What to do if your site is hacked

A calm, step-by-step guide to recovering your website after a hack — what to do first, how to clean up, and how to prevent it happening again.

Discovering your website has been hacked is alarming. Please take a breath. This happens to businesses of all sizes, and it is almost always recoverable. The most important thing right now is to act calmly and methodically — rushing causes mistakes.

This guide walks you through exactly what to do, in order.

Quick summary

First: don't panic, and don't make random changes. Take your site offline if possible, gather information about what happened, and reset everyone's access so the attacker can't keep working. Then restore from a clean backup if you have one, or get professional help to clean the malware. Change every password that could have been involved a second time once the site is clean, and figure out how the attacker got in so you can close that door.

How to know if your site has been hacked

Common signs include:

Visitors are redirected to a different website
Your browser or Google shows a security warning
You see pages, posts, or files you didn't create
Your hosting provider or security plugin sent an alert
The Security issues report in Google Search Console shows a warning, or your site appears with a warning label in Google's search results
Customers report seeing unusual content or being redirected
Your site is suddenly running very slowly or sending spam

Step 1: Stay calm and don't make random changes

When you're stressed, it's tempting to start clicking around, deleting things, or trying multiple fixes at once. Resist this. Random changes can make it harder to diagnose what happened and may erase evidence.

Write down what you observed and when. This information helps you or a professional understand the scope of the breach.

Step 2: Take your site offline temporarily

Putting your site into maintenance mode prevents visitors from being exposed to malicious content while you work on a fix.

In WordPress: many security plugins have a "maintenance mode" option, or you can use a dedicated maintenance plugin
Through your hosting control panel: your host may allow you to suspend or take your site offline
Ask us and we can do this for you

Step 3: Reset access now — and again after the cleanup

WordPress's own guidance is to lock things down early: force a password reset for every user, especially administrators, so the attacker can't keep making changes while you work.

But one reset is not enough. If malware is still present with a backdoor in it, the attacker can get straight back in whatever you set the password to. That is why WordPress tells you to change the passwords a second time once the site is confirmed clean (Step 7 below). Plan for both rounds.

Step 4: Restore from a clean backup if you have one

This is the fastest recovery path. If your hosting provider keeps daily backups — many managed WordPress hosts do; check what yours keeps and for how long — restoring to a backup from before the hack is often the cleanest solution.

Identify the approximate date the hack occurred. Look at when unusual files appeared, when your traffic changed, or when the first complaints came in.

Choose a backup from before that date. You want a clean backup — one made before the malware was introduced.

Restore the backup in a staging environment first, if your host supports this. Confirm the restored site is clean before pushing it live.

Change passwords and update. After restoring, immediately change all passwords (see Step 7 below) and apply all pending updates.

See Why backups are your safety net for why maintaining recent backups is so important.

Step 5: If you don't have a clean backup, get professional help

Manually cleaning a hacked WordPress site requires expertise. Attempting it without that expertise often results in missing hidden backdoors — and the site gets hacked again within days.

Contact us immediately. We can coordinate professional malware removal. WordPress's own guidance also points to security plugins such as Wordfence and Sucuri for scanning a site. Sucuri takes paid malware removal requests and cleans the site for you, and on Wordfence's side the paid Care plan includes hands-on support with security incidents while the Response plan adds 24/7 support from Wordfence's incident response team. See Malware & your website explained for how the two compare.

Don't try to patch around it

Deleting files you find suspicious but not doing a full scan often leaves backdoors in place. A thorough scan and clean is the only reliable approach.

Step 6: Identify and close the entry point

After your site is clean, you need to understand how the attacker got in — otherwise they (or someone else) will get in again the same way.

Common entry points:

Outdated plugin or theme with a known vulnerability — a very common cause
Weak or reused password on an admin account
Compromised web hosting credentials
Abandoned plugin that is no longer maintained
File upload vulnerability in a form or plugin

Your hosting provider's security logs, or a security plugin's log, may show the attack path. A professional cleanup service will typically identify this as part of their work.

Once the site is confirmed clean, change them again — every access point, not just WordPress:

Change your WordPress admin password for every admin account.

Change your hosting account password.

Change your FTP/SFTP password if you use it.

Change your database password (your host or developer can help with this).

If your email was involved: change that too. Check for any forwarding rules or access grants you didn't create.

Enable two-factor authentication on everything that supports it.

Step 8: Remove and review user accounts

In WordPress, go to Users → All Users and review every account. Delete any you didn't create. Change the roles of any that have more access than they need.

Step 9: Update everything

Update WordPress core, all themes, and all plugins to their latest versions. Deactivate and delete any plugins or themes you are not actively using.

Step 10: Submit for review if Google flagged your site

If Google flagged your site, affected pages can appear with a warning label in search results, or visitors can hit a warning page in their browser. Once your site is clean, you need to request a review:

Log into Google Search Console for your site.

Open the Security issues report. It lists what Google found, with sample affected URLs.

Fix every issue listed, across the whole site. Google says fixing only some pages will not earn a partial return to search results.

Request a review. Select Request Review in the Security issues report, and describe what the problem was, what you did about it, and the result.

Then wait. Google says most reconsideration reviews take several days or weeks, and emails you when the review is done. Don't resubmit while a request is still open — that can slow things down further.

Common questions

Do I need to tell my customers?

It depends on what data was involved. If customer personal data (names, emails, payment information) may have been accessed, you may have a legal obligation to notify affected customers and possibly a data protection authority. We strongly recommend speaking with a lawyer if personal data may have been compromised.

My hosting company flagged my site and suspended it. What do I do?

Contact your hosting provider's support to understand what they found. Many hosts will walk you through recovery, or they can point you to their recommended cleanup process. Ask us — we can help coordinate this.

How long does recovery take?

With a clean backup: often a few hours. Professional malware removal without a backup: longer, and it depends on the service — ask them for their turnaround before you sign up. If Google flagged the site, add the review on top: Google says most reconsideration reviews take several days or weeks after you submit.

Will this happen again?

It can happen again if the root cause isn't fixed. The most important prevention steps: keep all software up to date, use strong unique passwords, turn on 2FA, and maintain regular backups. See Securing your WordPress site.

Need a hand?

If you're stuck, email support@chykalophia.com and we'll help. Include your website address and a screenshot if you can.