Your WordPress site is hacked. You're seeing spam redirects, Google warnings, or unknown admin accounts. Every hour the infection stays live, it damages your SEO rankings, exposes your visitors to malware, and erodes the trust you've built. Here are the exact steps to take right now, in order, to contain the damage, clean the infection, and prevent it from happening again.
Step 1: Don't Panic — and Don't Delete Anything Yet
Your first instinct might be to delete suspicious files or restore from a backup immediately. Resist that urge. You need to preserve evidence of the infection for forensics — understanding how the attacker got in is the only way to prevent reinfection.
Book a free, no-obligation strategy call and we'll map out your next move.
Take a full backup of the infected site right now. Label it clearly as "infected — [date]" so you never accidentally restore it. This gives you a forensic copy to analyze later and a safety net if the cleanup goes wrong.
Step 2: Change Every Password Immediately
From a clean device (not one that's been accessing the compromised site), change:
- WordPress admin passwords for every user account
- Hosting/cPanel password
- SFTP/SSH credentials
- Database password (update wp-config.php to match)
- Any third-party service API keys stored in the site
Use long, unique passwords generated by a password manager. If you've been reusing the compromised password anywhere else, change those too.
Step 3: Put the Site in Maintenance Mode
If possible, take the site offline or put it behind a maintenance page. This stops the infection from spreading to visitors, prevents Google from crawling more compromised pages, and gives you a clean environment to work in without the attacker's code running actively.
Step 4: Identify the Infection
Before cleaning, you need to know what you're dealing with:
Check your admin users. Go to the database (via phpMyAdmin or WP-CLI) and look at the wp_users table. Any administrator account you don't recognize — especially with random usernames or free email addresses — was created by the attacker. Document them but don't delete yet.
Scan the file system. Look for PHP files in your /uploads/ directory (there should be none), files with recent modification dates that you didn't change, and files with obfuscated code (base64_decode, eval, str_rot13). A security plugin or the Sucuri SiteCheck scanner can help identify known malware signatures.
Check the database. Search for injected spam content — posts you didn't create, especially in other languages or containing pharma/casino keywords. In one recovery we handled, we found over 6,000 injected spam posts the site owner had no idea existed.
Review server logs. Your hosting access logs can reveal the entry point — which file was first accessed, from which IP, and when the attack began.
Step 5: Clean the Infection
Replace WordPress core files. Download a fresh copy of your WordPress version from wordpress.org and replace all core files. Don't touch wp-content or wp-config.php yet — just the core.
Remove malicious files. Delete every file identified in Step 4: rogue PHP files in /uploads/, backdoor scripts, injected code in theme and plugin files. If a plugin file has been modified, replace the entire plugin with a fresh copy from the official repository.