My WordPress Site Was Hacked: What to Do in the First Hour
Short answer: in the first hour, don’t delete anything, change every password, put the site into maintenance mode if it is harming visitors, and check whether you have a clean backup. Then get the site properly cleaned, because hacks that are only patched on the surface usually come back.
Seeing your website redirect to a betting page, show strange text, or get flagged by Google is stressful. The good news is that almost every hacked WordPress site can be recovered. What you do in the first hour decides how quickly. If you’d rather hand it over, our WordPress malware removal service does exactly this.
| Time | What to do | Why |
|---|---|---|
| Minutes 0–10 | Confirm the hack and take screenshots | Evidence for the clean-up and your host |
| Minutes 10–20 | Change all passwords | Lock the attacker out |
| Minutes 20–30 | Contact your host and developer | They can see server logs and isolate the site |
| Minutes 30–45 | Find your latest clean backup | Gives a fallback |
| Minutes 45–60 | Plan the clean-up and tell customers if needed | Protects trust |
Signs your WordPress site has been hacked
- Redirects to gambling, adult or fake prize pages, often only on mobile or only from Google.
- Spam pages in Google results for your domain in other languages or selling unrelated products.
- Warnings from Google, your browser or your host.
- New admin users you didn’t create.
- Emails bouncing or your domain being flagged for spam.
- A sudden slowdown with no other explanation. See why a WordPress site gets slow.
Step 1: Don’t panic and don’t delete files
It’s tempting to start deleting anything that looks odd. Don’t. You may delete evidence that shows how the attacker got in, or break the site further. Take screenshots of what you see, note the time, and write down any recent changes such as a new plugin or a new staff login.
Step 2: Change every password
Change the passwords for all WordPress admin users, the hosting control panel, FTP or SFTP accounts, the database and the email account linked to the site. Use long, unique passwords. Remove any admin users you don’t recognise. If your team shares one login, this is the moment to stop.
Step 3: Contact your host
Your hosting provider can see server logs, may already have detected the infection and can sometimes isolate the site so it doesn’t affect others or send spam. Ask them whether they have a recent clean backup and how far back it goes.
Step 4: Protect your visitors
If the site is redirecting people or trying to install something on their phones, put it into maintenance mode or take it offline temporarily. A few hours offline is better than customers being sent to scam pages under your name.
Step 5: Find a clean backup, but be careful
Restoring a backup can be the fastest fix, but only if the backup is from before the hack and you also close the hole the attacker used. Otherwise you will be hacked again within days. Many hacks sit quietly for weeks before anyone notices, so the newest backup may already be infected.
Step 6: Clean, patch and harden
A proper clean-up means scanning every file and the database for malicious code, replacing WordPress core, theme and plugin files with fresh copies, removing backdoors, updating everything, and closing the original entry point, which is often an outdated plugin or a weak password. Then harden the site: limit login attempts, add two-factor login for admins and set up monitoring.
Step 7: Ask Google to review the site
If Google shows a warning or has indexed spam pages, use Google Search Console to request a review once the site is clean, and remove spam URLs. Rankings usually recover once the spam is gone.
How to stop it happening again
Most hacks we clean come from outdated plugins, nulled (pirated) themes and reused passwords. Keep everything updated, use only licensed themes and plugins, give each person their own login, and keep off-site backups. Our WordPress maintenance care plans cover updates, security monitoring and support for KES 60,000 (USD 600) a year. Read what a care plan should include.
We’ve worked on WordPress since 2012 and on 1,200+ projects, and we’re rated 5.0 on Google.
Frequently asked questions
How do I know if my WordPress site has been hacked?
Common signs are redirects to spam sites, strange pages in Google, browser or Google warnings, unknown admin users and a sudden slowdown.
Should I delete my hacked WordPress site and start again?
Usually not. Most sites can be cleaned and secured. Deleting it loses content and evidence, and the same weakness can affect a new site.
Can I just restore a backup?
Only if the backup is from before the infection and you also fix the weakness the attacker used. Otherwise the hack often returns.
How long does it take to clean a hacked site?
Many sites are cleaned the same day or the next. Heavily infected or very large sites take longer.
Will my Google rankings recover?
Usually, once the site is clean, spam pages are removed and Google has re-crawled the site.
Need a hacked site cleaned now?
Call or WhatsApp us with your web address and what you’re seeing. We’ll tell you what to do straight away. During working hours (Monday to Friday, 8am to 6pm EAT) we reply within minutes on phone or WhatsApp at +254 705 828 000.
Prefer it in writing? Request a quote.
Written by Vincent Ochieng, founder of Butterfly Prime Solutions (since 2012). Last updated: 26 October 2026.
