A hacked WordPress site can put revenue, reputation, and customer data at risk. This article shows precisely which immediate actions to take, how to cleanly restore your site, and which long-term security measures are needed to prevent the risk from recurring.
Immediate Check — What to Do First
Put the website into maintenance mode or take it temporarily offline via the host configuration.
Change hosting access, FTP/SFTP, database user, WordPress admin, and email passwords (use strong passwords / a password manager).
Contact your host: request logs (access and error logs) and clarify possible sources of infection.
Monitor live traffic: unusual downloads, high CPU/requests, unknown cron jobs.
Damage Control
Check all administrator accounts and delete unknown ones.
Identify and isolate files with suspicious timestamps, unknown PHP files, or new .php files in upload folders.
Check wp-config.php and .htaccess for tampering; replace temporarily if necessary.
Take important pages/offers offline if they display compromised content.
Backup & Recovery
Create a full backup (files + database) before making any changes.
If clean backups exist: choose a clean state from before the hack date. Check the backup locally, then restore it.
No backup? Manually build a clean system: fresh WP installation + verified themes/plugins + cleaned database import.
Malware Scan & Cleanup
Run automated scans with multiple tools (file system + database).
Manually check for tampering: remove obfuscated eval/base64 strings, unexplained cron jobs, iframes, external redirects.
Check the database for injected spammy post or option entries (wp_posts, wp_options, usermeta).
Compare signatures and modified core files against fresh WP core files.
Plugins & Themes: Audit & Update
Update or remove all plugins/themes that are not actively needed or are outdated.
Only use plugins from trustworthy sources; obtain premium plugins only through official channels.
Keep child themes clean; no unknown snippets in functions.php.
Hardening & Prevention
Enable two-factor authentication (2FA) for all admins.
Set correct file permissions (644/640 for files, 755/750 for directories).
Obscure the admin URL, enable brute-force protection, use login rate limiting and IP blocking.
Install a security plugin (malware scanning, web application firewall, login protection).
Set up regular automated backups to external storage (a separate account).
Set up monitoring: file integrity checks, login alerts, uptime monitoring.
Restoring SEO & Reputation
Check Google Search Console: look for indications of hacked content, request manual actions.
Remove any spam pages or redirect URLs that have appeared and submit a reconsideration request once clean.
Have affected content crawled, update sitemaps, and submit indexing requests.
Post-Incident Checklist
Complete audit report (indicators found, files removed, recovery timeline).
Implement a security plan: weekly/monthly tasks, responsibilities, emergency service contact.
Train users with admin rights: secure password use, phishing recognition.
Acting fast saves time and money. eazyCode Software GmbH takes care of cleaning up, restoring, and securing your WordPress website. We investigate the hack, restore everything safely, and protect your site permanently. Request a free initial diagnosis now – by email or phone. We'll get your website back online quickly and reliably.