If your WordPress site is showing content you didn't add, redirecting visitors to another website, sending spam emails, or your browser is warning you it's unsafe, it's likely been compromised. Acting quickly and in the right order limits the damage and gets you back online faster. Here's what to do first.
1. Isolate the site so the damage doesn't spread
Before you start cleaning anything, stop the bleeding.
- If the site is actively harming visitors (redirecting them or serving malware), switch it to Maintenance Mode using a plugin, or temporarily rename your active theme's folder so the site shows a default error page instead of the hacked content.
- Disconnect any staging or cloned copies of the site from the same database until you've confirmed the infection source.
2. Change every password right away
Assume every password connected to the site is compromised, not just your WordPress admin login.
- Your WordPress admin password, from Users in wp-admin (if you can still log in).
- Your hosting control panel password.
- Your database user password.
- Any FTP account passwords tied to the site.
Use a different, strong password for each one. Reusing the same password across accounts is one of the most common ways sites get re-infected right after cleanup.
3. Take a backup of the site as it is right now
Before you delete or change anything, back up the infected site (files and database) separately from your regular clean backups. This gives you something to fall back on if cleanup goes wrong, and a copy to inspect if you need to figure out exactly how the attacker got in.
4. Scan for malware
Run a malware scan to identify infected files rather than guessing. See How to Scan Your Website for Malware Using ClamAV for the steps in both control panels. Note down every file it flags before you start removing anything.
5. Remove unfamiliar files, plugins, and admin users
Compare what's in your WordPress installation against what you actually installed. Delete anything you don't recognize, especially in the wp-content/plugins and wp-content/uploads folders, where malicious code is often hidden.
In cPanel
- Open File Manager and navigate to your site's root folder.
- Sort files by Last Modified to spot files changed recently that you didn't touch.
- Delete any plugin folder you don't recognize, and rename any suspicious file so it can't run while you investigate further.
- In wp-admin, go to Users and delete any administrator account you didn't create.
In DirectAdmin
- Open File Manager from your DirectAdmin dashboard and browse to your site's root folder.
- Check the modification dates on files the same way, and remove anything unfamiliar.
- Delete unrecognized plugin folders under wp-content/plugins.
- In wp-admin, go to Users and remove any administrator account you don't recognize.
6. Restore from a clean backup if the site is too damaged to clean up
If the infection is widespread or you can't be confident you've removed everything, it's often faster and safer to restore from a backup taken before the compromise. See How to Restore a Website Backup for the steps. After restoring, still change all your passwords and update everything, since the same vulnerability that let the attacker in the first time is still there until you patch it.
7. Update everything and lock the door behind you
Most WordPress hacks come through an outdated plugin, theme, or WordPress core file with a known vulnerability. Once the site is clean:
- Update WordPress core, all themes, and all plugins to their latest versions.
- Remove any plugins or themes you're not actively using, even if they're not the cause. Every inactive one is still a potential entry point.
- Install a reputable security plugin that limits login attempts and monitors for file changes going forward.
Keep regular backups going forward. A recent, clean backup is what turns a hacked site from a crisis into a quick restore.