Roughly 13,000 WordPress sites get hacked every single day. If yours currently looks off, strange redirects, an unfamiliar admin user, a browser security warning, spam pages suddenly appearing in search results, here’s exactly what to do, in the right order.
Step One: Isolate the Site Immediately
Maintenance Mode First, Investigation Second
The moment you suspect a hack, put the site into maintenance mode to prevent further damage and protect visitors before doing anything else. This stops the compromise from actively spreading to visitors, distributing malware, or serving spam content, while you work through the recovery steps.
Step Two: Change Every Password, Not Just One
The Single Biggest Contributing Factor
81 percent of hacked WordPress sites involved weak or stolen passwords as a contributing factor. This is the single most common thread across compromised sites, which makes this step non-negotiable rather than optional.
Reset WordPress admin, hosting account, FTP or SFTP, and the database, all of them, not just the account that seems to have been the entry point. An attacker who gained access once frequently plants additional credentials as a backup way back in.
Step Three: Scan for Malware Properly
A Visual Check Isn’t Enough
Using a dedicated scanning tool to find malicious files and code injections catches what a manual look through the file structure will almost certainly miss. Injected malicious code is frequently disguised to look like legitimate theme or plugin files, which is exactly why a proper scanner matters here.
Step Four: Restore From a Clean Backup When You Can
The Fastest Genuine Path Back to Normal
If a recent, uninfected backup exists, restoring it is typically the fastest way to recover, faster and more reliable than manually cleaning an already-compromised site file by file, where a single missed piece of injected code can leave a backdoor in place.
This is also the strongest argument for maintaining regular, tested backups stored somewhere separate from the live site itself, before a hack ever happens, since a backup taken after the compromise began is just as infected as the live site.
Step Five: Update Everything Before Going Back Live
Patch the Actual Entry Point
Update WordPress core, every theme, and every plugin immediately, before bringing the site back online. The median time from a vulnerability’s public disclosure to mass exploitation is around 5 hours, which means whatever specific vulnerability let an attacker in needs patching before the site returns, not sometime after.
Where Most Vulnerabilities Actually Come From
The majority of WordPress vulnerabilities come from plugins rather than WordPress core itself, and 43 percent can be exploited without any authentication at all. A site running several plugins that haven’t been updated recently is carrying meaningfully more risk than one running a lean, actively maintained plugin set.
After the Site Is Clean, Two Jobs Remain
Tell Google the Site Is Fixed
If the compromise injected spam pages or triggered a browser warning, cleaning the files is only half the recovery. Google may still be serving warnings or holding a manual action against the site. Requesting a review in Search Console once the malware is genuinely gone starts that clock, and skipping it can leave a clean site looking dangerous in search results for weeks longer than necessary.
Work Out How They Got In
Restoring a backup returns the site to a working state. It does not close the door that was used. If an outdated plugin was the entry point and you restore a backup that still contains it, you have reset the site to a vulnerable configuration and the same compromise can follow within days.
This is why the update step belongs before the site goes back online rather than after, and why a genuine post-incident question, which plugin, which account, which known vulnerability, matters more than the cleanup itself.
Why Prevention Is Dramatically Cheaper Than Recovery
The Real Cost of a Hack
The average total recovery cost for a small business is around $14,500, once emergency developer time, downtime, lost revenue during the outage, and the months of SEO cleanup often needed to undo injected spam links and any resulting Google manual penalty are all factored in.
What Basic Prevention Actually Looks Like
Keeping WordPress core, themes, and plugins updated on a regular schedule, removing any plugin no longer actively used or maintained, enforcing strong unique passwords with two-factor authentication on admin accounts, and maintaining genuine off-site backups covers the majority of what actually causes hacks in the first place. Our guide on website security basics every business owner should check walks through this checklist in more detail.
Speed of Response Also Genuinely Matters
Because exploitation of a newly disclosed vulnerability can begin within hours, a site that isn’t actively monitored for unusual activity can sit compromised for weeks before anyone notices, by which point the damage, including any SEO impact from injected spam content, has had far longer to accumulate.
The Bottom Line
If your WordPress site is showing signs of a hack, the order matters: isolate it, change every password, scan properly for malware, restore from a clean backup if available, and update everything before bringing it back online. Given roughly 13,000 sites are hacked daily and the average recovery cost runs into the thousands of dollars, ongoing prevention is consistently the cheaper path compared to recovering after the fact.
If you’re not confident your site is properly secured, or you’re dealing with a suspected compromise right now, our website design team can help assess and fix it properly.
WhatsApp Hameed for a quick question, or call +971 56 544 6241 for a free consultation.
A hacked site is rarely a mystery once you look closely. It’s almost always a password, a plugin, or both, left unattended for too long.
