showing a suspicious sign, or you want to avoid ever getting there? NEXUS SYNERGY audits your WordPress installation for free (technical, SEO, AI visibility) and hands you a clear action plan within 24 business hours. Contact our team to secure your site for the long run.
