My WordPress site was hacked: what to do, step by step

Published on November 6, 2026 · The mitza.es team

Discovering that your website has been hacked is unpleasant, but it can be fixed, and the fix almost always starts with not doing anything rash. This guide is written for owners of WordPress sites at small businesses and freelancers: how to recognise the problem, what to do in the first hour, how to clean the site without it getting reinfected and what obligations you have if personal data is involved. It is no substitute for a forensic analysis in serious cases, but it puts the first steps in order.

Signs that your site may have been hacked

Strange redirects: when you open your site from your phone or from Google you end up somewhere else (casinos, pharmacy, scams). Sometimes it only happens to visitors who arrive from a search engine, which is why the owner doesn't see it.
Pages and text you didn't create: hundreds of URLs with ads for medicines, watches or text in another language. Look for them with site:yourdomain.com on Google.
Google warnings: “This site may be hacked”, “Deceptive site” or a message in the “Security issues” section of Search Console.
Administrator users you don't recognise or changes to plugins and settings that nobody made.
Your hosting suspends the account or warns you about abnormal resource usage, mass email sending or suspicious files.
Emails from your domain end up in spam or you get bounces for messages you never sent.
The site is much slower or breaks after an update, with no clear explanation.

No single sign is proof, but several together are enough reason to act. If you are still not sure it is a hack, a website security audit can confirm or rule it out.

What to do in the first hour

Don't delete everything or reinstall blindly. If you do, you lose the clues about how they got in and they are likely to get in again the same way.
Make a copy of the site exactly as it is (files and database). Even if it is infected, you will need it to investigate afterwards.
Put the site in maintenance mode or restrict it with a password while you work, so you don't harm your visitors or your reputation.
Change the credentials from a clean computer: WordPress administrators, hosting panel, SFTP/FTP access, database and the associated email. Log out of all open sessions. If you need strong passwords, our password generator works in your browser without sending anything.
Notify your hosting provider. They can isolate the account, check the server logs and tell you whether other sites on the same account are infected, which is very common.
Scan your computer with an up-to-date antivirus: in many cases the passwords are stolen from an infected machine, not from the website.

How to diagnose how they got in

Cleaning without knowing how they got in is the number one cause of reinfections. These are the checks that give you the most information:

Versions: were WordPress core, the theme and the plugins up to date? Many attacks use vulnerabilities that have already been fixed. That is what happens with alerts such as the one about the 7.1.4 flaw.
“Nulled” plugins and themes (pirated copies of paid ones): they often come with backdoors built in. If you use any, remove it.
File integrity: if you have terminal access, WP-CLI can compare the core and plugin files from the official repository against the originals: wp core verify-checksums and wp plugin verify-checksums --all. Files that don't match or that shouldn't be there are suspicious.
Recently modified files: check what changed in the last few days, especially in the root, in wp-content/uploads (where there should be no PHP files) and in wp-content/mu-plugins.
Users and database: new administrators, scripts injected into posts and widgets, and the siteurl and home addresses in the options table.
Server logs: odd requests to specific PHP files or mass hits on wp-login.php and xmlrpc.php.
Scheduled tasks: attackers often leave WordPress or server (cron) tasks that recreate the malware every few hours.

How to clean the site without it getting reinfected

There are two ways. The first is the safest; the second is faster but riskier:

Restore a clean copy from before the infection (if you know when it started) and apply all the updates immediately. This is the preferable route. If you don't have reliable backups, now is the time to read about the 3-2-1 backup rule.
Clean it by hand by reinstalling WordPress core and the plugins from official sources, deleting whatever you don't recognise and reviewing wp-config.php, .htaccess and the database. It takes experience: a single forgotten backdoor is enough for them to come back.

Whatever you choose, also do the following:

Renew the keys and salts in wp-config.php to invalidate existing sessions.
Remove plugins and themes you don't use and replace abandoned ones with maintained alternatives.
Change all the passwords again once the site is clean.
Use SFTP instead of FTP and review file and folder permissions.
Check that the hosting account doesn't have other infected sites on it.

A practical tip: a cleanup plugin can help detect problems, but it doesn't guarantee the site ends up clean. If your business depends on the site (online store, bookings), it is worth having someone with experience review it.

After cleaning: Google, customers and the AEPD

Google: if Search Console shows “Security issues”, once you have fixed them request a review from that same screen. Remove the spam pages or return a 410 error for them if any were created. While the warning lasts, your visibility and clicks may drop.
Personal data: if the site had forms, orders, customer accounts or access to data and they may have been affected, the GDPR generally requires you to notify the breach to the AEPD (Spain's Data Protection Agency) without undue delay and, where feasible, no later than 72 hours after becoming aware of it, unless the breach is unlikely to result in a risk to individuals. If you are unsure whether your case requires it, consult your advisor as soon as possible. The article on the AEPD's penalty regime gives you the context.
Customers: if data was exposed or fraudulent emails were sent in your name, tell them clearly and without jargon. It helps you keep their trust.
Public help: INCIBE (Spain's national cybersecurity institute) offers free assistance on 017.

Prevention: what really lowers the risk

Update core, plugins and theme with a maximum deadline for critical patches.
Fewer plugins, better maintained. Every extension is one more door.
Two-step verification and unique passwords for every administrator; keep the number of users with high privileges to a minimum.
Automatic, tested backups, stored off the server.
Web application firewall and monitoring of file changes.
Hosting with isolation between accounts and good support: we explain it in domain and hosting: how to choose.
Ongoing maintenance. A site without maintenance ends up, sooner or later, in one of these situations. You will find the details in website maintenance: what it includes and how much it costs.

Frequently asked questions

Why does my site get reinfected after I clean it?

Almost always for one of these reasons: an undetected backdoor is left behind, the passwords weren't changed, the vulnerable plugin or theme is still installed, or another infected site on the same hosting account keeps reinfecting the first one.

Can Google penalise my site for being hacked?

It isn't a fine, but Google may show warnings to users or remove pages from its results until the problem is resolved. That is why it pays to clean thoroughly and request the review.

Is a security plugin enough to clean it?

It helps detect modified files and block attacks, but it is no substitute for analysing how they got in. Use it as support, not as the only solution.

When is it better to call a professional?

When you hold customer data or run a store with payments, if the infection comes back, if your hosting has suspended the account or if you don't know how they got in. The sooner you act, the smaller the damage.

How we can help at Mitza

We diagnose the source, clean and harden the installation, and then keep it up to date with our website maintenance service. If you need to start with a review, there is the website security audit, or you can tell us about your case on the contact page.

My WordPress site has been hacked: what to do, how to clean it and how to stop it happening again