Security and maintenance WordPress site hacked? What to do in the first hours

A hack shows up in many ways: the site redirects to strange pages, Google shows results with titles in another language, the browser warns about a dangerous site, unknown users appear or your host suspends the account. Whatever the sign, the first hours matter. This guide helps you contain the problem calmly.

Signs your site has been compromised

• Redirects to gambling, pharmacy or download sites, sometimes only on mobile or from Google.
• Pages on Google you never created, often with Japanese or other foreign-language text.
• Browser or Search Console warnings about a dangerous site or deceptive content.
• Admin users, plugins or files nobody recognizes.
• Email from your domain suddenly flagged as spam or bouncing.
• A notice from your host about unusual resource use or bulk email.

The first hours: contain it

1. Don’t delete files or reinstall yet: you’d lose the trail of how they got in, and you might wipe your only backup.
2. Contact your hosting provider. They can isolate the account, review logs and check whether other sites on the server are affected.
3. Change passwords from a clean computer (and check which logins your company controls): hosting dashboard, every WordPress admin, database, FTP or SFTP and your domain’s email accounts. Turn on two-factor authentication wherever possible.
4. Make a copy of the current state (files and database), store it separately and label it as compromised. It’s useful for the investigation.
5. If the site is showing harmful content to visitors, put up a maintenance page or ask your host to take it offline temporarily.
6. Check the “Security issues” and “Manual actions” sections in Search Console.

Clean up or restore

If you have a backup from before the attack and know roughly when the infection happened, restoring it is usually fastest. The risk is restoring a backup that was already infected, or leaving the same door open again. So after restoring, update everything and find out how they got in.

If there’s no clean backup, the site has to be cleaned: replace WordPress core, themes and plugins with official copies, look for injected code in the database and content folders, and remove unknown users and files. It’s delicate work, best done with professional help.

At Lume, recovering a compromised site is a specialized service, quoted separately based on the site’s condition.

Close the door

• Update WordPress core, themes and plugins, and remove the ones you don’t use.
• Review your user list and keep only the ones you need, each with the minimum permissions.
• Regenerate the security keys in wp-config.php to log out every open session.
• Make sure your host runs a supported PHP version.
• If Google flagged the site, request a review in Search Console once it’s clean.

If personal data was exposed

If the attack may have affected client or contact data, such as form submissions, talk to a legal advisor. Depending on where you and the affected people are, the law may require you to notify them, and sometimes a regulator, within set deadlines.

Prevention costs less than recovery

Most hacks exploit outdated software, weak or reused passwords and abandoned plugins. Ongoing maintenance with controlled updates, tested off-site backups and monitoring greatly reduces the risk and, if something does happen, lets you detect it and restore quickly.

Frequently asked questions

Is reinstalling WordPress enough?

No. Malicious code usually also lives in the database, themes, plugins or the uploads folder.

How long does recovery take?

It depends on how far the attack spread and whether clean backups exist. Be wary of fixed timelines before anyone has looked at the site.

Can it happen again?

Yes, if the cause isn’t fixed. That’s why everything has to be updated and access reviewed after the cleanup.