WordPress site hacked: what to do in the first hour

WordPress site after a hack, browser warning screen and tools to remove malicious code

How to spot a breach

The site redirects to foreign sites (casinos, pharma, "you won a phone"), often only on mobile or only from Google results, so the owner browsing from a bookmark sees nothing.
Google shows results from your domain in Japanese, with pills or shoe brands, on pages you never created.
The browser shows a red screen "This site may be dangerous", and Search Console sends a notification in the "Security Issues" report.
Hosting suspended the account or sent a list of files with malicious code.
In the WordPress dashboard there is an admin user that no one added, or a plugin with a name resembling a system one.
The site sends spam: suddenly hundreds of emails from your domain, and your regular messages start landing in spam.
The site suddenly slows down or the server reports high CPU usage: a script mining cryptocurrency or launching attacks on other sites.

First hour: eight steps

Don’t delete anything blindly. First, make a full copy of files and database in its current state. The copy is needed to analyze how they got in and in case cleaning breaks something.
Change passwords: for the WordPress admin (all admins), FTP/SFTP, the database (update wp-config.php), and the hosting panel. If the same password was used elsewhere, change it there too.
Check the user list. Remove unknown administrators. Verify email addresses of known accounts, as the attacker often swaps the email to reset passwords.
Compare files with a clean version. The WordPress core, themes and plugins from the official repo can be compared file‑by‑file with the original. Any difference is suspicious. Tools: WP‑CLI (wp core verify-checksums, wp plugin verify-checksums --all) or a scanning plugin.
Find files that shouldn't be there: PHP files in the uploads folder, randomly‑named files in the root folder, a modified .htaccess with redirects, code in wp-config.php outside the configuration. Search by recent modification dates and by common functions (base64_decode, eval) in files where they don't belong.
Check the database: options table (site URL, active plugins), post content with scripts, users table.
Update everything: WordPress, theme, plugins, PHP on the host. Remove plugins and themes you don't use, even if inactive; an inactive plugin with a vulnerability is still a file on the server.
Verify from outside: open the site in incognito on a phone and from Google search results, check the security report in Search Console, scan with an external scanner.

How to remove a Google warning

When Google detects malicious code or spam on your site, the Search Console "Security Issues" report shows a description and example URLs. After cleaning the site you submit a review request with a brief note of what was fixed. Google usually processes it within a few days. The browser warning disappears after a successful verification. If the breach added thousands of spam pages, they should return a 404 or 410 after cleanup; Google will eventually drop them from the index, and manually removing them in Search Console speeds up the process for the most important URLs.

Where they usually come from

From the data we see during cleanup, in the overwhelming majority of cases it’s one of four paths:

Out‑of‑date plugin or theme with a publicly known vulnerability. Bots scan the web for specific versions and exploit them automatically, without human involvement. The most common cause.
Weak admin password or an "admin" login with a leaked password.
“Premium for free” theme or plugin downloaded from an unofficial source, with a built‑in backdoor.
Another site on the same hosting account, previously infected. On shared hosting, one site’s files can access another’s.

Post‑cleanup security

WordPress.org publishes a guide to securing installations. From it and from practice comes a short list that stops most automated attacks:

Core security auto‑updates enabled; plugins and theme updated at least once a week.
Two‑factor authentication for admins, login attempt limits, username other than "admin".
File editing from the dashboard disabled (DISALLOW_FILE_EDIT), PHP execution in the uploads folder blocked.
One site per hosting account or account isolation.
Off‑site backups daily, with a restore test once per quarter.
Monitoring: someone or something checks the site regularly, because most breaches are noticed by owners weeks later when traffic from Google drops.

What to tell clients and what about privacy law (GDPR / Privacy Act)

If the site has a contact form, user accounts or a store, a breach can expose personal data such as names, email addresses, phone numbers, order histories. Privacy law (GDPR / Privacy Act) requires an assessment of whether a data protection breach occurred and, if so, reporting to the relevant authority within 72 hours of discovery, and, when the risk to individuals is high, notifying the affected people. This is not legal advice, just a reminder that cleaning the site does not close the issue if customer data was stored.

Practically: keep a copy of the infected site (step 1 from the list above) as evidence, note when the breach was noticed and what was found, check server logs for database access or table export. If the store kept customer passwords (WordPress stores them as hashes, not in plain text, but hashes can be cracked), after cleaning force a password reset for all users. The notice to customers should be short and factual: what happened, what data may have been affected, what you did, what the customer should do (change password, watch out for suspicious emails). It’s better to write it yourself before customers see a warning in their browser.

How much does cleaning cost

Our WordPress site cleaning after a hack costs at a reasonable rate per site, pricing on the WordPress emergency page. Included: backup before work, removal of malicious code from files and database, WordPress core, theme and plugin updates, password and key changes, reporting to Google if the site received a warning, and a list of security measures to implement. If after cleaning you want someone to continuously look after the site, the Care packages start at C$119/month and include updates, backups and monitoring. Stand‑alone availability monitoring, without care, is a modest monthly fee.

If the site has been cleaned several times and the infection returns each time, it usually means there’s a backdoor in the theme or plugin or another infected site on the same account. In that case it’s cheaper to rebuild the site from clean files and move only the content, rather than clean it a fourth time.

Frequently asked questions

The site redirects to another site only on mobile. Is this a hack?

Almost certainly yes. Malicious code often checks whether the visitor is on a phone or coming from Google results, and only then redirects, so the owner browsing from a desktop tab sees nothing.

Is restoring a backup enough?

Only if the backup is from before the breach and you know how they got in. Restoring a copy with the same vulnerable plugin leads to reinfection within days. After restoring, update everything and change passwords.

How long does Google remove the "This site may be dangerous" warning?

After cleaning the site and submitting a review request in Search Console it usually takes a few days. If Google finds leftover malicious code, it rejects the request and you need to clean again.

Will I lose rankings in Google after a hack?

During the warning, traffic from Google drops almost to zero because users avoid the flagged site. Once the warning is removed, rankings usually recover within a few weeks, provided the spammy pages have been removed.

How much does it cost to remove a virus from a WordPress site?

With us at a reasonable rate for one site, including a backup before work, updates, password changes and a Google report. Ongoing care with updates, backups and monitoring from C$119/month.

Sources of prices and data

Market prices are indicative data from the listed sources, checked 8.10.2026. Our prices come from the current cansitelab.pro price list and are final.

Cleaning after a hack for a reasonable rate →

WordPress site hacked: what to do in the first hour and how to prevent a repeat