Key takeaways
- Most hacked WordPress sites are compromised through an outdated plugin, not WordPress core. Sucuri's hacked-site reports keep finding the same thing: plugins and weak passwords are the two leading causes of infection.
- In the first hour: contain the damage, save a copy of the compromised site, change every password, then clean or restore — in that order. Deleting files before you scan is how owners make a bad day worse.
- A clean daily backup collapses the whole recovery into a single restore. No backup? A professional cleanup costs roughly $99–$590/year depending on the service — the real bill is downtime and lost Google trust, not the cleanup itself.
- The #1 reinfection trap is restoring a backup that still contains the vulnerable plugin that let the attacker in. Update before you go back online.
First: are you sure it's actually hacked?
Before you panic, confirm the hack. We've seen owners spend days "cleaning" a false positive while real malware sat untouched — and we've seen the reverse, owners shrugging off a genuine compromise as a glitch. Check these five signs before you touch anything:
- Google says so. Search for your site. A "This site may be hacked" or "Deceptive site ahead" warning is the most reliable sign you have. Google detects this from its own crawls — trust it over your gut.
- Visitors go somewhere else. Open your site in an incognito window and click around. Hackers often show different content to logged-out visitors than to logged-in admins. If a stranger lands on a pharmacy page, a gambling site, or gets a download prompt you never added, you're compromised.
- Admins you never created. WordPress → Users → All Users. If there's an administrator account you didn't create, the attacker already has the keys.
- Files you never uploaded. PHP files with random names (like x47k2.php) sitting in your uploads folder or root directory. Those are backdoors.
- Your host suspends you. If your host shuts the account down for "malware distribution," that's a diagnosis, not an insult.
None of these are subtle once you know what to look for. If two or more are true, stop reading this section and start the clock. Every hour a compromised site stays live is an hour Google remembers.
Your first hour: do these 7 things in this order
Order matters. The search results for this topic all give you roughly the same checklist — but they rarely explain why the order matters. Each step below protects the next one.
1. Contain the damage (5 minutes)
Put the site in maintenance mode or restrict access from your hosting panel. A visitor landing on malware is not just a bad experience — it exposes your customers to harm and it teaches Google to distrust your domain. Containment comes first because everything else takes longer than you think.
2. Save a copy of the compromised site (10 minutes)
This is the step almost everyone skips, and it's the one professionals consider non-negotiable: make a full backup of the hacked site before you clean anything. Files and database. This copy is your evidence and your insurance — if a cleanup goes wrong, you need the original state to fall back on.
3. Change every password (10 minutes)
Not one password. All of them: WordPress admin, hosting/cPanel, FTP/SFTP, database, and the email account used for admin recovery. Use 16+ character random passwords from a password manager. Attackers steal credentials and reuse them — changing only the admin password while the FTP credentials stay compromised is locking the front door while the back door stands open.
4. Scan before you delete (15 minutes)
Install a security scanner — Wordfence (free) is the standard starting point — and run a full scan. It compares your files against known clean versions of WordPress and flags anything modified or injected. You need this map before you start deleting, because deleting the wrong file breaks the site and deleting only half the malware guarantees reinfection.
The single sharpest insight in this whole post: a hacked site isn't one infected file — it's usually a system of infections across files, the database, and scheduled tasks. Clean one layer and the others rebuild it. That's why the methodical order beats speed every time.
5. Remove the intruders (20–60 minutes)
Delete unauthorized admin accounts. Remove the malicious files the scan flagged. Search the database for suspicious scripts and spam links — hacks live in the database too, not just in files. Check your scheduled cron jobs for anything you didn't add; malware loves to hide there because nobody looks. Replace WordPress core files with clean copies, and regenerate the security salts in wp-config.php (this forcibly logs out every session, including the attacker's).
6. Close the door they walked through (15 minutes)
Update WordPress core, every plugin, and every theme — including the inactive ones. Then delete anything you don't actually use. The vulnerability that let the attacker in is probably still sitting in your plugin list, waiting. Going back online without patching it is mopping the floor while the tap is still running.
7. Ask Google to take the warning down (10 minutes)
Once the site is clean, go to Google Search Console → Security Issues and request a review. Explain the cleanup steps you completed. Google typically re-evaluates within 24–72 hours — until then, the warning may still show in search results. Your rankings may dip in the short term; a clean site with a history of quick recovery bounces back.
Should you do this yourself or hire someone?
Honest answer: it depends on what the site is worth and how much you like terminal windows. This is the decision the generic checklists never help you make, so here's the table we wish someone had handed our clients:
| Route | Typical cost | Your time | Pick this when |
|---|---|---|---|
| DIY with free tools (Wordfence scan + manual cleanup) | $0 | 2–6 hours | Simple brochure site, you have backups, no customer data involved |
| MalCare paid | ~$99/year | 30 minutes | You want one-click removal without touching code; good for non-technical owners |
| Sucuri | ~$199.99/year and up | Near zero | You want unlimited professional cleanups done by their team, plus a firewall |
| Wordfence Care | ~$590/year | Near zero | You're already on WordPress and want expert cleanup with a guarantee |
| A developer you trust | Varies ($150–$500 typical) | Near zero | The site is custom, the infection is deep, or customer/payment data may be exposed |
A note on those prices: they're from this year's published plans and they change, so treat them as the right ballpark, not a quote. The pattern that matters: the cleanup itself is cheap compared to the damage. A brochure site down for a week loses leads. A store serving malware to customers loses trust it took years to build.
If customer names, emails, order data, or payment details were anywhere near the compromised site, stop the DIY route and call a professional — or your host's security team — immediately. That is not a cleanup problem anymore; it's a data-breach problem with legal obligations.
The 4 traps that bring the hack right back
Roughly half of the "my site got hacked again" stories we hear trace back to one of these four mistakes. They're all avoidable, and all four are things the step-by-step guides mention in passing without saying why they cause reinfection:
- Restoring a dirty backup. Your clean backup from last month still contains the vulnerable plugin version the attacker exploited. Restoring without updating everything first is a time machine back to the original hack. Always: restore → update everything → scan → go live.
- Changing one password. Attackers harvest every credential they can find. If you change the WordPress password but leave the FTP and database passwords, they walk straight back in through the side door.
- Cleaning files but not the database. The Japanese-keyword hack and redirect malware live in the database, not in files. A file-only cleanup looks successful for about a day. Then the redirects come back.
- Keeping the nulled theme or abandoned plugin. That "free" premium theme from a sketchy download site, or the plugin that hasn't been updated in two years — these are the actual entry points in most small-business hacks. Delete them. The $49 license for the real thing is the cheapest security product that exists.
How it actually happened (so it doesn't happen again)
Here's the uncomfortable truth that reframes the whole problem: you probably weren't targeted. Almost nobody hacks a small business website personally. Bots scan millions of sites for known plugin vulnerabilities and exploit whatever they find. Your site wasn't chosen — it was findable.
Sucuri's annual hacked-website reports have been consistent on this for years: the leading cause of infection is vulnerable plugins and themes, not WordPress core, and the other top cause is weak passwords, especially on admin panels. In one of their reports, only 37% of infected WordPress sites were even running an outdated core — WordPress's auto-updates have largely fixed the core problem. The plugins, which don't auto-update as aggressively and which owners install and forget, are the real attack surface.
That means prevention isn't a mystery. It's maintenance. Specifically:
The prevention stack that fits a small-business budget
| What | Cost | Why it matters |
|---|---|---|
| Daily off-site backups (UpdraftPlus or your host's) | Free – ~$70/yr | A clean backup turns a hack from a disaster into a 30-minute restore |
| Auto-updates for plugins and themes | Free | Closes the vulnerability window bots exploit; this single setting prevents most hacks |
| Delete unused plugins and themes | Free | Every installed plugin is attack surface, even inactive ones |
| Two-factor authentication on admin | Free | Kills the weak-password attack vector outright |
| Malware scanning (Wordfence free or Sucuri SiteCheck) | Free | Catches infections early, before Google does |
| A firewall (Cloudflare free tier, MalCare, or Sucuri) | Free – ~$199.99/yr | Blocks the malicious traffic before it reaches your site |
The whole free column — backups, auto-updates, deleting junk, 2FA, scanning — costs nothing and prevents the overwhelming majority of small-business hacks. The paid options buy you convenience and response time, not fundamentally different protection.
The 30-second version
If you remember nothing else: contain it, copy it, change every password, scan before deleting, clean files and the database, patch the hole, then ask Google for a review. Skip the order and you'll be doing it twice. And when you're clean, set up daily backups and auto-updates — the two free things that make this a story you tell once instead of a story you repeat.
If you'd rather not do any of this at 11pm with your heart pounding — that's a reasonable call. Run our free site audit and we'll tell you honestly whether your site is at risk and what it would take to fix it, or book a call and we'll handle the cleanup ourselves. Our services and pricing are both public, so you'll know exactly what it costs before you say a word to us.
