• wordpress
• 19 October 2026 |
• MSJ Digital

WordPress Website Hacked? How to Fix and Secure It

WordPress Website Hacked? How to Fix and Secure It

If your WordPress site is hacked, do this right now in order: take the site offline or into maintenance mode, change all passwords, scan with a security plugin, remove the malware, update everything, and restore from a clean backup if one exists. Then harden the site so it does not happen again. Panicking and randomly deleting files makes recovery harder — follow the steps below methodically.

This guide walks you through full recovery and long-term hardening. It assumes you have hosting panel (cPanel) access. If you do not, contact your host first — you cannot clean a hack without server access.

Step 1: Confirm and Contain (First 30 Minutes)

Common hack symptoms: Google shows “This site may be hacked,” visitors get redirected to spam sites, unknown admin users appear, strange files or posts show up, or your host suspends the account for malware.

1. Put the site in maintenance mode so visitors (and Google) stop seeing the hacked version. A simple .maintenance file or a maintenance plugin works.
2. Do not pay any ransom or “fix” service that contacted you out of nowhere — many are scams riding on the hack.
3. Change passwords immediately: hosting panel, WordPress admin, database, and FTP — all of them, from a clean device. Assume every credential is compromised.
4. Take a full backup of the hacked site before cleaning. You need a “before” copy in case cleaning removes something you need to inspect.

Then notify your hosting provider — good hosts will confirm the infection scope and sometimes help with initial containment.

Step 2: Scan and Identify the Infection

1. Install Wordfence (free) and run a full scan. It compares your core files, themes, and plugins against official versions and flags modifications.
2. Check for unknown admin users (Users → All Users) — hackers routinely create backdoor accounts. Delete any you do not recognize.
3. Look at recently modified files in cPanel File Manager, sorted by date. Files modified at odd hours that you did not touch are suspects.
4. Common malware hiding spots: wp-content/uploads (PHP files that should never be there), inactive themes, and wp-config.php or .htaccess modifications.
5. Check Google Search Console’s Security Issues report — it tells you exactly which URLs Google flagged.

Wordfence will offer to repair modified core files automatically — let it. For infected theme/plugin files, the safest move is usually deletion and fresh reinstall from official sources.

Step 3: Clean Thoroughly

1. Delete and reinstall WordPress core: via Dashboard → Updates → Re-install Now. This wipes core-level infections cleanly.
2. Delete and reinstall all themes and plugins from wordpress.org or the original vendor. Do not “clean” premium plugin files by hand — reinstall fresh copies.
3. Remove nulled/pirated themes and plugins permanently. These are the number one infection vector for Pakistani WordPress sites. If your site was built with pirated software, this is almost certainly how the hackers got in.
4. Scan the uploads folder for PHP files — uploads should contain only media. Delete any .php files found there.
5. Check and clean the database: look in wp_options and wp_posts for suspicious entries, spam links, or unknown admin accounts. Wordfence and Sucuri’s scanner help here.
6. Reset all salts and keys in wp-config.php (use the WordPress salt generator) to force-logout every session, including the attacker’s.

If a clean backup from before the hack exists, restoring it is often faster and more reliable than manual cleaning — then update everything immediately after restore, since the old backup may contain the vulnerability that was exploited.

Step 4: Update Everything and Verify

1. Update WordPress core, all themes, and all plugins to current versions.
2. Remove inactive themes and plugins entirely — they are attack surface with zero benefit.
3. Re-scan with Wordfence until it reports clean.
4. Test the full site: homepage, key pages, contact forms, checkout if ecommerce. Cleaning sometimes breaks things — verify before going live.
5. Request a review in Google Search Console (Security Issues → Request Review) to remove the “hacked” warning from search results.
6. Take the site out of maintenance mode and monitor closely for 48 hours.

Step 5: Harden the Site So It Never Happens Again

Recovery without hardening is just scheduling the next hack. Implement these permanently:

• Licensed software only: No nulled themes or plugins, ever. This single rule prevents the majority of WordPress hacks.
• Automatic updates for minor core releases and trusted plugins.
• Strong, unique passwords plus two-factor authentication on all admin accounts (Wordfence Login Security handles this free).
• Limit login attempts and consider changing the login URL to slow brute-force attacks.
• Least-privilege users: Give contributors “Editor,” not “Administrator.” Delete accounts of people who no longer need access.
• Web Application Firewall: Wordfence’s firewall or Cloudflare’s free plan blocks most automated attacks before they reach your site.
• Automated off-site backups: Daily backups stored away from your hosting account (UpdraftPlus to Google Drive works well). A backup is the difference between a bad day and a business disaster.
• Reputable hosting: Cheap oversold shared hosting with outdated server software is part of the problem. Quality hosting with malware scanning is part of the solution.

Frequently Asked Questions

How do I know if my WordPress site is hacked?

Warning signs: Google “site may be hacked” notices, redirects to unknown sites, new admin users you did not create, sudden traffic drops, spam content in search results for your domain, or your host suspending the account.

Can I clean a hacked WordPress site myself?

Yes, if you are comfortable with cPanel and following technical steps carefully — this guide covers the full process. If the site earns significant revenue or the infection keeps returning, hire a professional; recurring infections usually mean a missed backdoor.

How much does professional hack cleanup cost in Pakistan?

Typically PKR 15,000–50,000 depending on infection severity, plus hardening. Be suspicious of anyone charging PKR 2,000 — proper cleanup takes hours of careful work.

Will Google remove the “hacked” warning after I clean the site?

Yes. After a full cleanup and verification scan, request a review in Search Console’s Security Issues section. Reviews typically complete within 24–72 hours.

A hacked website is stressful, but it is recoverable — and preventable. If you would rather have professionals handle the cleanup and lock the site down properly, MSJ Digital offers WordPress security cleanup and hardening, plus ongoing maintenance plans that keep your site updated, backed up, and monitored. Our custom website design services include security-first builds, so your next site starts hardened instead of hoping for the best.