WordPress Site Hacked? A Calm Recovery Plan for Small Businesses

Your site is redirecting visitors to a casino, Google shows a red warning, or your host has suspended your account. This guide is for small-business owners and whoever looks after their WordPress site. It walks through what to do in the first hour, how to clean up properly, how to stop the attacker coming back, and when to hand the job to a professional.

In short: Don't start deleting things. Take a copy of the hacked site as evidence, ask your host for logs, and put up a maintenance page. Then rebuild from fresh, official copies of WordPress, your plugins and your theme, remove anything you can't account for, change every password and the WordPress salts, and remove unknown admin users. If customer data, payments or email are involved, or the infection keeps coming back, hire a professional incident-response or malware cleanup service.

First hour: contain and collect

A hack is stressful, and the urge is to start deleting files. Resist it for an hour. WordPress.org's own "My site was hacked" FAQ starts with exactly this: stay calm and document what you see.

1. Write down the symptoms. What made you think you were hacked, when you noticed it, and what changed recently (a new plugin, a theme edit, a new staff login). This becomes your incident record.
2. Take a full backup of the hacked site. Files and database, downloaded off the server. It's evidence, and a safety net if the cleanup breaks something. Label it clearly as infected so nobody restores it by mistake.
3. Ask your host for logs today. Access logs and control-panel login history show how the attacker got in. Some hosts keep them only for a short time, so ask early.
4. Put the site into maintenance mode at the server or host level, so visitors aren't sent to malware while you work.
5. Scan your own computers. The WordPress FAQ notes that stolen FTP or admin passwords often come from malware on the site owner's laptop. Changing passwords from an infected computer achieves little.

Watch out: Don't log in to wp-admin from a shared or untrusted computer during the cleanup, and don't install random "cleaner" plugins from outside the official directory.

Decide: fix it yourself or call a professional

Many small hacks can be cleaned by a careful owner or developer. Some can't, and getting it half right is how sites end up reinfected a week later.

Lordevo doesn't do hands-on cleanup of hacked sites, so we're not the right call during an active compromise. Your hosting company is a good first contact: many offer malware removal or can recommend someone. Ask any provider what's included, whether they find the entry point, and whether they recheck afterwards.

Clean the site: rebuild, don't patch

The goal is to replace everything that can be replaced with a known-good copy, and examine everything else.

1. Replace WordPress core. Download the same version from WordPress.org and upload fresh wp-admin and wp-includes folders over SFTP, deleting the old ones first. The WordPress FAQ recommends uploading the files yourself rather than using the dashboard's reinstall button, because the installer only overwrites existing files and malware often adds new ones. If you have WP-CLI, wp core verify-checksums lists core files that differ from the official release.
2. Reinstall plugins and themes from their official source. Delete each plugin folder and install a fresh copy rather than just deactivating it, because a deactivated plugin's files can still be run directly. wp plugin verify-checksums --all helps for plugins hosted on WordPress.org. Remove anything you don't use.
3. Search what's left. Check wp-content/uploads for PHP files (it should normally hold media, not code), and inspect wp-config.php, every .htaccess file and the web root for code or files you don't recognise. Our guide on checking a PHP site for web shells and backdoors shows what to look for.
4. Check the database. Look in the users table for administrators you didn't create, and in the options table for unfamiliar URLs or scripts. Attackers often add admin accounts directly in the database, so don't rely only on the Users screen.

Watch out: A backup from before the hack isn't automatically clean. If the attacker got in weeks earlier, your "good" backup may already contain a dormant backdoor. Restore it, then check it with the same steps.

Nulled (pirated) premium plugins and themes are a common source of infection, because the "free" copy can come with extra code. If you find one, replace it with a licensed copy from the developer or remove it.

Close the way back in

Cleaning without closing the entry point invites a repeat. Once the files are clean, change every credential, even ones you don't think were exposed:

• WordPress passwords for all admin and editor accounts
• The database password (and update it in wp-config.php)
• SFTP/SSH and hosting control-panel passwords
• Email accounts tied to the site, especially the admin email
• The WordPress secret keys and salts: replace them in wp-config.php with a fresh set from the official generator, which logs everyone out

Then update WordPress, every plugin and your theme to current versions. Our guide on updating WordPress plugins safely covers how to do it without breaking the site, and securing your WordPress login covers two-factor authentication and login limits. The WordPress FAQ also suggests changing passwords a second time once the site is confirmed clean.

After the cleanup: Google, email and monitoring

Google. If Google flagged your site, open the Security Issues report in Search Console, fix every issue it lists across the whole site, then select Request Review and describe what you did. Google says reviews can take several days or weeks, and resubmitting early doesn't help.

Email. Hacked sites are often used to send spam, which can get the server's IP address blocklisted and hurt your normal email. If your business email shares that server, check deliverability. Make sure SPF, DKIM and DMARC are set up so others can't easily send mail pretending to be you: SPF, DKIM and DMARC explained.

Hardening. Work through the WordPress hardening checklist and add the security headers every small business website needs.

Monitoring. Watch for the same symptoms for several weeks: new admin users, changed files, odd redirects, new pages in Google. Keep off-site backups and test that they restore.

Where Lordevo's scans fit, and where they don't

After the site is clean, our scans can help you check the outside of it. The free Safe Scan on pentest.lordevo.com passively checks security headers, TLS, cookie flags, a short list of files that should never be public, advertised software versions against the critical CVEs we track, and your SPF, DKIM and DMARC records. The paid Deep / Active Scan is an automated, ownership-verified scan that adds a targeted pass when it detects WordPress.

Both are automated. Neither is a malware cleanup, a manual penetration test or proof that a site is clean. They can't see inside your files or database the way a cleanup service can.

Key takeaways

• Keep evidence first: a full backup of the hacked site and your host's logs.
• Rebuild core, plugins and themes from official sources. Delete rather than deactivate.
• Treat old backups as suspect until checked.
• Change every password and the WordPress salts, and remove unknown admins, including in the database.
• Request a Google review only after everything is fixed.
• Call a professional for shops, customer data, or infections that come back.

FAQ

Can I just restore yesterday's backup? You can, but the hole the attacker used is probably still there, and the backup may contain their backdoor. Restore, then check and update everything.

Will a security plugin clean it for me? Scanner plugins can find many known infections, but no single scan proves a site is clean. Use one as a check alongside the rebuild, not instead of it.

Where can I get free help? The WordPress.org Fixing WordPress forum is run by volunteers, and the WordPress.org FAQ linked above lists more resources.