WordPress Site Hacked? What to Do in the First Hour

If your WordPress site is hacked, the first hour matters more than the next week. The order is: contain the damage, collect the evidence, clean with something you can undo, then close the entry point. Skip the last step and you will be back here in a month. This guide walks the list in the order a cleanup actually works, for a normal site owner with no server background.

Step 1: Contain it before you investigate

Stop the bleeding first. Change your WordPress admin password, your hosting control panel password, your FTP or SFTP password, and the database password if you know how. Use a password manager and make them long.

Then log everyone out. In WordPress, changing the keys and salts in wp-config.php invalidates every session at once. Most hosts also offer a “log out all users” button. Attackers often keep a logged-in session alive even after you change the password, so this step is not optional.

If the site is redirecting visitors to spam or serving malware, put a maintenance page in front of it. Your host can do this, or a one-line rule in .htaccess. A site that is down for an hour costs less than a site that gets its domain blacklisted.

Step 2: Look for the obvious footholds

Before any scanning, check three places attackers love:

Users. Go to Users in the admin and sort by role. Any administrator you did not create is a problem. Delete it and attribute its content to your own account. Check the email address on your own admin account too; attackers change it so they can reset the password later.

Plugins and themes. Look for anything you did not install, especially with generic names like “wp-core-helper” or a single-letter folder. Deactivate and delete. An inactive theme is still a place to hide code, so remove unused themes as well.

Scheduled tasks. Injected code often re-creates itself from a scheduled event. A cron viewer plugin or WP-CLI shows every scheduled hook. Names you do not recognise, running every minute, deserve a close look.

Step 3: Scan and read the evidence

Now scan the files and the database. The point of a good scan is not a red “infected” badge. It is evidence: which file, what pattern, and why it was flagged, so you can decide instead of guessing.

A scanner that verifies files against the official copies does most of the work. WordPress core and every plugin and theme from WordPress.org have published checksums. A file that does not match its official version has been changed, and that short list is where the infection lives. DevDome Malware Scanner does this verification, checks PHP for backdoor and webshell patterns, inspects uploads for PHP disguised as images, and looks inside the database for injected scripts and hidden links. Scanning, quarantine and eligible repairs work without an account, and a free account adds a larger signature set. We make it, so weigh that; the method matters more than the tool.

Whatever you use, read each finding. “Modified core file” with a diff is actionable. A vague “suspicious” with no evidence is not.

Step 4: Clean without deleting the wrong thing

Quarantine beats delete. Move flagged files to a quarantine folder where they cannot execute, then check the site still works. If something breaks, restore the file and look again. Deleting on a hunch is how a cleanup turns into a rebuild.

For modified core, plugin or theme files from WordPress.org, repair means replacing them with clean official copies. For premium or custom code there is no official copy, so compare against your own backup or the vendor’s download.

Clean the database too. Injected scripts hide in post content, widgets, options and user metadata. Search for script tags, iframes and base64 strings that should not be there.

Finally clear every cache: the plugin cache, the server cache and the CDN. A cached copy of the infected page will keep serving malware after the files are clean.

Step 5: Find and close the entry point

This is the step most guides skip and the reason sites get reinfected. Ask how they got in:

• An outdated plugin or theme with a known vulnerability. Update everything, and remove plugins you no longer need.
• A weak or reused password. Enforce strong passwords for every account with publish or admin rights.
• A compromised computer or FTP client with saved credentials. Run a malware scan on your own machine.
• A neighbouring site on the same hosting account. One infected site can write into another’s folders if permissions allow.

An activity log helps here. If you can see which account logged in from where and what it changed, the timeline usually points at the door. Turn one on now, even if it is late for this incident, so the next one is easier to trace.

Step 6: Recover your reputation

If Google flagged the site, go to Search Console, open Security Issues, and request a review once the site is clean. Reviews usually take a few days. Check your domain on blocklists if email started bouncing, and tell your host you have cleaned up so they lift any restrictions.

Then set a reminder. Rescan in a week. Reinfection checks catch the cases where you missed a file, and a quiet second scan is a lot cheaper than a second incident.

What to keep doing afterwards

Weekly scheduled scans, automatic updates for plugins you trust, a strong password policy, two-factor authentication for admins, and a log of logins and changes. None of this is exciting. All of it is cheaper than the hour you just spent.

Related reading: Wordfence Alternative: Lighter Security Without the Firewall Overhead.