My WordPress site was hacked. What now?

Short answer: If your WordPress site was hacked, change every password (hosting, WordPress admins, FTP, database), back up the site as it is, then restore a clean backup or clean it with a security scanner, update WordPress, every plugin and theme, and remove unknown admin users. Out-of-date plugins are the most common way in.

Spam in your Google results, visitors sent to strange sites, or a warning from your host. Here’s how to tell, and what to do, in order.

Signs your site was hacked

• Google shows your site with casino, pharmacy or foreign-language text you didn’t write.
• Visitors (often only on phones, or only coming from Google) are sent to another website.
• Google or your browser warns “This site may be hacked” or “Deceptive site ahead”.
• Your host suspended the account, or your emails suddenly land in spam.
• WordPress has admin users you don’t recognize.

Hacks are often hidden from the site owner on purpose, so run the free check-up from any device to see what the public sees.

What to do, in this order

1. Don’t delete everything in a panic. You may need the current files to find how they got in.
2. Change every password: hosting account, all WordPress admin users, FTP/SFTP and the database. Use new, long passwords, and turn on two-factor login where offered.
3. Take a backup of the site as it is now, so nothing is lost if a cleanup goes wrong.
4. Restore a clean backup from before the hack, if your host keeps one. That’s often the fastest fix.
5. Update WordPress, every plugin and every theme, and delete plugins and themes you don’t use. An out-of-date plugin is how most small-business sites are broken into.
6. Scan the site with a security plugin such as Wordfence or Sucuri (both have free scanners), and remove anything they flag.
7. Remove unknown admin users and check your site’s email settings haven’t been changed.
8. Ask Google to re-check. If Google flagged the site, request a review in Google Search Console once it’s clean.

Keeping it from happening again

Keep WordPress and plugins updated, keep regular off-site backups, and use strong passwords with two-factor login. Most hacked sites we see are several WordPress versions behind.

Common questions

Should I delete my WordPress site and start over?

Not first: a clean backup from before the hack is usually faster, and the current files help find how they got in.

Which free tools can scan a hacked WordPress site?

Security plugins such as Wordfence and Sucuri have free scanners that flag changed files and known malware.

How do I stop it happening again?

Keep WordPress, plugins and themes updated, delete unused ones, use strong passwords with two-factor login, and keep off-site backups.

Updated October 17, 2026.