WordPress site hacked: what should you do?

A hacked WordPress site often shows strange signs: visitors redirected to gambling or pharmacy websites, pages in a foreign language in Google, an unknown administrator, a red warning in the browser. This guide explains how to react in the right order, clean the website and stop it happening again.

Most WordPress hacks do not target your business in particular: they are bots that test vulnerable plugins or weak passwords on a massive scale.

How can you tell if your WordPress site is hacked?

• Your website redirects to another site, sometimes only on mobile or from Google.
• Google shows "This site may be hacked" or the browser shows a red warning page.
• Pages, posts or links you did not create appear.
• An unknown administrator account appears in Users.
• PHP files with strange names appear in httpdocs, especially in wp-content/uploads.
• Your mailbox or domain sends emails you did not write.
• You can no longer log in to the admin area.

Clean your hacked website step by step

1. Change your Upkyo client area password: My profile, Change my password.
2. Change the passwords of every WordPress administrator account, your FTP accounts and your database.
3. Work out when the hack happened, then open your hosting, Backups, and choose a backup from before that date.
4. Click Restore and confirm, see Restore a backup of your website.
5. Immediately update WordPress, themes and plugins, see Update WordPress, plugins and themes.
6. Delete unused plugins and themes, and any you do not recognise.
7. Check the list of WordPress users and delete unknown accounts.
8. Check the website in a private window, from a computer and a phone.

What if there is no clean backup?

If the hack is old or you do not know how long it has been going on, the cleanup is done by hand:

• Reinstall the WordPress files: download the same version from wordpress.org and replace the wp-admin and wp-includes folders. Do not touch wp-content or wp-config.php at this stage.
• Reinstall plugins and the theme from their official source rather than keeping the existing files.
• Inspect wp-content/uploads: this folder should only contain images and documents. A .php file there is almost always malicious.
• Check wp-config.php and .htaccess: look for added code, often unreadable (long strings of characters, eval, base64_decode).
• Check the database: scripts can be injected into posts or into the site options.

Use Files or an FTP account for these tasks, see Connect with FTP or SFTP. If you are not comfortable doing it, open a ticket from /submitticket.php describing what you found.

How do hackers get into a WordPress site?

• An outdated plugin or theme: by far the most common cause.
• A "premium" theme or plugin downloaded for free from an unofficial website: these often contain hidden code.
• A weak or reused password on an administrator account.
• An old, forgotten website on the same hosting that was never updated.
• An infected computer that leaked your FTP or WordPress credentials.

After the cleanup: prevent it happening again

• Update WordPress, themes and plugins regularly from the Security section of your site in Your WordPress sites.
• Use a recent, supported PHP version, see Change the PHP version.
• Give each administrator a long, unique password, and keep the number of administrators low.
• Add two-step verification to the WordPress login with a well-known plugin.
• Create a manual backup before every major change.
• Delete test sites and old installations you no longer use.

If Google has flagged your website

Once the website is clean, log in to Google Search Console, open the security issues section and request a review. Describe what you fixed. The warning disappears once Google confirms the website is safe.

Frequently asked questions

My WordPress site redirects to another website, what should I do?

That is the most common symptom of a hack. Change your passwords, restore a backup from before the problem appeared, then update everything to close the hole.

Do I need to delete everything and start again?

Rarely. A clean backup followed by updates is enough in most cases. A full reinstall is only useful if no clean backup exists and manual cleanup fails.

Was my data or my customers' data stolen?

Not always: many hacks only aim to place links or redirects. If your website stores personal data (customer accounts, orders), assume it may have been accessed and check your notification obligations.

How do I stop my WordPress site being hacked again?

Keep WordPress, themes and plugins up to date, use unique passwords and remove anything you no longer use. Most repeat hacks come from a hole left open after the first cleanup.

Can Upkyo support help me?

Yes: open a ticket from /submitticket.php or write to support@upkyo.com, 24/7. Give the website address, what you found and since when.