What to do the moment your WordPress site is hacked

Discovering your website has been hacked is a stomach-drop moment. The instinct is to start deleting things and hope it goes away. Don't. The first hour matters, and a few calm, deliberate steps will save you from making it worse.

1. Don't panic-delete

Deleting files at random destroys the evidence you need to understand how the attacker got in. If you clean without finding the entry point, they walk straight back in a week later. Slow down.

2. Take a full backup first — even of the hacked site

Snapshot everything as it is: files and database. A compromised backup is still forensically useful, and it means nothing is lost while you work.

3. Put the site into maintenance mode

If the site is defaced, redirecting visitors to spam, or serving malware, take it offline for visitors while you work. Protecting the people who trust your site comes first.

4. Change every password and rotate keys

WordPress admin, hosting, database, FTP/SFTP, and any connected email. Assume credentials are compromised. While you're there, regenerate your WordPress security keys (salts).

5. Find the entry point before you clean

Most hacks come in through an outdated plugin or theme, a weak password, or a known vulnerability. Identify the door before you sweep the floor — otherwise you're just tidying up for the next visit.

6. Clean thoroughly, then harden

Remove the malware, injected code, and any hidden backdoors, replace core files with clean versions, and then close the vulnerabilities so recovery doesn't just return you to where you started.

When to call for help

If you're seeing a Google “this site may be harmful” warning, a full defacement, or you simply can't find the source, that's the moment to bring in someone who has done this before. Recovery is methodical work, and a calm second pair of hands is often the fastest route back online.