Your WordPress site was hacked: what to do first

Signs it has happened

• Google shows “This site may be hacked” under your name, or Chrome shows a red warning page.
• Visitors are redirected to another website, often only on phones.
• Pages, links or users you did not create appear.
• Your hosting company suspends the account or emails you about malware.
• Your emails suddenly start going to spam.

The first hour, in order

1. Keep a copy of the site and its database as it is now, even infected. It helps find how they got in.
2. Change every password: WordPress admins, hosting, the database, and the email used for those accounts.
3. Remove admin users you do not recognise.
4. Tell your hosting company. Many can help, or can restore a clean backup.
5. Note the date you first saw a problem. It tells you which backups are likely clean.

Cleaning the site

There are two safe routes.

Either way, update everything afterwards and remove plugins and themes you do not use.

Telling Google it is clean

If Google flagged the site, open Google Search Console, look at the Security issues report, and request a review once the site is clean. Google rechecks it and removes the warning if it agrees.

Our Search Console guide explains how to get access if you have never used it.

Making it less likely next time

• Install updates every month, with a backup first.
• Use long, unique passwords, and two step login where you can.
• Give admin access only to people who need it.
• Keep backups somewhere other than your hosting.
• Remove what you do not use.

This is exactly the routine in Website Care. For a site hacked before care starts, the clean up is quoted once as a separate job.