WordPress hacked? Step-by-step guide to recover your site

If you suspect your WordPress hacked issue is real, acting quickly is essential. Website hacks often start quietly. Hackers may insert hidden malware, create unauthorized admin accounts, or redirect visitors to malicious pages without your knowledge. Over time, these attacks can damage your reputation, harm your search rankings, and even expose sensitive user data.

Understanding what to do when a WordPress hacked situation occurs can help you minimize damage and recover faster. This guide explains the most common signs of a compromised WordPress website, the steps needed to remove malware, and practical strategies to strengthen your website’s security moving forward.

Signs of a hacked WordPress websiteLink to heading

Recognizing the early warning signs of a wordpress hacked situation can help you respond quickly and prevent further damage. When attackers gain access to a website, they often leave traces that affect how the site behaves, appears, or performs. Below are several common indicators that may suggest your WordPress website has been compromised.

Unable to access the WordPress dashboardLink to heading

One of the first signs of a wordpress hacked incident is losing access to your WordPress dashboard. If you enter the correct username and password but still cannot log in, it may indicate that an attacker has already taken control of the administrator account.

In many cases, hackers modify the login credentials or change the administrator password after gaining access. Once this happens, the original site owner is locked out of the dashboard and cannot manage users or remove unauthorized access. This tactic allows attackers to maintain control of the website while preventing the owner from regaining access easily.

Unexpected website redirectsLink to heading

Unusual redirects are another common warning sign that your wordpress hacked issue may be real. Instead of loading your intended page, visitors may suddenly be sent to unfamiliar websites.

Attackers often use this technique to redirect users to phishing pages or websites that contain malware. These malicious pages may attempt to steal personal information, distribute harmful software, or launch additional attacks.

Redirects can also be used to generate traffic for spam websites. In some cases, hackers manipulate the site to boost advertising revenue or intentionally harm the website’s search engine performance. This behavior may damage your site’s credibility and reduce its visibility in search results.

Unusual changes to website contentLink to heading

Unexpected modifications to website content can also indicate that a wordpress hacked attack has occurred. Hackers may alter text, add hidden links, or insert malicious scripts into existing pages.

Sometimes these changes are subtle, such as adding links that redirect visitors to suspicious websites. Because these links may be hidden within the page structure, they are not always easy to notice at first.

In other situations, attackers intentionally replace or deface entire pages. This type of attack may be used to spread messages, promote spam content, or simply vandalize the website. Any sudden or unexplained changes to your website’s content should be investigated immediately.

Sudden drop in website trafficLink to heading

A sharp decline in website traffic can also signal a wordpress hacked situation. When hackers modify content or create redirects, it can negatively affect your website’s search engine optimization (SEO).

Search engines may detect suspicious activity or malicious code on your website. If this happens, the site could be flagged as unsafe or removed from search results entirely. As a result, organic traffic may drop significantly within a short period of time.

In more serious cases, hackers may use your website to distribute malware or conduct harmful activities. When search engines detect this behavior, they may blacklist the website, which prevents users from accessing it through search results.

Unknown administrator accountsLink to heading

Another common sign of a wordpress hacked website is the appearance of unfamiliar user accounts with administrator privileges. Once attackers gain access to a site, they may create additional admin accounts to maintain long-term control.

These accounts allow them to change settings, install malicious plugins, or modify website files without needing the original login credentials. Because administrator roles have full control over the site, this tactic helps attackers continue their activities without being detected immediately.

To reduce this risk, website owners should regularly review the list of user accounts within the WordPress dashboard. Checking user permissions frequently can help identify suspicious accounts before they cause further harm.

Security warnings in browsers and search resultsLink to heading

Search engines and web browsers often warn users when a website appears unsafe. If your site is affected by a wordpress hacked incident, you may notice warning messages appearing in search results or browsers.

For example, search engines may display a message such as “This site may be hacked” next to your website in search results. This warning alerts users that the site could contain harmful content or suspicious activity.

Similarly, browsers may block access to the website and show a security message like “Deceptive site ahead.” These warnings are designed to protect users from phishing pages, malware downloads, or other online threats.

If you see these alerts, it is important to verify your website’s security status using tools such as Google Safe Browsing and begin investigating the possible cause immediately. Addressing the issue quickly can help restore your site’s reputation and protect visitors from potential risks.

>>> See more: 15 Common signs that your WordPress website is under attack

How to fix a hacked WordPress websiteLink to heading

Enable WordPress Maintenance ModeLink to heading

If you still have access to the admin dashboard, the first action you should take in a wordpress hacked situation is to enable maintenance mode. Activating this feature temporarily blocks visitors from accessing your website. 

Maintenance mode also prevents attackers from exploiting the compromised website further while you work on resolving the problem. By limiting public access, you can safely inspect files, review changes, and begin the recovery process without risking additional harm to visitors.

If you cannot access the dashboard, maintenance mode can still be activated manually by editing important website files such as functions.php or the .htaccess file. These files allow administrators to control how the website behaves when it loads. Modifying them can temporarily disable the site until the issue is fixed.

Some hosting providers also allow you to enable maintenance mode through their hosting control panel. This option can be helpful if you are unable to log in to WordPress but still have access to your hosting account.

Reset WordPress passwordsLink to heading

When a wordpress hacked incident occurs, it is highly likely that your login credentials have already been exposed. 

Start by changing the password for your WordPress administrator account. In addition, you should update the passwords associated with your hosting account and the website database. These accounts are critical components of your website’s infrastructure, and compromised credentials can allow attackers to regain access even after you remove malicious files.

If you are still able to log in to the WordPress dashboard, you can update your password directly through the admin panel.

If access to the dashboard is blocked, you can recover your account using the password reset feature provided by WordPress. To use this option, visit the login page and choose the Lost Your Password link. You can also open the password recovery page directly by entering the following address in your browser:

yourdomain.com/wp-login.php?action=lostpassword

After entering your registered email address, WordPress will send instructions for creating a new password.

In addition to resetting the main administrator account, it is important to review all user accounts on your website. Update the credentials for every authorized user to prevent attackers from exploiting other accounts that may have been compromised during the wordpress hacked incident.

Update WordPress Core, Themes, and PluginsLink to heading

Before fully repairing your compromised website, make sure that your WordPress installation is updated to the latest version. WordPress updates often include security patches that fix known vulnerabilities in the content management system. If these updates are not applied, attackers can take advantage of those weaknesses to gain access to your website.

In addition to updating WordPress itself, you should also review all installed themes and plugins. Outdated plugins and themes frequently contain vulnerabilities that hackers exploit to infiltrate websites. By updating them to the latest versions, you reduce the risk of attackers using the same vulnerability again after the initial cleanup.

Disable Plugins and ThemesLink to heading

Plugins and themes can sometimes contain security weaknesses, which makes them a common entry point when a wordpress hacked incident occurs. Temporarily disabling these components helps reduce potential vulnerabilities and allows you to identify which extension may be responsible for the security breach.

Start by deactivating all plugins and themes on your website. After that, enable them again one at a time. Once you discover the component causing the issue, remove it permanently to ensure the website remains free from malware and other harmful code.

To deactivate plugins, access your WordPress admin area and go to wp-admin → Plugins → Installed Plugins. Under each plugin name, select the Deactivate option to turn it off.

If you want to disable several plugins at the same time, check the boxes next to the plugins you want to deactivate. Then choose Deactivate from the drop-down menu and apply the action. Once they are disabled, you can remove them completely by selecting the Delete option.

To manage themes, navigate to Appearance → Themes in the WordPress dashboard. Move your cursor over the theme you want to remove, select Theme Details, and click Delete. Unlike plugins, themes cannot be deactivated in bulk, so you will need to review them individually.

In addition, some hosting platforms allow you to manage themes directly from their control panel. For example, you may delete a theme through the hosting dashboard by opening the WordPress Security panel. Security scanners available in the hosting panel can also warn you if a plugin contains known vulnerabilities so you can update or remove it promptly.

Reinstall WordPressLink to heading

If attackers modify or infect core WordPress files with malicious scripts, reinstalling the content management system is often the most reliable way to restore your website. 

There are several ways to reinstall WordPress depending on your level of access. If you can still log in to the admin dashboard, open the sidebar menu and navigate to Dashboard → Updates → Reinstall. Before performing this action, make sure you have created a complete backup of your website content to avoid losing important data.

If the dashboard is inaccessible, you can reinstall WordPress through your hosting control panel. Many hosting providers include an Auto Installer tool that allows users to install WordPress again from the website management section. More experienced users may also choose to reinstall the platform using command-line tools such as WP-CLI. 

Once the new installation is complete and security threats have been removed, you can upload your website files again. This can be done through the hosting panel’s File Manager or by using an FTP client such as FileZilla.

It is also a good practice to delete unused WordPress installations because outdated or abandoned sites can introduce additional security risks. To remove them, delete unnecessary files and folders located inside the public_html directory.

Warning: If you are not certain which system files should be removed, avoid deleting them. Removing critical WordPress files incorrectly may break your website or cause additional technical issues.

Remove suspicious administrator accountsLink to heading

Attackers who gain access to a website often create new administrator accounts so they can continue controlling the system from inside. When dealing with a wordpress hacked situation, reviewing user accounts and removing unauthorized administrators is an essential security step.

To check all users and their permission levels, open the WordPress dashboard and navigate to Users → All Users. Review the list carefully to identify accounts that you do not recognize.

If you find a suspicious account with administrator privileges, move your cursor over the username and click Delete to remove it. 

You can also modify a user’s permissions instead of deleting the account. Select Edit under the user’s profile and locate the Role section. From there, choose a lower permission level to remove administrative privileges.

If several unknown accounts appear on the site, WordPress allows you to remove them simultaneously. Check the boxes next to the suspicious usernames and select Delete from the Bulk actions drop-down menu. You may also change their permission level in bulk by choosing a new role from the Change role to… option.

Before deleting any user account, confirm with other administrators or team members. Once an account is removed, the action cannot be reversed, so verifying ownership helps avoid accidentally deleting legitimate users.

Search for malwareLink to heading

One of the quickest ways to check for malware is by using an online website security scanner. These tools analyze your website’s public pages and look for suspicious scripts, malware signatures, or blacklisting status.

To perform a scan, simply enter your website URL into the scanner. The tool will review your site and report any known security threats, malware patterns, or suspicious behavior.

This method is fast and easy, but it has limitations. Most online scanners can only detect malware that appears on the visible front-end of the website. If malicious code is hidden in server files or the database, it may not be detected.

Disable PHP execution in the uploads directoryLink to heading

When a wordpress hacked incident occurs, attackers often attempt to create hidden backdoors that allow them to regain access later. One common method is uploading malicious PHP files into the Uploads directory. Preventing PHP execution in this location helps block attackers from running harmful code.

You can stop these scripts from executing by adding a configuration file to the uploads directory. Follow these steps to apply this security measure:

1. Open your hosting control panel and navigate to Websites, then click Manage for the site you want to configure.
2. Select File Manager to view the website’s files and folders.
3. Locate the wp-content/uploads/ directory.
4. In the sidebar, click the Create New File option.
5. Name the file .htaccess.
6. Insert the following code into the file:

<Files *.php>
deny from all
</Files>

7. Save the file by clicking the disk icon in the upper-right corner.

This configuration prevents PHP scripts inside the uploads folder from running, which helps eliminate one common technique used during a wordpress hacked attack. If your hosting provider does not include a built-in file manager, you can create the .htaccess file locally on your computer and upload it to the appropriate directory using an FTP client such as FileZilla.

While reviewing your files, it is also important to verify file permissions. Incorrect permissions can create additional security risks. Right-click any file or folder and select Permissions to view its settings. In most cases, recommended permissions are 644 for files and 744 for directories. 

Clean the WordPress DatabaseLink to heading

In some cases, attackers gain entry to a website through SQL injection attacks. This technique allows them to insert malicious commands directly into the WordPress database.

To remove these threats, the database must be carefully reviewed and cleaned. This process includes deleting suspicious records, removing unused data, and optimizing the database structure.

Although you can manually clean the WordPress database, the process can be complex and time-consuming. In addition, deleting the wrong database entry may disrupt website functions or cause pages to break.

A safer option is to use a trusted optimization plugin that automates the cleanup process. Tools such as WP-Optimize can scan and clean your database while reducing the risk of accidental errors.

After installing and activating the plugin, follow these steps:

1. Open the WordPress dashboard.
2. Navigate to WP-Optimize → Database in the sidebar menu.
3. Review the available optimization options and select the items you want to clean by checking the corresponding boxes.
4. Click Run all selected optimizations to begin the cleanup process.

Before performing any database changes, create a full website backup. This precaution ensures that you can restore your data if a plugin mistakenly removes an important record. 

Repair or regenerate the WordPress SitemapLink to heading

A sitemap is a structured file that provides search engines with information about the pages and content on your website. It helps search engines discover, crawl, and index your site more efficiently. However, during a wordpress hacked attack, hackers may target the sitemap to locate vulnerable sections of the website.

If the sitemap becomes corrupted or manipulated, search engines may struggle to crawl your pages correctly. 

After resolving a wordpress hacked issue or removing malware from the site, it is often necessary to generate a new sitemap.

The easiest way to generate a new sitemap is by using a reliable SEO plugin, such as Yoast SEO. Once installed and activated, the plugin can automatically generate a new sitemap based on your current website content.

After generating the updated sitemap, submit it to Google Search Console. This step informs Google that your website has been cleaned and encourages the search engine to crawl your pages again. Over time, the search engine will reindex your content and restore its presence in search results.

Keep in mind that the reindexing process may take some time. In many cases, it can take up to two weeks for your website to appear normally again in the search engine results pages (SERP) after a wordpress hacked incident has been resolved.

Contact your hosting providerLink to heading

If your website runs on a shared hosting environment, there is a possibility that the security issue did not originate from your own website alone. In some cases, a wordpress hacked incident may occur because another website on the same server was compromised, allowing attackers to exploit shared resources or vulnerabilities. 

For this reason, it is important to contact your hosting provider and ask them to investigate whether the breach affects only your website or multiple sites hosted on the same server.

Your hosting provider can also assist with identifying and removing security threats. At a minimum, they should help you regain access to your WordPress admin dashboard if attackers have locked you out. Additionally, they may provide server activity logs that show the IP addresses accessing your website. These logs are valuable for understanding when the intrusion occurred and how the attacker may have gained entry.

If your current host cannot offer adequate support or lacks the tools needed to mitigate a wordpress hacked situation, it may be worth considering a more secure hosting provider that offers stronger security features and proactive support.

ConclusionLink to heading

A wordpress hacked incident can feel overwhelming, but it does not mean your website is beyond recovery. By identifying the warning signs early and following a clear recovery process, you can remove malicious files, restore your site’s functionality, and regain full control of your WordPress environment. 

More importantly, preventing future attacks should be part of your long-term strategy. To strengthen your website’s protection after recovery, consider adding an extra security layer such as W7SFW. This WordPress firewall helps monitor incoming traffic, block suspicious requests, and stop common attack attempts before they reach your website. 

Designed to work easily with WordPress, it can be activated quickly without complex configuration. By enabling W7SFW, website owners can reduce the risk of another wordpress hacked incident and keep their site safer from automated attacks and malicious bots.