WordPress hacked? Act in this order: tell your host, change every password (hosting, SFTP, database and all WordPress admins), and save a copy of the hacked site for later. Then clean it, either by restoring a backup from before the hack or by reinstalling WordPress and every plugin from official sources. Finally, find and fix how the attacker got in, usually an old plugin, theme or PHP version, or Google will flag you again.
Most hacked small business sites can be fully recovered. Below is the step-by-step plan we follow, written for owners who are not technical.
- Signs of a hack include spam redirects, strange Japanese or pharmacy pages in Google, new admin users you did not create, and a “This site may be hacked” label under your link.
- In the first hour: contact your host, change all passwords, and back up the hacked state before you touch anything.
- Restoring a clean backup is the fastest fix. If you have none, reinstall core, plugins and themes from official sources, then scan.
- Plugins are the main way in: 91% of new WordPress vulnerabilities found in 2025 were in plugins (Patchstack, 2026).
- Google removes its hacked warning only after you clean the site and request a review in Search Console.
How to tell if your WordPress site has been hacked
Hacks are not always obvious. Many attackers want your site to look normal to you while it quietly sends visitors or Google somewhere else. Watch for these signs:
- Spam redirects. Visitors, especially on phones or arriving from Google, get sent to a scam, casino or pill site. This “WordPress hacked redirect” often skips logged-in admins, so ask a friend to test it on mobile data.
- Japanese or pharma spam in Google. Search site:yourdomain.com. Pages in Japanese, or pages selling pills, fake designer goods or casinos, mean someone added spam pages. Google has a guide to this exact problem, the Japanese keyword hack.
- New admin users. Go to Users in your dashboard and filter by Administrator. Any account you do not recognise is a red flag.
- “This site may be hacked” under your link. Google says it shows this label when it believes a hacker changed existing pages or added new spam pages.
- Browser warnings. A red “Dangerous site” screen in Chrome comes from Google Safe Browsing. You can check your domain on the Safe Browsing site status page.
- Host suspension or warning email. Hosts often suspend accounts that send spam or serve malware.
- Unknown files. Files with random names in your site folder, or PHP files inside wp-content/uploads, where only images and documents should be.
If you see even one of these, treat it as a hack until you prove otherwise.
What to do when your WordPress website is hacked: the first hour
1. Don’t panic, and don’t start deleting things
Deleting random files can break the site and destroy clues about how the attacker got in. Write down what you saw and when, then follow these steps in order.
2. Contact your host
Your hosting company can see server logs, may already know about the hack, and can often put the site into maintenance mode or block bad traffic. Some hosts include malware cleanup in their plans, so ask. If they suspended the account, ask what they need from you to restore it.
3. Change every password
Assume every password connected to the site is known to the attacker. Change them all, from a computer you trust:
- Your hosting control panel login
- SFTP or FTP accounts
- The database password (then update it in wp-config.php so the site can still connect)
- Every WordPress administrator account, and ideally all users
- Your email account linked to the site, since password resets go there
Use long, unique passwords and turn on two-factor login where you can.
4. Back up the hacked site
It sounds odd, but save a full copy of the files and database as they are now. This lets you or a developer study how the attacker got in, and gives you something to fall back on if the cleanup goes wrong. Label it clearly as “hacked” so nobody restores it by mistake.
How to fix a hacked WordPress site
There are two ways to fix a hacked WordPress site. Pick the one that matches what you have.
Option A: Restore a clean backup
If you have a backup from before the hack, this is usually the fastest and cleanest route. The catch is knowing when the hack started. Spam pages in Google or old dates on unknown files can help you pick a backup from safely before that. You will lose any changes made since, such as new orders or blog posts, so note those first.
A restored backup still has the same weakness that let the attacker in. Go straight to the “fix the cause” section below before you relax.
Option B: Clean the site manually
No clean backup? Then work through this list. The official WordPress.org guide for hacked sites covers the same ground.
- Reinstall WordPress core. In Dashboard, Updates, use “Re-install”, or replace the wp-admin and wp-includes folders with fresh copies from wordpress.org. Do not touch wp-content or wp-config.php yet.
- Replace plugins and themes. Delete each plugin and theme folder and reinstall it from wordpress.org or the developer’s official site. Remove anything you no longer use, and never reinstall “nulled” (pirated) premium plugins, a common source of hidden backdoors.
- Scan the site. Run a scanner such as Wordfence, Sucuri SiteCheck or the Jetpack scanner. These compare files to known clean versions and look for known malware. A clean scan is a good sign, not proof.
- Check wp-config.php. Look for code that does not belong, especially long scrambled strings or lines with eval or base64_decode. Generate new security keys and salts while you are there.
- Check .htaccess. Attackers often add rules here to redirect visitors from Google or phones. Compare it to a standard WordPress .htaccess and remove anything unfamiliar.
- Look for PHP files in uploads. The wp-content/uploads folder should hold images and documents. A .php file in there is almost always a backdoor.
- Check the database. Search the posts and options tables for injected <script> tags, iframes and spam links. Also look for spam pages and posts you did not write.
- Remove unknown admins. Delete any user you do not recognise, and assign their content to yourself if asked.
Once done, scan again, then log out all sessions by changing the security salts.
Fix the cause, or it will happen again
Cleaning without closing the hole is like mopping a floor under a leaking pipe. Google warns that if you don’t fix the weakness, the site will likely be reinfected.
Update plugins and themes first
Patchstack counted 11,334 new vulnerabilities in the WordPress ecosystem in 2025, with 91% in plugins and 9% in themes. The same report says 46% were not fixed by the time they became public, and the weighted median time to first exploit was 5 hours. In plain terms: update fast, and remove plugins that are no longer maintained.
Update WordPress core
Core issues are rarer, but they happen. WordPress 7.1.2, released on 22 September 2026, fixed CVE-2026-87902, a critical flaw that under certain server and theme conditions could let an attacker run code without logging in. If your site is on anything older than 7.1.2, update now. At the time of writing, the latest release is 7.1.3.
Update PHP
PHP is the language WordPress runs on, and your host controls the version. On 21 October 2026, the PHP team patched two serious flaws nicknamed PHP2Shell, CVE-2026-109618 and CVE-2026-109619. Help Net Security reports that a single request from someone who is not logged in could trigger them, and that a working exploit exists. The fixed versions are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Read our PHP2Shell explainer for the details, and our guide on how to update PHP in WordPress safely.
Lock down logins
Turn on two-factor login for every admin, limit failed login attempts, and give each person their own account with the lowest role they need.
How to remove “This site may be hacked” from WordPress in Google
This label will not disappear on its own. Google says it won’t be removed until the website owner takes action. Here is the process:
- Verify your site in Google Search Console if you have not already.
- Open the Security Issues report. It lists the problem Google found and sample URLs that are affected.
- Clean the whole site and fix the weakness using the steps above. Make sure the hacked URLs now return a “404 Not Found” or “410 Gone”, or show clean content.
- Check Google can crawl the pages. Do not block them with robots.txt or noindex while you wait.
- Click “Request a review” in the Security Issues report. Briefly explain what you did for each type of problem, for example “removed the spam pages and updated an outdated plugin.”
Be patient. Google’s review guide says reviews for sites hacked with spam can take up to several weeks, while malware reviews take a few days. Asking for a review before the site is truly clean only keeps you flagged for longer. If you also have leftover spam pages in search results, the Google help for hacked sites explains how to clean those up.
Should you fix a hacked WordPress site yourself or hire a pro?
Honest answer: a simple hack with a recent clean backup is a reasonable DIY job if you are comfortable in your hosting panel. Hidden backdoors, database injections and repeat infections are where professionals earn their fee. Prices vary a lot depending on the size of the site and how deep the infection goes, so get a fixed quote before work starts.
| Situation | DIY | Professional cleanup |
|---|---|---|
| Clean backup from before the hack | Usually fine | Optional, to find the cause |
| No backup, small brochure site | Possible, slow | Faster and more thorough |
| Spam redirects that keep coming back | Hard: backdoors are often hidden | Recommended |
| Thousands of spam pages in Google | Hard | Recommended |
| WooCommerce store with customer data | Not advised | Strongly recommended |
| Host has suspended the account | Depends on host support | Recommended |
| Cost | Your time, plus any scanner subscription | A one-off fee, often less than lost leads |
If the site was old, slow and full of abandoned plugins before the hack, it can make more sense to rebuild it properly. We cover that in our website redesign service and custom WordPress development.
Spam redirects, a “This site may be hacked” label or a suspended account need fast action. Send us your website address and we will reply within 24 hours with a plain-English plan and a fixed quote before any work starts.
How to keep your WordPress site from being hacked again
- Keep WordPress, plugins, themes and PHP up to date, and check weekly.
- Delete plugins and themes you don’t use.
- Use two-factor login and unique passwords for every account.
- Keep automatic daily backups stored off the server, and test a restore now and then.
- Use a security plugin or firewall to block known attacks.
- Only install plugins from wordpress.org or trusted developers.
Our full WordPress security checklist walks through each step. WordPress also publishes its own hardening guide for more technical readers.
Frequently Asked Questions
How do I know if my WordPress site has been hacked?
Common signs are redirects to spam sites, Japanese or pharmacy pages showing in Google for your domain, admin users you did not create, a “This site may be hacked” label in search results, browser security warnings, and a suspension notice from your host. Searching site:yourdomain.com in Google is a quick first check.
Can a hacked WordPress site be fixed?
Yes, in most cases. Restoring a clean backup or reinstalling core, plugins and themes from official sources removes most infections. The key is also fixing the weakness that let the attacker in, otherwise the hack usually returns.
Why does my WordPress site redirect to a spam site?
Attackers add code to files like .htaccess, wp-config.php, theme files or the database that sends some visitors elsewhere. It often targets mobile users or people arriving from Google, so you may not see it when logged in. Clean those locations and change all passwords.
How long does it take to remove “This site may be hacked”?
After you clean the site and request a review in Google Search Console, Google says reviews for spam hacks can take up to several weeks, and malware reviews take a few days. The label stays until Google confirms the site is clean. Our guide on removing the “This site may be hacked” warning walks through the review request step by step.
Will my hosting company clean my hacked site?
Some do, some only scan, and some will suspend the account until you fix it. Contact them first either way, as they can see server logs and help you find where the attack came from.
Does a hack hurt my Google rankings?
It can. Spam pages, redirects and warning labels put visitors off and can affect how Google shows your site. Cleaning up quickly and requesting a review gives you the best chance of recovering.
What is the Japanese keyword hack in WordPress?
It is a common spam hack that creates thousands of auto-generated Japanese pages on your domain to sell counterfeit goods. They show up in Google under your site name, often without you seeing them when logged in. You fix it by removing the spam files and database entries, deleting unknown users and Search Console owners, then using the Removals tool and requesting a review.
Need help with a hacked WordPress site?
If your site has been hacked and you would rather not do this alone, we can help. We clean and secure hacked WordPress sites, find how the attacker got in, and close the gap so it does not happen again. Send us your website address and we will reply within 24 hours with a plain-English plan and a fixed quote. Get help with your hacked site.
