Too long, didn’t read
- Change every password first — WordPress, hosting, FTP, database.
- Don’t restore a backup until you know when the hack happened.
- Scan, then clean — or bring in someone who does this weekly.
- Fix the hole it came through, or you’ll be back here in 30 days.
1. Take a breath, then change every password
The instinct is to start deleting things. Resist it. The very first move is to lock the doors: change your WordPress admin password, your hosting control panel password, your FTP/SFTP password, and your database password. If you have other admin users, reset theirs too — or remove them if you don’t recognise them.
Hackers frequently add a hidden admin account so they can get back in after you “fix” things. Go to Users → All Users and look for anyone you didn’t create.
2. Do not restore a backup yet
This is the mistake we see most often. Restoring last night’s backup feels like the fast fix, but most hacks sit quietly for days or weeks before you notice anything. Restore too recent a backup and you restore the malware along with it. Restore too old a backup and you lose orders, posts and customer data.
If you sell online: put the store in maintenance mode now. A hacked WooCommerce checkout can skim card details. One hour offline is cheaper than a breach notification.
3. Scan the site — then actually clean it
Install a reputable security scanner and run a full scan. It will list infected files. Here’s the uncomfortable part: a scanner finds most of the infection. Cleaning the rest means going through wp-config.php, your theme’s functions.php, the uploads folder, and — often forgotten — the database itself, where injected spam links love to hide.
If that last paragraph made your stomach drop, that’s a reasonable response. This is the point where most business owners bring in help, and there’s no shame in that.
4. Find the hole and close it
Cleaning a hacked site without fixing the entry point is like mopping the floor with the tap still running. In our experience the way in is almost always an outdated plugin or theme, a weak or reused password, an abandoned plugin, or shared-hosting cross-contamination.
Update everything. Delete anything you’re not using — deactivated plugins can still be exploited. Turn on two-factor authentication for every admin.
5. Ask Google to take the warning down
If Google flagged your site, the cleanup isn’t finished until that’s gone. In Google Search Console go to Security & Manual Actions → Security Issues and request a review once you’re confident the site is clean.
6. Make sure it doesn’t happen again
The sites that get hacked twice are the ones where nobody’s job is to keep them updated. That’s genuinely all a care plan is: someone whose job it is to watch. Updates applied, backups taken before the updates, security plugin configured properly, and a human who answers when something looks wrong.