What should I do first when my WordPress site is hacked?

Take a full backup of the site as it is now, files and database, before changing anything. That copy is your evidence for finding how the attacker got in. Then decide whether to take the site offline, check Google Search Console for security warnings, and change every credential.

Should I take my WordPress site offline immediately after a hack?

Take it offline right away if visitors are being redirected, served malware or phishing, or the site is visibly defaced. If the compromise looks limited to the backend with no visitor-facing symptoms, you can often leave it running while you investigate, as long as you work quickly.

Can I just restore a backup to fix a hacked WordPress site?

Only if the backup is older than the infection and you also close the entry point. Restoring an infected backup brings the malware back, and restoring a clean one without fixing the vulnerable plugin or stolen password lets the attacker return. Update everything and change every credential right after restoring.

Will Google penalize my site for being hacked?

Google does not penalize you for being a victim, but it can show a security warning in Search and Chrome if it detects malware, phishing or spam content. That hurts traffic until you clean up and request a review in Search Console.

How do I know the hack has been fully fixed?

The malware is removed, the original entry point is closed, and every credential has been changed. Re-check after 24 hours and again after a week. If a file or admin account comes back, something was missed.

Do I have to tell my users or customers about a hack?

It depends on what data the site holds and where you and your customers are. If the site stores personal or payment data, check the breach-notification rules that apply to you, and ask a lawyer if you are unsure.

WordPress Site Hacked? How to Fix It Step by Step

This page covers what to do in the first hours after you find a compromise: what to protect, what to decide, and what order to work in. If you are not sure the site is hacked, run the five-minute check first. When you reach the cleanup itself, How to Remove Malware From a WordPress Site has the file and database commands.

Do not delete anything yet. Wiping suspicious files feels productive, but it destroys the evidence you need to find how the attacker got in. Without closing that entry point, a clean site is usually reinfected within days.

The seven steps at a glance

Back up the site as it is now. Files and database.
Decide: offline or running. Based on what visitors see.
Check Google. Security issues in Search Console.
Scope the damage. Three quick checks.
Change every credential. Hosting first, WordPress last.
Remove the malware. Core, plugins, themes, database.
Close the entry point. Then watch for a week.

Step 1: Back up the site exactly as it is

Before changing anything, copy the infected site: all files and the database. This is not the backup you will restore from. It is evidence you can compare against later, and your host or a security service will ask for it if you need help. From the WordPress folder over SSH:

wp db export ~/infected-backup.sql
tar -czf ~/infected-files.tar.gz .

Without SSH, use your host's backup tool or download the site over SFTP, and export the database from phpMyAdmin.

Step 2: Decide whether to take the site offline

The answer depends on what visitors see right now.

Take it offline if visitors are redirected, served malware or phishing, or the site is visibly defaced. Use maintenance mode or a server-level pause. Every minute it stays up is harm to your visitors.
Leave it running if the problem looks limited to the backend, such as a suspicious file or an unfamiliar admin account, and visitors see nothing wrong. Move quickly through the next steps and treat it as urgent.

Step 3: Check whether Google has flagged the site

Open Google Search Console and go to Security & Manual Actions → Security issues. If Google flagged the site, visitors may already see a warning before they reach it. This is often how owners first learn they were hacked. Write down what the report says. After the cleanup you will request a review, and Google expects specifics about what was found and fixed.

Step 4: Scope the damage with three quick checks

You do not need a full audit yet. Three commands tell you roughly how deep it goes:

wp user list --role=administrator
find wp-content/uploads -name "*.php"
wp core verify-checksums

The first lists administrators, so you can spot one you did not create. The second finds PHP files in the uploads folder, which should hold only media. The third compares WordPress core with the official files. If you cannot use SSH, the detection guide shows how to check the same things from wp-admin and your host's file manager. A spam page that appears when you search site:yourdomain.com usually means the database was changed too, not only files.

Step 5: Change every credential, now

Do this before cleanup, not after. If the attacker still holds a valid login, anything you clean can be undone. Use a computer you trust, since a keylogger on yours would hand over the new passwords. Work in this order, from most to least powerful:

Hosting or cPanel login, plus every SFTP and SSH account. Delete SSH keys you do not recognize and add fresh ones.
The database password. Change it in your host panel, then update DB_PASSWORD in wp-config.php.
Every WordPress administrator and editor. Remove accounts you do not recognize.
The security keys and salts. This logs every existing session out, including the attacker's:
```
wp config shuffle-salts
```
Third-party keys stored on the site, such as payment, email and API keys.

Step 6: Remove the malware

With the site contained, evidence saved and credentials changed, the cleanup is its own process: replacing core, reinstalling plugins and themes, checking the usual hiding places, and cleaning the database. Follow How to Remove Malware From a WordPress Site. If you suspect a hidden login for the attacker, read How to Find a WordPress Backdoor.

Step 7: Find how they got in

The most common mistake is stopping at "it's clean". If the way in stays open, the same attack works again. Check, in this order:

Outdated or abandoned plugins and themes. wp plugin list --update=available shows pending updates. A plugin that has not been updated for years is a risk even if no update is pending. Search the plugin's name in public vulnerability databases such as those run by Patchstack, WPScan and Wordfence.
Pirated or "nulled" themes and plugins. These often ship with malware built in.
Your server's access logs. Look for POST requests to PHP files that should not receive them, especially in wp-content/uploads and plugin folders. Most hosts offer raw access logs in the control panel.
The infected backup from Step 1. Files with the oldest suspicious modification date point toward the first break-in.

After the cleanup, check again after 24 hours and after a week. A file or admin account that returns means something was missed. When the site is clean, request a review from Google under Security issues in Search Console.

Should you restore a backup instead?

Only if the backup is older than the infection and you also close the entry point. Restore it, update WordPress, every plugin and every theme straight away, and change all credentials. A backup taken after the infection started brings the malware back with it.

How SiftWP helps

SiftWP automates the scanning and the safe parts of this sequence over SSH, without adding a plugin to a site that is already compromised. It investigates each finding. Low-risk, reversible issues are fixed automatically. Anything ambiguous, such as an unfamiliar admin account or a plugin that may be needed, pauses and asks you first. Flagged files are quarantined, never deleted outright, so a false positive can be undone.

Start with free credits, no card needed

How to fix a hacked WordPress site