My WordPress Website Was Hacked: What to Do First

Security guidance · Checked 31 October 2026

In this guide

1. Start with the symptom you can actually confirm
2. Reduce immediate exposure with your host
3. Preserve a copy before overwriting things
4. Secure access without destroying the recovery path
5. Decide what the recovery work covers
6. Test the recovered site as a customer would
7. What to send in your first enquiry
8. Frequently asked questions

A customer says your website sent them to a strange page. Your host sends a suspension notice. Or you log in and find an administrator you did not create. At that point, the most useful response is a short, controlled plan—not a succession of hurried plugin installs.

You do not need to diagnose the exact malware family before asking for help. You do need to protect visitors, preserve the information a maintainer will need and avoid making the only available recovery copy harder to use.

Start with the symptom you can actually confirm

Write down what happened, the affected URL, the time and how it was observed. Include whether the problem occurred on mobile, after clicking a search result or only when logged out. Keep the original hosting notice or browser warning.

Be precise about uncertainty. “A visitor was redirected from this product page at 10:20” is useful. “The whole server is definitely infected” is a conclusion that still needs evidence.

Do not ask customers to revisit a potentially harmful destination to capture more screenshots. Existing warning text and a description are enough to start the conversation.

Reduce immediate exposure with your host

If visitors are at risk, contact the hosting provider and ask about suitable containment. Depending on the situation, that might involve a safe maintenance response, restricted access or assistance with an already suspended account.

Agree what happens to legitimate enquiries, bookings and orders while access is limited. A blanket redirect to an unrelated domain can create confusion and should not become the default response.

Keep a known, safe alternative contact route available to your customers. Avoid making public claims about the cause or extent of an incident before the evidence is understood.

Preserve a copy before overwriting things

Ask the maintainer to preserve available website files, the database and relevant logs before cleanup, where access permits. Keep that incident copy separate from ordinary operational backups and restrict access to it.

A backup made today may contain the compromise; that does not make it worthless as evidence. It also does not make it suitable to restore publicly without review. The official WordPress hacked-site FAQ is a useful starting reference for investigating and recovering an affected installation.

If your host holds the only backup, request its date, scope and availability promptly. Do not assume the copy includes both the database and uploaded media.

Secure access without destroying the recovery path

Use a trusted device to secure the accounts that control the website: hosting, domain registration, administrative email and WordPress access. Coordinate credential changes with the person handling the incident so sessions, access dependencies and follow-up rotation are addressed in a sensible order.

Review unexpected administrators and integrations with the maintainer. Record what was found before disabling an account that may be relevant to the investigation. Legitimate staff should not share one unrestricted administrator login.

Arrange recovery access privately through temporary invitations or another supported secure method. Do not post passwords, customer exports, private keys or hosting credentials in a public enquiry form.

Decide what the recovery work covers

A useful agreement names the website, the visible problems, available access and the work included. Ask whether the scope covers files, database content, suspicious accounts, redirects, hardening and post-cleanup testing.

Separate a website cleanup from unrelated server administration, a full penetration test or a complete redesign. If the host reports a wider account compromise, the responsible teams may need to coordinate beyond WordPress itself.

Ask for approval before additional work or charges. You should understand what the initial package buys and what could require a separate quotation.

Test the recovered site as a customer would

When work is complete, retest the paths that matter to your business. Visit the affected URL logged out, check the main form, try mobile navigation and review any booking or shopping functions included in scope.

Keep a concise handover: what was found, what changed, which components were updated, what was tested and what remains uncertain. A claim that a scanner found nothing is less useful without knowing what the scanner actually covered.

If Google or a host applied a warning, their review process is a separate step. Website repair does not guarantee immediate removal of a third-party warning.

What to send in your first enquiry

• Your public website URL.
• A short description of the symptoms and when they began.
• Non-sensitive warning text from the host or browser.
• Whether you can still access WordPress and hosting.
• Whether backups are available, if known.

NithuDev’s WordPress malware removal and security recovery service offers a direct enquiry route. Personal contact within minutes refers to the initial response; repair timing is confirmed after assessment. Start with the free recovery quote form, without payment or passwords.

Frequently asked questions

Should I restore the newest backup immediately?

Not without considering whether it contains the same compromise and whether restoring it would lose recent orders or content. Review the available options first.

Can I just change my password?

Changing credentials may be necessary, but it does not remove altered files, injected content or other persistence. Match the response to the evidence.

Can you promise that no data was lost?

No honest recovery assessment can promise that in advance. Available backups, damage and access restrictions determine what can be recovered.

Published by NithuDev. Contact Nithu / Suthakaran Nithursan, website developer and security recovery specialist. About Nithu. Featured artwork is an AI-generated illustration for this guide, not a photograph of a client incident or security evidence.