WordPress Hacked? Emergency Checklist for the First Hours

It often starts with something small. A customer tells you they ended up on an online casino when they tried to visit your site. Your host sends an email saying your account was suspended for sending spam. Or Google shows the line “This site may be hacked.” right under your search result. At that point it's obvious: someone has got into your WordPress. That's frustrating, but it's not the end of the world. What matters now is doing things in the right order. If you panic, delete everything and restore whatever old backup you can find, the problem is often back a week later. This emergency checklist takes you through the first hours, the cleanup and the weeks after.

How can you tell that WordPress has been hacked?

Not every hack is obvious right away. Many attackers actually work hard to make sure you don't notice anything. They would rather quietly use your server for spam, for redirects or to push their own pages up in Google. Take these signs seriously:

• Redirects to unknown sites: Visitors end up on gambling, dating or fake shop pages. Often this only happens on smartphones or only when someone arrives from Google.
• Warnings from Google or the browser: Chrome shows a red warning page instead of your site, the search results say “This site may be hacked.” or Search Console reports a security issue.
• Strange pages in the index: A search for site:yourdomain.com turns up pages with Japanese characters, erectile dysfunction pills or cheap designer goods that you never created. Security people call this the Japanese keyword hack or the pharma hack.
• Unknown users: There's an administrator in your user list that nobody recognizes. Sometimes the account is even hidden from the list and only shows up in the database.
• Mail from your host: Your host reports outgoing spam or unusually high server load, or has already suspended your account.
• Odd files and changes: Files with cryptic names, foreign code at the top of index.php, plugins you never installed, or a login where your password suddenly stops working.

One thing confuses a lot of people: you often don't see anything yourself. Cleverly built malware recognizes administrators who are logged in by their cookie and shows them the perfectly normal site. So test your site in a private window, ideally on your phone over mobile data. Open it once directly and once through a Google search.

WordPress hacked: What should you do in the first hour?

In the first hour you don't need to find the malicious code yet. The goal is to limit the damage without destroying any evidence. Work through these points in order:

1. Take a breath and don't delete anything yet. The urge to wipe everything or blindly restore a backup is understandable. But that destroys exactly the traces that will later tell you how the attackers got in.
2. Write down what you see. Take screenshots of redirects and warnings, note the times and keep the emails from your host and Google. This helps you find the cause and, later on, with a possible report to the data protection authority.
3. Save the infected state. Download all files and an export of the database and store both separately, clearly labeled as infected. You will never restore this copy. It's only there as evidence and for comparison.
4. Take the site offline. This is a must if visitors are being redirected to scam pages or your shop processes payment data. A maintenance mode plugin won't help much here, because it runs inside the hacked WordPress itself. Block the site at server level instead and only let your own IP through. If your site runs on Apache, three lines at the very top of your .htaccess are enough:

   RewriteEngine On
   RewriteCond %{REMOTE_ADDR} !^203\.0\.113\.10$
   RewriteRule ^ - [R=503,L]

   Replace the address with your own IP. The status code 503 tells Google that the site is only temporarily unavailable. For a short time, this won't hurt your rankings. If your server uses nginx or you're not sure, ask your host for help.
5. Change the most important credentials. Set new passwords for your hosting account, for SFTP or SSH and for the database. Do this from a device you trust. If the credentials were stolen from your own computer, for example by a trojan that reads the passwords saved in FileZilla, new passwords won't help as long as that computer is infected. Change your own WordPress password as well. The other users and the security keys come after the cleanup, because as long as a backdoor is still open, the attacker can simply read the new passwords.
6. Tell your host. Many hosts have their own security team, malware scanners and, above all, the server's access logs. Ask specifically for the logs from the last few weeks and for backups. Some hosts keep them longer than you'd think.
7. Let the right people know. If you're an agency, inform your client. If other people have access to the site, they need to know too. And as soon as personal data may be affected, a legal deadline starts running. More on that below.

How do hackers get into WordPress? Finding the entry point

Many people skip this step, and that's exactly why so many sites get hacked twice. If you don't find the hole, you clean up and a few days later the attacker walks back in through the same door. Often not even on purpose, but because a bot automatically scans the web for exactly this vulnerability.

The most common entry points are:

• Outdated plugins and themes: This is by far the most common route. According to Patchstack's annual reports, the vast majority of known vulnerabilities in the WordPress ecosystem are in plugins, a small share in themes and hardly any in WordPress itself. Plugins that nobody maintains anymore or that have been removed from the WordPress.org plugin directory are especially risky.
• Nulled plugins and themes: Pirated copies of premium plugins from shady download sites. They cost nothing, but surprisingly often come with a backdoor built in.
• Weak or stolen passwords: Bots try combinations of usernames and passwords around the clock. If you use the same password for other services, you're in trouble after the next data leak.
• Neighbors in the same hosting account: If the same account also holds an old test install, a forgotten shop or your site from 2016 in a subfolder, the attacker can reach every other site in the account from there.
• Infected computers: Malware on an admin's PC can read saved credentials and send them to the attackers.

Here's how to track down the cause:

• Check your plugins and themes against a vulnerability database such as Wordfence Intelligence, Patchstack or WPScan. What matters is whether a vulnerability is known for exactly the version you have installed.
• Look at the server's access logs. Suspicious entries are POST requests to files that don't exist in WordPress at all, or to files in the wp-content/uploads folder. The timestamps often tell you when it all started.
• Check when suspicious files were created. The date is a clue, but not proof, because attackers like to fake timestamps.

How do you remove malware from WordPress?

Now it's time to clean up. There are two ways to do it.

Restoring a clean backup is the fastest. But it only works if you know for sure that the backup is older than the intrusion. That's harder than it sounds. There are often weeks, sometimes months, between the actual intrusion and the first visible symptoms, because attackers plant a backdoor first and only use it later. You also lose all content, orders and comments since the backup, and the hole is still open afterwards. If you go this way, update all plugins and themes right after restoring and still work through the points below.

Cleaning the site by hand takes longer, but it's more thorough. The safest way is to work on a copy rather than the live site. Here's how:

1. Replace WordPress completely. Delete the wp-admin and wp-includes folders and replace them with fresh copies of the same version from WordPress.org. Do the same with the files in the root directory, except for wp-config.php. You can then check that everything is in order with the WordPress command line:

   wp core verify-checksums

   The command compares every file with the official checksums from WordPress.org and also reports files that don't belong there at all.
2. Reinstall plugins and themes. Delete every plugin and every theme and install a fresh copy from a trusted source. Anything you don't use doesn't come back at all. For plugins from the official directory there's a check as well:

   wp plugin verify-checksums --all

   The command can't check premium plugins, because WordPress.org has no checksums for them. Download those again directly from the vendor.
3. Search the uploads folder. It's meant for images, PDFs and other media, not for PHP. This command finds files that don't belong there:

   find wp-content/uploads -type f -name "*.php"

   One exception is empty files named index.php, which some plugins create so nobody can list the contents of a folder. Take a close look at everything else.
4. Check everything you can't reinstall. That includes wp-config.php, .htaccess (a favorite hiding place for redirects that only apply to visitors from Google or on smartphones), your own theme with its functions.php and the wp-content/mu-plugins folder. WordPress loads whatever is in there automatically, and it can't be deactivated in the dashboard. Typical signs of malicious code are functions like eval, base64_decode or gzinflate combined with long, unreadable strings. This command is enough for a first search:

   grep -rlE "eval\(|base64_decode\(|gzinflate\(|str_rot13\(" wp-content/

   A match is not proof, since legitimate plugins use some of these functions too. But it shows you where to look more closely.
5. Clean up the database. Malicious code doesn't only live in files. Start by listing all administrators:

   wp user list --role=administrator --skip-plugins --skip-themes

   The two options at the end make sure WordPress loads neither plugins nor the theme, so it doesn't run any malicious code that may still be hiding there. Delete every account you can't account for. Also check in the wp_options table that siteurl and home still point to your domain. You can find injected scripts in posts and pages like this:

   SELECT ID, post_title, post_type FROM wp_posts WHERE post_content LIKE '%<script%';

   If your installation uses a prefix other than wp_, adjust the table names. Widgets are stored in wp_options as well and deserve a look too.
6. Check the scheduled tasks. Attackers like to set up cron jobs that recreate the malicious code at regular intervals. Look at the WordPress cron jobs as well as the cron jobs in your hosting control panel.

Scanners like Wordfence or the free Sucuri SiteCheck find a lot of known malware and are a good addition. But don't rely on them alone. An external scanner only sees what reaches the browser, and a plugin can only find what it already knows. New or cleverly hidden backdoors slip through.

How do you secure WordPress after a hack?

The site is clean? Then comes the part that decides whether it stays that way.

• New passwords everywhere: for every WordPress user, for the database (then enter the new value in wp-config.php), for SFTP and for your hosting account. Don't forget the keys for external services stored in plugins, for example for sending email or for payment providers.
• New security keys: Replace the salts in wp-config.php with new values from the official WordPress.org generator. This invalidates all existing logins, including any that an attacker may still have as a cookie.
• Close the hole: Update WordPress, all plugins and all themes. Replace plugins that are no longer maintained. Our guide How to keep WordPress plugins updated and secure shows you how to stay on top of this for good.
• Secure the logins: Set up a second login factor for all administrators (what 2FA is and how it works) and keep the number of administrators to the bare minimum.
• Turn off the file editor: With this line in wp-config.php, nobody can change code in plugins and themes through the dashboard anymore:

  define( 'DISALLOW_FILE_EDIT', true );

  You'll find more settings in our guides Secure wp-config.php and Set file permissions in WordPress correctly.
• Put a firewall in front: A Web Application Firewall blocks many attacks on known vulnerabilities before they even reach WordPress.
• Backups that actually work: automatic, daily, stored off the server and going back at least 30 days. And restored once as a test, before you need them in an emergency.

Keep a close eye on the site for a few weeks afterwards. If the malicious code shows up again after a few days, you've missed a backdoor or the hole is still open. For an overview of all protective measures, see our WordPress security checklist.

“This site may be hacked”: How do you get rid of the Google warning?

Google doesn't remove the warning on its own once you've cleaned up. You have to take action:

1. Sign in to Google Search Console. If you haven't set up your site there yet, do it now.
2. Under “Security & Manual Actions”, open the “Security issues” report. It shows you what Google found, often with a few affected URLs as examples.
3. Check in the settings who is listed as a user or owner. Attackers sometimes add themselves there to get their spam pages indexed faster. Remove anyone you don't know, along with the matching verification file in your site's root directory.
4. Click “Request review” and briefly describe what you found and fixed. According to Google, the review usually takes a few days for malware, about one day for phishing and sometimes several weeks for hacked spam pages.

After the cleanup, the spam pages themselves should return the status code 404 or 410. They will then gradually drop out of the index. If it's urgent, the Removals tool in Search Console helps. Afterwards, submit your real sitemap again. If your server sent out spam, also check whether your IP has ended up on an email blacklist. Your host can help you get it removed.

Do you have to report a hack under the GDPR?

That depends on whether personal data may be affected. With an online shop, a members area or stored contact form submissions, that's quickly the case. Even the WordPress user table contains names and email addresses.

Under Art. 33 GDPR you have to report a breach like this to the competent supervisory authority within 72 hours. The clock starts as soon as you become aware of it. You only don't have to report it if the breach is unlikely to result in a risk to the people affected. If the risk is high, for example because payment data or passwords may have been stolen, Art. 34 GDPR also requires you to inform the people affected directly.

Even if you decide not to report it in the end, you have to document the incident and your decision. That's what Art. 33(5) requires. Most supervisory authorities provide an online form for reporting. If you have a data protection officer, bring them in right away. This section is not legal advice.

When is it worth hiring a professional for the cleanup?

You can handle a lot of this checklist yourself if you know your way around files, databases and servers. In some cases, professional help is still the better choice:

• Your shop processes payment data and there's a suspicion that card details were stolen.
• The site gets reinfected after every cleanup.
• There's no usable backup and the command line isn't really your thing.
• It's a client's site and you'll need to be able to show exactly what happened later.

Your host is often the first place to go. Many offer a cleanup as a paid service. There are also specialized services, for example from Wordfence or Sucuri. Ask beforehand whether finding the entry point is included in the price. Just removing the malicious code only helps you until the next attack.

How InspectWP helps you after a hack

Let's be clear up front: InspectWP is not a malware scanner and doesn't replace a cleanup. But the report helps in two places that often get lost in the rush: finding the likely hole and checking things afterwards.

Even the free report lists the plugins and themes it detects on your site and flags those that have been removed from the WordPress.org plugin directory or haven't had an update in over a year. It shows you whether you're running an outdated version of WordPress and whether files are publicly reachable that have no business being there, such as a public debug.log, database backups or a file named .env. It also checks whether your login is protected against mass password guessing and whether usernames can be read from the outside.

On the Premium and Agency plans, you also see the installed versions of your plugins and known vulnerabilities for them. That way you can often find the most likely cause within minutes. With the InspectWP WordPress Connector, you also learn whether WordPress core files have been modified (the connector compares them with the checksums from WordPress.org), how many administrators there are and whether important folders are writable.

After the cleanup, automatic reports are worth it. InspectWP then checks your site regularly and can notify you by email. Comparing two reports shows you at a glance what has changed, for example a new plugin that supposedly nobody installed. You can get your first free report in just a few minutes.