If you think your WordPress site has been hacked, the first job is to stay calm and confirm it, because the fix depends on what kind of hack it is. I have cleaned real infections, including a case where three sites were pumping out gambling spam from a single nulled plugin. This is how you tell if you are actually hacked, what to do first, and how to clean it so it stays clean.
The common signs
- Google shows a warning like “This site may be hacked” under your result, or the browser blocks the page with a red screen.
- Strange pages or redirects. Visitors land on your site and get sent to a gambling, pharma or adult page, often only on mobile or only from Google, so it looks fine when you check it directly.
- Spam content you did not create, new posts, pages or links in a language that is not yours, usually about pills, casinos or loans.
- You cannot log in, or there is an admin user you do not recognise.
- The site is suddenly slow or your host suspended it for sending spam or using too many resources.
- Unknown files in the WordPress folders, often with random names, or core files that changed date recently without you touching them.
One of these can be a coincidence. Two or more together, assume you are hacked and act.
What to do first
- Do not panic and do not delete everything. You need the evidence to find how they got in, or they will just come back.
- Take the site offline or into maintenance mode if it is actively redirecting or serving spam, so it stops harming visitors and your reputation.
- Change every password: WordPress admin, hosting, FTP and database. Do it from a device you trust.
- Back up the current state, infected and all. You want a copy before you start changing things.
- Check who has access. Remove admin users you do not recognise, but note them first.
How a WordPress site actually gets hacked
It is almost never WordPress core itself. In practice it is one of a few things: a plugin or theme that was not updated and had a known hole, a nulled (pirated) plugin or theme that came with a backdoor built in, a weak admin password, or old shared hosting where one infected site infects its neighbours. The gambling-spam case I cleaned came from exactly this, a nulled plugin carrying a backdoor.
How to clean it properly
A security plugin scan is a start, but a real clean-up goes further, because good malware hides and leaves a way back in:
- Reinstall WordPress core fresh, so any changed core file is replaced with a known-good one.
- Replace every plugin and theme with clean copies from the official source, and delete anything nulled for good.
- Hunt the backdoors. Malware plants hidden files and injected code so it can return after a scan. These have to be found and removed by hand, in the files and in the database.
- Rotate the security keys and database password, so any stolen session is dead.
- Check for scheduled tasks and injected admin users that quietly re-infect the site.
- Ask Google to review the site once it is clean, to clear the warning.
If that sounds like a lot, it is, and doing half of it is why sites get re-hacked a week later. I covered a real example in my malware recovery case study, three sites cleaned file by file in a day.
How to stop it happening again
Clean-up is only half the job. Staying clean is about habits: keep WordPress, plugins and themes updated, never use nulled plugins, use strong passwords and two-factor on admin, put a security plugin or firewall in front of the site, keep real backups, and be on hosting that isolates your site from others. Most of this is part of ongoing technical care, and it costs far less than cleaning an infection twice.
When to get help
If the site is actively redirecting, your host has suspended it, or you have cleaned it once and it came back, get someone who does this properly. A botched clean-up leaves a backdoor and buys you a week. A short message with what you are seeing is enough for me to tell you how bad it is and what it takes to fix.