If you're reading this because you just saw a Google warning, strange redirects, spam pages you didn't create, or an email from your host saying your site was suspended, stop scrolling for a solution and start here: don't panic, don't delete anything yet, and don't assume the worst has already happened to your data. Most WordPress compromises are opportunistic and automated, not a targeted attack on you personally, and most are recoverable without paying anyone a ransom. This post is the ordered list of what to actually do, starting from the moment you notice something is wrong.
One thing up front: if your site stores customer payment information, health data, or other sensitive personal information, treat this as more than a technical cleanup. Beyond the steps below, you may have legal obligations around notifying affected users depending on your location and what data was exposed, and that's a conversation for a lawyer or your data protection officer, not a DIY blog post. Everything below covers the technical cleanup; it isn't legal advice.
Why this happens, in one paragraph
It's rarely your fault in the way people assume. Security firm Patchstack's 2026 State of WordPress Security report counted 11,334 new vulnerabilities disclosed across the WordPress ecosystem in 2025 alone, and the overwhelming majority of these, consistently in the low-to-mid 90s as a percentage, are found in plugins and themes rather than WordPress core itself. Separate research aggregated by industry outlet UnfoldCMS found that roughly 78% of compromised WordPress sites in 2025 had at least one outdated plugin at the time of the breach. Put simply: attackers usually aren't breaking WordPress itself, they're walking through a door left open by one unpatched plugin, and it happens at scale, with estimates from Sophos data cited by WPMayor putting daily WordPress compromises in the thousands worldwide. You're not an unusual target; you're one of many sites hit by the same automated scans.
Step 1: Lock down access before you do anything else
Before scanning, before cleaning, before anything: change your WordPress admin password, your hosting account password, and your FTP/SFTP or SSH password, all of them, right now, from a device you trust. This matters more than it might seem, because credential theft is a bigger factor than most people expect: industry data compiled by Sucuri and Wordfence, cited via security outlet HowToWP, attributes weak or stolen passwords as a contributing factor in 81% of hacked WordPress sites. If an attacker has your old password saved somewhere, cleaning the visible malware without changing credentials just invites them back in.
While you're at it, check your list of WordPress admin users for any account you don't recognize, and remove it. Attackers who gain access frequently create a new admin account as a backdoor precisely so they can get back in even after the original entry point is patched.
Step 2: Put the site in maintenance mode or restrict access, don't necessarily delete it
Your instinct might be to take the site fully offline immediately. In practice, most hosts and security plugins offer a maintenance mode that hides the site from public visitors while keeping it accessible to you for cleanup, which is usually the better move: it stops the malicious content from reaching visitors or search engines without destroying evidence you might need for diagnosis. If your host has already suspended the site for you (common when malware is detected server-side), you likely don't need to do this step yourself, but it's worth confirming with them what triggered the suspension.
Step 3: Back up the site exactly as it is, infection included
This feels counterintuitive, but back up the current infected state before you clean anything. If cleanup goes wrong, or if you need to bring in a professional later, having a snapshot of the compromised state (files and database both) gives you and anyone helping you a reference point. Store this backup somewhere separate from your live hosting, not just in the same account that was compromised.
Step 4: Scan to find out what you're actually dealing with
Run a scan using a reputable security plugin (Wordfence and Sucuri's free scanners are both widely used) or, if your host offers it, a server-side malware scan, which can catch things a plugin-based scanner sometimes misses since it runs outside the potentially compromised WordPress installation itself. Note everything the scan flags: unfamiliar files, modified core files, unexpected code in theme files, or new scheduled tasks (cron jobs) you didn't create.
It's worth knowing the threat landscape has shifted recently in a way that makes this step more important, not less. A 2026 report from Patchstack and security firm Monarx found that attackers are increasingly injecting malicious code directly into legitimate WordPress core, plugin, and theme files rather than dropping obviously separate malicious files, which makes surface-level "does this file look weird" checks less reliable than they used to be, and is a strong argument for using an actual scanning tool rather than manually eyeballing your file list.
Step 5: Restore from a clean backup if you have one, or clean manually if you don't
| Situation | What to do |
|---|---|
| You have a backup from before the infection started | Restore files and database from that backup, then immediately update everything (WordPress core, all themes, all plugins) before bringing the site back online |
| You don't have a clean backup, or don't know when the infection started | Replace WordPress core files, and every plugin and theme, with fresh downloads from official sources (not the files currently on your server); manually inspect your wp-content/uploads folder and database for injected content, since uploads and database entries aren't replaced by reinstalling core files |
| You have no technical confidence in doing either of the above safely | This is the point to bring in a professional cleanup service rather than risk an incomplete cleanup that leaves a backdoor in place |
Whichever path applies to you, don't skip updating everything before you go back live. Restoring an old backup without updating it just puts the same vulnerable version back online, ready to be exploited the same way again.
Step 6: Rotate your WordPress secret keys and salts
This is a step people frequently forget. WordPress uses a set of security keys stored in your wp-config.php file to validate login cookies. If an attacker had access to your site, regenerating these keys (WordPress.org provides a free tool to generate new ones, which you paste into wp-config.php) invalidates any existing login sessions, including any the attacker may have established, forcing everyone, attacker included, to log in again with the new credentials you already changed in Step 1.
Step 7: Check for the aftereffects: Google, your host, and your users
- If Google flagged your site as hacked (visible in Search Console under Security Issues), you'll need to request a review through Search Console once you're confident the site is genuinely clean, not just hidden. Reviews typically take a few days to process, and submitting one before you're actually clean will waste that cycle.
- If your host suspended you, they'll usually want confirmation the malware is removed before reinstating the site; some hosts will do a compromise check on their end even after you've cleaned things.
- If you collect user accounts or customer data on the site, this is where the legal-notification question from the top of this post applies, and it's worth resolving before you consider the incident closed, not after.
What this doesn't mean: the honest limits of DIY cleanup
It's worth being direct about something most quick-fix guides gloss over: a manual cleanup by someone without security experience can miss a backdoor, and a site that looks clean isn't always actually clean. Attackers who've compromised a site once often leave more than one way back in, precisely so that removing the obvious malware doesn't fully lock them out. If your site was hosting genuinely sensitive data, was down for an extended period, or you're not fully confident after cleanup that you've found everything, the honest move is bringing in a security professional for a proper audit rather than declaring victory based on one clean scan.
It's also worth knowing that even a careful, patient site owner can still get hit. Recent security research has found attack chains where credentials are stolen, a malicious plugin is uploaded, and it's activated within roughly 30 seconds, according to a 2026 GoDaddy cybersecurity report. Speed like that means prevention (the next section) matters more than any individual habit, and being hacked isn't proof you did something careless.
Preventing the next one
Once you're clean, the highest-leverage habits going forward, in rough order of impact, are: keeping every plugin, theme, and WordPress core updated promptly rather than "eventually," using strong unique passwords with two-factor authentication on all admin accounts, removing any plugin or theme you're not actively using rather than leaving it installed and unpatched, and using a security plugin that includes a web application firewall for an added layer, while knowing that firewalls alone aren't a complete solution: some research suggests traditional WAFs miss a meaningful share of WordPress-specific attacks, which is another reason patching promptly still matters even with a firewall in place.
Frequently asked questions
Will I lose my Google rankings permanently because of this?
Almost always no, assuming you clean the site properly and submit a security review once it's genuinely clear. Google has seen this exact scenario countless times and has a defined recovery process precisely because hacked-and-recovered sites are common. Rankings can dip during the period the site was flagged, but a clean, promptly handled recovery typically restores your previous standing over time.
I have a strong password. How did this even happen?
Most compromises don't come through guessing your login password directly. They come through a vulnerable plugin or theme, an old version of WordPress core, or credentials that were compromised somewhere else entirely (a data breach on an unrelated site where you reused a password, for instance). A strong, unique password helps, but it's one layer among several, not a guarantee on its own.
Should I pay if I get a ransom demand to restore my site or unlock my files?
Generally, no. Paying doesn't guarantee the attacker will actually restore anything or that they won't come back, since you've now confirmed you're willing to pay. If your files are genuinely encrypted and you have no clean backup, consult a professional incident-response service before considering payment, and treat it as a last resort rather than a first response.
Do I need to tell my hosting provider even if they haven't already suspended my site?
It's a good idea. Hosts often have visibility into server-level issues you don't (other compromised accounts on shared infrastructure, unusual outbound traffic from your account) and some offer free malware removal assistance or can at least confirm whether the compromise has spread beyond WordPress itself to other parts of your hosting account.
Prevention matters more than any single cleanup, and one of the most common preventable mistakes is treating every plugin as equally safe just because it's popular. The next post in this series tackles that directly: how many plugins are actually too many, and why the real risk isn't the number on your plugins page at all.
No comments yet — be the first to share your thoughts.