What to Do If Your Website Gets Hacked

Discovering that your website has been hacked can be stressful, but it does not necessarily mean the website is permanently damaged.

Most compromised websites can be recovered.

The important part is to avoid randomly deleting files or restoring backups before you understand what happened. A hacked website may contain hidden backdoors, unauthorized administrator accounts, modified database records, malicious scheduled tasks, or stolen passwords.

The goal is not simply to make the website look normal again.

The goal is to remove the attacker and make sure they cannot get back in.

For WordPress websites, keeping WordPress core, plugins, and themes current remains one of the most important security precautions.

Step 1: Document What Happened

Before changing anything, write down what you are seeing.

For example:

• Website redirects somewhere unexpected
• Strange pages appeared
• Browser displays a malware warning
• New administrator accounts appeared
• Files have recently changed
• Search results contain spam pages
• Hosting provider suspended the site
• Email is being sent unexpectedly

Also note approximately when the problem started.

This information can help your hosting provider or developer determine how the website was compromised.

WordPress specifically recommends documenting the symptoms of a compromised website before beginning recovery.

Step 2: Contact Your Web Host

Your hosting provider may be able to see information that is not available from inside WordPress.

Ask whether they can determine:

• When suspicious files appeared
• Which files were recently modified
• Whether unusual login activity occurred
• Whether other websites in the account were affected
• Whether malware scanning detected anything
• Whether a clean backup is available

If you host several websites under one account, assume the other sites may also need to be checked.

Do not simply repair the homepage and assume the problem is gone.

Step 3: Make a Backup of the Compromised Site

This sounds strange, but before cleaning the website, preserve a copy of its current state if possible.

Back up:

• Website files
• Databases
• Important configuration files
• Relevant logs

This gives you something to examine later and prevents you from accidentally destroying information that could help identify how the attack happened.

Do not use this hacked backup as your normal restoration backup.

Keep it separately and clearly label it as compromised.

Also treat files from the compromised website cautiously. Do not execute downloaded scripts or open suspicious files unnecessarily on your computer.

Step 4: Check for a Known-Clean Backup

A good backup can make recovery dramatically easier.

The important words are:

known clean

A backup from yesterday is useless if the website was compromised two weeks ago.

Look for a backup from before the first signs of the attack.

If you have one, restoring that backup may be the fastest recovery method, but you still need to determine how the attacker originally gained access.

Otherwise, the exact same vulnerability may simply be exploited again.

Step 5: Change Your Passwords

Assume important credentials may have been exposed.

Change passwords for:

• Hosting control panel
• WordPress administrators
• FTP or SFTP
• SSH
• Database users when appropriate
• Email accounts connected with the website
• Any external services whose credentials were stored on the server

Use new passwords rather than slight variations of the old ones.

If the same password was used elsewhere, change it there too.

Credential resets are an important part of recovering from compromised systems.

Step 6: Check Every Administrator Account

In WordPress, go to:

Users → All Users

Look carefully at every Administrator account.

Delete accounts you do not recognize.

Attackers sometimes create legitimate-looking administrator accounts so they can return later even after malicious files have been removed.

Also check existing accounts for unexpected:

• Email address changes
• Password resets
• Permission changes

Enable two-factor authentication for administrator accounts when practical. WordPress currently recommends 2FA for privileged users, although WordPress core itself does not provide it without an additional authentication solution.

Step 7: Update Everything

Once the website is under control, update:

• WordPress core
• Plugins
• Themes
• PHP when necessary
• Other applications installed in the hosting account

Remove plugins and themes you no longer use.

Do not simply deactivate abandoned software and leave it sitting on the server.

If a plugin or theme is no longer maintained, replace it.

Keeping WordPress, plugins, and themes updated is one of WordPress’s primary security recommendations.

Step 8: Replace WordPress Core Files

For a WordPress website, one useful cleanup technique is replacing WordPress core files with fresh copies from WordPress.

Do not overwrite everything blindly.

Your important content normally lives primarily in:

/wp-content/

and your site configuration is stored in:

wp-config.php

Fresh WordPress core files can eliminate malicious modifications hidden inside standard WordPress files.

Plugins and themes should also be replaced with clean copies from their original trusted sources whenever practical.

Step 9: Inspect wp-content Carefully

The /wp-content/ directory deserves special attention because it contains:

• Plugins
• Themes
• Uploaded images
• Other website content

Instead of trusting the existing plugin and theme folders, reinstall clean copies.

Be particularly suspicious of PHP files inside locations where PHP normally should not be needed.

For example:

/wp-content/uploads/

normally contains images, documents, videos, and other uploaded media.

A random PHP file buried inside an uploads folder should immediately be investigated.

Step 10: Check the Database

Malware does not always live inside files.

Attackers can also modify the WordPress database.

Check for:

• Unknown administrator accounts
• Spam posts
• Injected JavaScript
• Modified site URLs
• Strange plugin settings
• Malicious redirects
• Unexpected scheduled actions

This is why blindly restoring the database from a compromised website can sometimes restore part of the infection.

If you have a known-clean database backup, that is preferable.

Step 11: Check Important Configuration Files

Inspect files such as:

wp-config.php

.htaccess

and other server configuration files.

Look for:

• Unexpected redirects
• Strange PHP code
• Unknown external domains
• Obfuscated code
• Recently modified sections

WordPress also recommends protecting important configuration files and using appropriate file permissions as part of hardening an installation.

Step 12: Decide Whether to Clean or Rebuild

There are two basic recovery approaches.

Option 1: Clean the Existing Website

This can work when:

• You understand the compromise
• The infection is limited
• You can identify modified files
• You have reliable malware scanning
• You are comfortable reviewing the website

Option 2: Rebuild From Clean Files

A complete rebuild is often safer when:

• Malware keeps returning
• Many files have been modified
• You cannot determine when the compromise occurred
• Multiple websites were infected
• You suspect several backdoors
• You cannot confidently verify the existing installation

In that situation, reinstall the website software from clean sources and selectively restore your content.

Do not copy the entire compromised website back into the clean account.

That defeats the purpose of rebuilding it.

Step 13: Restore Media Carefully

Images and normal media files can usually be preserved, but the uploads directory should still be inspected.

Common media formats include:

.jpg

.jpeg

.png

.gif

.webp

.pdf

.mp4

Be cautious with executable files such as:

.php

A PHP file found unexpectedly among ordinary images deserves investigation before being restored.

Step 14: Scan Your Own Computer

Sometimes the website itself was not the original weak point.

Malware on a developer’s computer can steal:

• FTP passwords
• Browser passwords
• Hosting credentials
• WordPress credentials

If a compromised credential caused the intrusion, cleaning the website without securing the computer can result in the website being hacked again.

Scan the computers used to administer the website and update their operating systems and browsers.

Step 15: Secure the Website Before Calling It Finished

Once the website is clean:

• Change passwords again if necessary
• Enable two-factor authentication
• Remove unused administrator accounts
• Remove unused plugins and themes
• Enable automatic updates where appropriate
• Use HTTPS
• Review file permissions
• Keep reliable backups
• Monitor unexpected file changes
• Keep PHP and other server software supported and current

WordPress strongly recommends HTTPS for protecting administrative logins and visitors.

Automatic WordPress background updates are also enabled on most installations and were specifically introduced in part to improve security.

The Most Important Rule

Do not focus only on removing the visible malware.

A successful website recovery answers two questions:

1. How did the attacker get in?

2. What did you change so they cannot use the same method again?

If you only delete the hacked files without fixing the original vulnerability, stolen password, outdated plugin, insecure account, or hidden backdoor, the website may simply be compromised again.

A website hack is inconvenient, but with good backups, updated software, secure credentials, and a careful recovery process, it is usually manageable.

When you are unsure whether the website is completely clean, rebuilding from trusted software and a known-clean backup is safer than guessing.