WordPress Site Hacked? What to Do in the First 60 Minutes

Your phone buzzes. A customer says your website sent them to a casino. Or Google shows a red warning screen. Or your homepage is suddenly full of Japanese text you never wrote.

Your stomach drops. Breathe. A hacked WordPress site is fixable, almost always. What you do in the next 60 minutes decides whether this is a one-day problem or a one-month nightmare.

Here is the exact order I follow when a hacked site lands on my desk.

Minute 0–5: Confirm it’s really a hack

Not every weird thing is a hack. Before you panic, check:

• Open your site in a private window on your phone (mobile data, not Wi-Fi). Many hacks only show to visitors coming from Google or on mobile, so you might not see it while logged in.
• Search Google for site:yourdomain.com. Strange pages in other languages, pharmacy or casino words? That’s a classic SEO spam hack.
• Check Google Search Console → Security issues. If Google flagged you, it says so here.
• Look for new admin users in Users → All Users. An admin you don’t recognise is a near-certain sign.

If any of these are true, treat it as a hack.

Minute 5–15: Stop the damage (but don’t destroy evidence)

The instinct is to delete everything suspicious. Don’t. Deleting files at random often breaks the site and removes the clues that show how the attacker got in. If you don’t find the entry point, they come back, usually within days.

Do this instead:

1. Change every password: WordPress admins, hosting panel, FTP/SFTP, database, and the email account linked to the site. Use a password manager.
2. Take a full backup of the hacked site now. Yes, the infected one. It’s evidence, and a safety net if the cleanup goes wrong.
3. Remove admin users you don’t recognise.
4. If you run a store, check recent orders and the checkout page. Card skimmers on checkout pages are a real risk. If anything looks off, temporarily switch to a payment option that redirects off-site (like PayPal) or pause checkout.

Minute 15–30: Tell the right people

• Your host. Many hosts have a security team, and some will scan for free. They also need to know if your site is attacking others.
• Your payment provider, if you suspect card data was exposed. This is not optional for stores.
• Your team. Make sure nobody “fixes” things on their own at the same time.

Minute 30–60: Decide: clean it yourself or get help

Be honest with yourself here.

You can try it yourself if: it’s a small brochure site, you have a clean backup from before the hack, and you’re comfortable with SFTP and the database.

Get help if: it’s a store, you don’t know when the hack started, you don’t have a clean backup, or Google has already flagged you. Every day with a Google warning costs you visitors and trust. Most visitors never come back after seeing that red screen.

If you restore a backup

A backup only helps if it was taken before the infection started, and you still need to close the hole. Otherwise you restore, they walk back in, and you’re back here next week. After restoring:

• Update WordPress core, every plugin and every theme.
• Delete plugins and themes you don’t use (deactivated isn’t enough).
• Remove any “nulled” (pirated) premium plugins. They’re the most common backdoor I see.

How sites actually get hacked

In my cleanups, the cause is almost always one of these:

• An outdated plugin with a known vulnerability. Attackers scan thousands of sites a day for exactly this.
• Nulled plugins or themes downloaded from “free premium” sites.
• Weak or reused admin passwords, with no login protection or two-factor.
• Abandoned plugins that haven’t been updated in years.
• Shared hosting where another hacked site on the same account infects yours.

What a proper cleanup includes

When I clean a hacked site, “done” means all of this:

• Malware removed from files and the database (spam often hides in the database).
• The entry point found and closed, not just the symptoms removed.
• Core, plugins and themes reinstalled from clean sources.
• Google warning removed through Search Console.
• Hardening: login protection, two-factor, a firewall, file editing disabled.
• A short report of what happened and what changed.

The 5-minute habit that prevents most hacks

• Update plugins weekly (on a staging copy first if you run a store).
• Keep off-site backups for 30 days.
• Use two-factor login for every admin.
• Delete what you don’t use.
• Run a free check every month. My free Website Health Checker shows exposed usernames, login protection and other weak spots in 20 seconds.

Hacked right now?

I offer same-day hacked site cleanup from $199, with the entry point closed and a 30-day re-infection warranty. If it comes back within 30 days, I clean it again for free.

Not sure if it’s a hack? Run the free health check first, or message me and I’ll tell you honestly what I see.