If you are reading this because your site is showing content you did not put there, redirecting visitors to somewhere else, or flagged by Google as deceptive, start at the first section and work down. The explanation can wait.
If you are reading this in advance, good. The last section covers what makes recovery fast rather than painful.
The first hour
Do these in order. Each one limits the damage.
1. Do not panic-delete anything yet. You need the evidence to find how they got in. Deleting the visible malware without finding the entry point means they return within days.
2. Take the site offline or into maintenance mode. Every hour a compromised site stays up is more visitors exposed, more spam indexed by Google, and more reputational damage. Your host can usually do this in a minute.
3. Take a snapshot of the compromised state. Files and database, labelled clearly as infected. You are not going to restore this, but you will need it to work out what happened. Keep it separate from your clean backups.
4. Change the passwords that matter, from a device you trust: hosting account, WordPress admin, database, FTP and SFTP, and the email account tied to the admin user. Change the email password first, because whoever controls the inbox can reset everything else.
5. Tell your host. On shared hosting they may already know, may have other affected sites, and often have tools and logs you cannot access yourself.
6. Check what data was involved. If the site holds customer personal data, that is a separate obligation from the technical cleanup, covered below.
Confirm it is actually a hack
Not everything that looks like a compromise is one. Before the full process, rule out the ordinary explanations.
| Symptom | Could also be |
|---|---|
| Site shows a white screen | A PHP error after a plugin update |
| Site is slow | Traffic spike, or a host issue |
| Strange redirects | A misconfigured plugin or a stale cache |
| Google warning | A false positive, or a bad ad network script |
| Cannot log in | Session or cookie problem |
Signals that point to a real compromise: admin users you did not create, posts or pages you did not write, files in wp-content/uploads with a .php extension, scheduled tasks you do not recognise, outbound spam from your domain, or a sudden flood of indexed pages for pharmaceutical or gambling terms.
Check Google Search Console. The Security Issues report tells you whether Google has detected something and often what kind. This is also where you will later request a review.
Find how they got in
This is the step people skip, and skipping it is why sites get reinfected.
Four entry points account for most WordPress compromises:
An outdated plugin or theme. By a wide margin the most common. Attacks are automated, scanning for known vulnerabilities in specific plugin versions.
An outdated PHP version. An unpatched interpreter is a standing invitation. PHP 8.2 reaches end of life on 31 December 2026, which makes this timely. See what WordPress owners must do about PHP 8.2.
A weak or reused password, usually on an admin account, often without two-factor authentication.
A compromise elsewhere on the server. On shared hosting, a neighbouring site can be the way in.
Where to look: your host’s access logs around the time the first strange thing appeared, the WordPress users table for accounts created recently, file modification timestamps, and your error logs.
If nobody on your team can read a server log, this is the point to bring someone in. Cleaning without finding the entry point is treating the symptom.
Clean it
Two routes. Be honest about which one applies to you.
Route A: restore from a clean backup
The fastest path, if you have one.
- Identify a backup from before the compromise. Check its date against when the first symptom appeared, and assume the compromise started earlier than you noticed.
- Restore to a staging environment first, not straight over the live site.
- Verify it is actually clean before promoting it.
- Patch the entry point before going live, or you are restoring a site with the same open door.
- Reapply any legitimate content created after the backup date, manually.
The common failure here is restoring a backup that was already infected. If your backups go back only seven days and the compromise is older, this route is closed.
Route B: clean the existing installation
Slower, and more error-prone.
- Replace WordPress core. Download a fresh copy of the same version and overwrite everything except
wp-contentandwp-config.php. - Replace plugins and themes with fresh copies from source. Do not try to clean them individually. Delete anything you do not use.
- Clean
wp-content/uploads. No PHP files belong there. Any.phpfile in uploads is almost certainly a backdoor. - Check
wp-config.phpfor injected code, usually at the very top or bottom. - Check the database, particularly the options table for injected scripts, and the users table for accounts you did not create.
- Check for scheduled tasks, both WordPress cron entries and server-level cron jobs. A common persistence trick is a scheduled job that reinstalls the malware after you clean it.
- Check
.htaccessfor injected redirect rules. - Rotate the security keys in
wp-config.phpto invalidate every existing session.
On scanner plugins: Wordfence and Sucuri are useful for detection and will find most known malware signatures. They are less reliable at guaranteeing you removed everything, particularly obfuscated backdoors. A clean scan is good news, not proof.
When to pay someone
Be realistic. Hand it over if any of these are true:
- You have no clean backup
- The site takes payments or holds customer data
- It has been reinfected once already
- Nobody can read a server log
- It has been down more than a day
A specialist cleanup typically costs less than a week of lost business, and considerably less than the second cleanup after a missed backdoor.
Recover your search visibility
Technical cleanup is half the job. Google may have flagged you, and that does not clear itself.
Request a review in Search Console. Under Security Issues, once you are confident the site is clean, submit a review. Describe what happened and what you fixed. Reviews typically take a few days.
Check what got indexed. Compromised sites often have hundreds of spam pages indexed. Search site:yourdomain.com and look for pages you did not create. Return 404 or 410 for them rather than redirecting them to the homepage, which creates a different problem.
Expect a ranking dip. Traffic usually recovers over weeks once the warning clears, assuming the cleanup was complete. If rankings do not recover, the usual cause is a backdoor that was missed and spam that is still being generated.
Check your email reputation. If the server was sending spam, your domain may be on blocklists, which affects legitimate email. This is separate from the website and is often discovered weeks later when invoices stop arriving.
If personal data was involved
If the compromised site held customer personal data, the technical cleanup is not the whole obligation.
Singapore’s PDPA includes data breach notification requirements, and whether you must notify affected individuals and the PDPC depends on the nature and scale of what was exposed. Get advice rather than deciding this yourself, and do it early, because notification obligations are time-bound.
Document what you know: what data the site held, what evidence exists about what was accessed, when you detected it, and what you did. That record is what any assessment will rest on. Our guide to PDPA compliance for websites covers the wider obligations.
Make the next one unlikely
Most of this is unglamorous and most sites skip it.
| Measure | Why it matters |
|---|---|
| Automatic updates for core, plugins, themes | Closes the most common entry point |
| Two-factor authentication on every admin account | Defeats password attacks entirely |
| Remove unused plugins and themes | Deactivated is not removed. The files are still there |
| A current PHP version | An unpatched interpreter is the second most common route |
| Off-server backups, tested | A backup you have never restored is a theory |
| 30 days of backup retention minimum | Seven days is not enough when you notice late |
| Least-privilege user roles | Not everyone needs to be an administrator |
| File integrity monitoring | Tells you something changed before a visitor does |
The two that do most work are automatic updates and two-factor authentication. Neither costs anything.
On backups specifically: the single most useful thing you can do this week is restore your backup to a staging site and confirm it works. Most people discover their backup is broken at the worst possible moment.
For the broader picture, see website security best practices for Singapore SMEs and brute force attack prevention.
Frequently asked questions
How do I know if my WordPress site is hacked?
Common signs are admin users you did not create, content you did not publish, unexpected redirects, PHP files in the uploads folder, outbound spam from your domain, or a security warning in Google Search Console. Slowness or a white screen alone are more often plugin errors than compromises.
What should I do first if my site is hacked?
Take the site into maintenance mode, snapshot the compromised state for evidence, change passwords for hosting, WordPress, database and the admin email starting with the email account, and notify your host. Do not delete the malware before you have identified how they got in.
Can I clean a hacked WordPress site myself?
Sometimes. Restoring from a clean backup taken before the compromise is the most reliable route, provided you patch the entry point before going live. Manual cleaning is error-prone because backdoors are designed to be missed. Get help if you have no clean backup, if the site handles payments or personal data, or if it has already been reinfected.
Why did my site get hacked again after I cleaned it?
Almost always a backdoor or a scheduled task that was missed, or the original entry point was never closed. Reinfection within days or weeks is the signature of an incomplete cleanup rather than a new attack.
How long does it take to recover search rankings after a hack?
Google’s security review typically takes a few days once you request it. Traffic usually recovers over several weeks afterwards. If rankings do not recover, the most common cause is remaining malware still generating spam pages.
Will Wordfence or Sucuri find all the malware?
They find most known signatures and are worth running. They are less reliable against obfuscated or custom backdoors. Treat a clean scan as encouraging rather than conclusive, particularly if the site was compromised more than once.
Do I need to tell my customers?
If personal data was involved, Singapore’s PDPA includes breach notification requirements, and whether notification is required depends on what was exposed and at what scale. Take advice early rather than deciding alone, since the obligations are time-bound.
How do hackers get into WordPress sites?
Most commonly an outdated plugin or theme with a known vulnerability, targeted by automated scanning. Then an unpatched PHP version, then weak or reused admin passwords without two-factor authentication, then a compromise of a neighbouring site on shared hosting.
What is the most important thing to prevent this?
Automatic updates for core, plugins and themes, plus two-factor authentication on admin accounts. Both are free and together close the majority of real-world entry points. After that, tested off-server backups with at least thirty days of retention.
If you need this handled now
If your site is down or flagged and you need it dealt with rather than explained, that is work we do: entry point identification, cleanup, Search Console review, and the hardening afterwards so it does not recur.
Ongoing, this sits in website maintenance, which covers the updates, backups and monitoring that make a compromise unlikely and recovery quick. If your current hosting offers no staging and no usable backups, that is worth fixing first: see how to choose the right web hosting.
