My WordPress site has been hacked. What do I do first?
Finding out your WordPress site has been hacked is a horrible moment. The urge is to start deleting things or to reinstall everything straight away. Please hold off for a moment. A hacked site can almost always be recovered, and the order you do things in matters.
Last updated
The short answer
If your WordPress site has been hacked, do not delete files or reinstall straight away. Tell your web host. Change the hosting, WordPress and email passwords from a different, clean device. Ask the host which backups exist and from what dates. If the site takes payments or holds customer details, put up a maintenance page until it is checked. After that the site is cleaned, restored from a backup made before the break-in, or rebuilt. WaTo Consulting in Adelaide cleans hacked WordPress sites and closes the way in.
Signs your WordPress site has been hacked
Visitors are sent somewhere else
People click through to your site and land on a gambling, pharmacy or fake prize page. It often happens only on phones, or only to people arriving from Google, so you may never see it yourself.
Strange pages under your name in Google
Search for your business name and look at the results. Spam pages or listings in another language under your web address mean someone has planted pages on the site that you cannot see in the menu.
A red warning or a hacked label
Browsers show a full red warning page when Google has flagged a site as unsafe. Google can also mark your listing in its search results as possibly hacked.
Admin users you did not create
Open the Users list in WordPress. An administrator account that nobody in the business recognises is a strong sign. Write the name down and leave it there for now, because it is part of the trail.
Your host has suspended the account
Hosts scan for malware, which is harmful code planted on a site. If they find it, they may switch the site off to protect other customers and their mail servers. It feels harsh, but it is the host doing its job.
A sudden slowdown
A hacked site is often put to work sending spam or attacking other sites. That uses up the hosting account and your own pages crawl. A slow site can have other causes too, so treat this one as a clue.
Who this guide is for
- A customer has told you your website sent them to another site or showed a warning.
- Your host has emailed to say they found malware or have suspended your account.
- Your site has been cleaned before and the same problem has come back.
- You look after the website for a small business and are not sure what to touch first.
What to do in the first hour
- Do not delete or reinstall anything yet. Deleting files in a panic destroys the trail that shows how they got in. Reinstalling WordPress over the top usually leaves the way in open. Take screenshots of what you see and note the time.
- Tell your web host. They may already know. Hosts can see things you cannot, such as which files changed and when. Ask them what they have found and whether they have switched anything off.
- Change your passwords from a clean device. Use a different computer or your phone, in case the one you normally use is part of the problem. Change the hosting, WordPress and email passwords, and do the same for every admin user.
- Ask what backups exist and from which dates. A backup is a saved copy of the whole site. You need to know how far back they go, because the break-in often happened weeks before anyone noticed. Do not restore one yet.
- Take it offline if it handles payments or customer details. Ask your host to put up a maintenance page, which is a simple 'back soon' notice, until the site has been checked. Then log a website job or call us on (08) 7123 0805.
Clean, restore or rebuild, and how WaTo can help
- Clean it. Our malware clean-up service finds and removes the planted files, then closes the hole they came in through. This suits a site with recent orders, bookings or content you cannot afford to lose.
- Restore a backup, then patch. If a copy exists from before the break-in, going back to it is often the quickest path. The hole is still in that older copy, so it has to be closed straight after the restore.
- Rebuild it. For a small site that keeps getting hit, our WordPress rebuild turns it into a code site with no plugins, database or login page. That removes most of the ways in. A typical site takes about a week.
- Keep it clean afterwards. A website maintenance plan keeps updates and backups in hand. A web application firewall, which filters out bad traffic before it reaches the site, adds another layer.
- We clean hacked sites, repair and maintain WordPress, and host on our own Australian servers. We have been Adelaide owned and operated since 2001.
Related questions
Why does my WordPress site keep getting hacked?
There are two usual reasons. Either the hole they used the first time was never closed, or a back door was left behind. A back door is a small hidden file that lets the attacker back in after the visible damage has been cleaned up. A proper clean-up looks for both.
How did they get in?
Most often through an out-of-date plugin, which is an add-on that gives the site extra features. Patchstack's State of WordPress Security in 2026 report counted 11,334 new security holes in WordPress software during 2025, and 91% of them were in plugins. Weak or reused passwords are the other common way. Our guide on keeping WordPress updated explains more.
How do I get the Google warning removed?
Clean the site first. Then ask Google to recheck it through Search Console, which is Google's tool for website owners. Google looks at the site again and takes the warning off once it finds the site clean. Asking before the site is clean only delays things.
Do I have to tell my customers?
Possibly. Australia's Notifiable Data Breaches scheme applies to organisations covered by the Privacy Act, and a breach likely to cause serious harm must be reported to the people affected and to the Office of the Australian Information Commissioner (OAIC). The OAIC website explains who is covered, including which small businesses. This is general information, so check with the OAIC or a lawyer about your own case.
Can I just restore last week's backup and carry on?
Only if last week's copy is from before the break-in, and often nobody knows that yet. Planted files can sit quietly for weeks. Even a clean backup still has the hole that let them in, so it needs patching straight after it is restored.
Could my email or office computers be affected too?
Usually a hacked website stays a website problem. It is worth a closer look if the same password was used elsewhere, or if staff have noticed odd logins or emails. Our guide on what to do if you've been hacked covers office computers and email.
How WaTo can help with this
- Malware cleanup
- Website rescue and repair
- Website maintenance
- Web application firewall
- WordPress rebuild
Site hacked right now?
Call us on (08) 7123 0805 or log a website job. Tell us what you have seen, who hosts the site and whether it takes payments or holds customer details. We will work out with you whether to clean it, restore a backup or rebuild it.
Mon to Fri, 8:30am to 5pm
