Your site is redirecting visitors to somewhere unpleasant, Google is showing a warning next to your listing, or your host has emailed about malicious files. It is a bad morning.
The instinct is to start deleting things. Resist it for ten minutes and work through this in order — the cleanup is the easy part, and doing it before you know how they got in guarantees you will be doing it again.
First: contain it
Take the site offline, or put it in maintenance mode. This feels drastic when you are worried about traffic, but a compromised site is actively harming visitors and burning your search reputation with every hour it stays up. Google penalizes sites serving malware quickly and lifts those penalties slowly.
Then change passwords — WordPress admin accounts, hosting control panel, FTP/SFTP, and the database user. Use different ones. If the attacker still has a valid password, everything else you do today is temporary.
Second: work out how they got in
This is the step people skip, and it is the reason sites get hacked twice. Almost every WordPress compromise arrives through one of four doors:
- An outdated plugin or theme. By far the most common. Known vulnerability, automated scanner, done. It does not require anyone to target you.
- A weak or reused admin password. Credential stuffing at scale.
- An abandoned plugin that no longer receives security updates but is still installed and active.
- A compromised local machine. Malware on a computer that has your saved FTP credentials.
Your access logs and file modification dates will usually tell you which. Look at what changed and when, then match that against plugin versions.
Third: clean it properly
Reinstalling WordPress core is straightforward — the core files are replaceable and should be replaced wholesale rather than inspected. Plugins and themes likewise: delete and reinstall clean copies rather than trying to spot the modified line.
The parts that need real attention are the ones you cannot simply overwrite:
wp-config.phpand.htaccess, both common places to hide injected code.- The uploads folder, which should contain media and nothing executable. PHP files in there are a red flag.
- The database — injected scripts in post content, and rogue administrator accounts. Check your user list against people you recognize.
- Scheduled tasks, which attackers use to reinstall themselves after you have cleaned up.
A backup from before the compromise is the fastest clean route, if you have one and you are confident about the date. Restoring a backup that already contains the attacker just resets the clock.
Fourth: close the door
Update everything. Delete plugins and themes you are not using — an inactive plugin is still a file on disk and can still be exploited. Remove any administrator account you cannot account for. Turn on two-factor authentication for admin logins.
Then, if Google flagged the site, request a review through Search Console. That is what removes the warning; cleaning the site does not clear it on its own.
What actually prevents this
Nothing exotic. Keep WordPress, plugins and themes updated — that single habit prevents the large majority of compromises. Run fewer plugins. Use a password manager. Keep backups you have actually tested restoring, because an untested backup is a hope rather than a plan.
If your site is with us
Open a ticket and we will clean it up for you at no charge. We would rather deal with it quickly than have a compromised site sitting on our network, and we have seen most of the variants before.
Support is available 24 hours a day, every day — this is not a problem that waits politely for business hours.