It starts with a customer email. “I just wanted to let you know that your website is sending me to some kind of pharmacy site. Thought you’d want to know.”
You visit your own site. It looks completely normal. You check on your phone. Still fine. You start to wonder if your customer was confused, or clicked the wrong link, or perhaps imagined the whole thing.
They didn’t. What they saw was a cloaked redirect, one of the most common WordPress compromises, designed specifically to hide from logged-in site owners whilst serving malicious content to everyone else. You can’t see it because the attackers don’t want you to.
Or maybe it’s less subtle. Maybe Google is showing “This site may be hacked” beneath your business listing in search results. Maybe your host has suspended your account with a brief note about malware. Maybe you’ve found blog posts written in Japanese, or posts full of pharmaceutical links that you definitely didn’t create.
Whatever brought you to this guide, this will help you confirm whether you’ve actually been compromised, help you understand how serious it is, and decide what to do next, in the right order.
First, Are You Actually Hacked?
Before anything else: a significant number of people who suspect they’ve been hacked haven’t been. It’s genuinely useful to know, because the response to “my site has a plugin conflict” is very different from “my site is serving malware.”
Things that look alarming but often aren’t a hack:
A sudden white screen or fatal error is almost always a plugin or theme conflict, especially after an update. If it happened immediately after you (or WordPress) ran an update, start there before assuming the worst. We’ve covered this in detail in WordPress Update Failed? Here’s What to Do.
Unusual slowness on its own is rarely a hack. It’s more commonly a hosting, caching, or plugin issue. If your site is just slow, the Why Is My WordPress Site So Slow? diagnostic is a better starting point.
Problems with logging in, an SSL warning or a sudden design glitch are all worth investigating, but none of them signal a compromise on their own.
Things that are almost certainly a compromise:
These are different. If you’re seeing any of the following, a hack is the most likely explanation:
- Visitors or customers reporting redirects to unknown or clearly malicious sites
- Your own browser flagging your site as dangerous
- Google showing a “This site may be hacked” or “This site may harm your computer” warning in search results
- New admin users in WordPress that you don’t recognise and didn’t create
- Posts, pages or files you didn’t create, especially if they contain pharmaceutical terms, gambling links, or are written in a language that’s not yours
- Unexpected modifications to core files, particularly wp-config.php, .htaccess, or anything inside the wp-includes folder
- Your hosting account suspended with a malware or abuse notice
- A Google Search Console security alert (under Security & Manual Actions, then Security Issues)
The clearest single check: log in to Google Search Console and look at the Security Issues report. If Google has detected malware or hacked content, it will tell you. If you’re not set up in Search Console, Sucuri SiteCheck runs a free external scan in under a minute and will flag most visible compromises.
If you’re seeing something from the first list, you probably have a technical problem to fix, not a security incident. If you’re seeing anything from the second list, read on.
Confirming the Compromise: Four Checks Worth Running
If the signs above have you concerned, the next step is confirming the compromise with tools rather than guesswork. Visible symptoms tell you something is wrong. These checks tell you what, and how far it’s spread.
Google Search Console — Security Issues report
If you have Search Console set up, this is the first place to look. Go to Security & Manual Actions, then Security Issues. Google will tell you directly if it has detected malware, hacked content, or social engineering on your site, and in many cases will show you the affected URLs. If nothing is flagged here, that doesn’t mean you’re clean, as Google only catches what its crawlers have seen. A positive result, though, is definitive.
Sucuri SiteCheck
Sucuri SiteCheck is a free external scanner that checks your site’s visible output against known malware signatures, blacklists, and spam databases. Enter your URL and it runs in under a minute. It catches surface-level compromises well, including redirects, injected spam content, and defacements, but won’t see anything that’s been cloaked from external scanners. Useful as a first pass, not a final verdict.
Wordfence
If you can still log in to your WordPress dashboard, install Wordfence and run a full site scan. The free version is sufficient for this. Wordfence checks your core files, plugins, and themes against known clean versions, and flags anything that’s been modified unexpectedly. This is a more thorough check than an external scanner because it looks at your actual files, not just your site’s output. Run the scan, note anything flagged as modified or unknown, and don’t delete anything yet.
Your host’s malware report
Most managed WordPress hosts run their own malware scanning. If your account has been suspended, the suspension notice should hopefully name the infected files or folders. If it hasn’t been suspended, log in to your hosting control panel and look for a security or malware section. Some hosts on cPanel include tools like ImunifyAV that will show you a file-level report.
Between these four checks, you’ll have a reasonable picture of whether a compromise has occurred and roughly where it is. The results also determine your next decision: how serious is this, and what does the response look like?
How Bad Is It? Understanding the Severity Spectrum
Not every WordPress compromise is the same, and the response that’s appropriate for one type is insufficient or excessive for another. Here’s an honest picture of the range.
Mild: injected spam content
At the lower end, attackers inject spam links or hidden pages into your site, typically to boost the search rankings of pharmaceutical, gambling, or adult sites. Your site continues to function normally for visitors. You may not notice anything until Google flags it or you stumble across pages you didn’t create. The damage to your reputation and rankings is real but limited, and the compromise itself is often contained. With a clean backup and a thorough file audit, this tier is generally recoverable without specialist help, though “thorough” is doing a lot of work in that sentence, and is where most DIY attempts fall short.
Moderate: redirect malware and backdoors
A step up in seriousness. Redirect malware sends visitors, sometimes all visitors and sometimes only those arriving from search engines or on mobile, to malicious sites. Cloaked redirects are designed to be invisible to logged-in owners, which means they can run for weeks before anyone notices. Backdoors are a related problem: hidden entry points left by attackers so the redirects can return even after visible malware is removed. This tier looks cleanable from the outside but rarely is, because removing what you can see doesn’t remove the mechanism that put it there. Re-infection within days or weeks is the most common outcome of an incomplete clean-up.
Severe: full server compromise, data theft, phishing
At the serious end, attackers may have persistent access to your server, customer data may have been exfiltrated, and phishing pages may be hosted on your domain in directories you’d never think to check. Your site may also be operating as part of a spam or attack network. This tier may carry legal and regulatory implications depending on what data your site holds, particularly if you process payments or store customer information. It requires a professional response, and depending on your circumstances, may require disclosure to affected customers or the ICO.
The Honest Difficulty
The gap between these tiers is significant, but the signs visible to a non-technical owner often aren’t. A cloaked redirect and a spam link injection can look identical from the WordPress dashboard. A severe compromise can leave no visible trace at all for weeks. The scan results from the previous section will give you useful information, but interpreting what they mean, and crucially what they’re not showing you, is where technical judgement matters. If your scans have flagged something and you’re uncertain which tier you’re dealing with, that uncertainty is a reasonable prompt for a professional assessment.
What to Do Right Now
If you’ve confirmed a compromise or you’re reasonably certain one has occurred, work through these steps before doing anything else.
1. Don’t delete anything yet
The instinct to wipe everything and start fresh is understandable. Resist it. Deleting infected files before you understand how the attacker got in removes the evidence you need to close the entry point. A site rebuilt from scratch on top of an unidentified vulnerability will be reinfected, often within hours. Note what you’ve found, where you found it, and leave it in place until you have a plan.
2. Take your site down if it’s actively harming visitors
If your site is redirecting visitors to malicious content, serving phishing pages, or displaying a browser warning, take it into maintenance mode or ask your host to suspend it temporarily. A brief period of downtime is far less damaging to your reputation than customers continuing to be sent to harmful sites. Most hosts can do this at the account level if you can’t access WordPress admin.
3. Change every password, immediately
WordPress admin accounts, your hosting control panel, FTP or SFTP credentials, and your database password if it’s accessible. Do this from a device you trust, not the one you normally use to manage the site, and if there’s any chance that device has been compromised, that applies here too. Use a password manager to generate strong, unique credentials for each. This doesn’t clean the site, but it closes the most obvious re-entry routes whilst you work through the rest.
4. Scan with Wordfence or Sucuri
If you haven’t already run the checks in the previous section, do so now. The results will tell you what you’re dealing with and inform every decision that follows. Don’t skip this step in favour of going straight to restoration, as restoring a backup without understanding the compromise means you may restore the vulnerability alongside the clean files.
5. Restore from a clean backup, if available
A backup that predates the compromise is the cleanest recovery path available. Before restoring, confirm when the backup was taken and cross-reference it against when the compromise likely began. Search Console alerts and the earliest spam content you can find are usually enough to establish a rough timeline. Restoring a backup that was already infected solves nothing. If you don’t have a reliable clean backup, skip to step 6.
6. If it’s anything beyond mild, get professional help
This isn’t a caveat buried at the end. For anything in the moderate or severe tier, DIY clean-up carries a real risk of leaving backdoors in place and facing re-infection within days. If you’re uncertain which tier you’re in, that’s also a reason to get a proper assessment. For active emergencies, our site-hacked fix page is the fastest route to help. If you want ongoing protection with malware removal included as standard, take a look at our WordPress security service — it’s part of every care plan, with real developers reviewing scan results and responding if anything is ever found.
Why DIY Clean-up Usually Falls Short
Removing visible malware from a WordPress site is not technically too difficult. With Wordfence or a similar tool, you can identify modified files, delete injected content, and restore clean versions of core files in an afternoon. The problem is that this addresses the symptom, not the cause.
Most WordPress compromises involve a backdoor, essentially a hidden entry point that is often a few lines of obfuscated code buried in a plugin file, an obscure theme function, or a directory WordPress doesn’t routinely surface in the admin. The backdoor is how the attacker got persistent access, and it’s what allows them to return after the visible malware has been removed. Backdoors are designed to be overlooked. They don’t show themselves in scan results the way injected spam links do, and they’re often written to look like legitimate code to anyone not specifically looking for them.
The practical consequence is predictable: a site that appears clean after a DIY removal gets reinfected. Sometimes within hours, more often within a few days. The owner removes the malware again, and the cycle continues until either the backdoor is found and closed or the site is rebuilt entirely from known-clean files.
A thorough clean-up involves more than file removal. It means auditing every file against a known-clean reference, checking the database for injected content and malicious redirects, reviewing user accounts and access logs for signs of ongoing access, and then hardening the site against the vulnerability that was exploited in the first place. It also means submitting a review request to Google if the site was blacklisted, and monitoring for reinfection in the days that follow. Doing all of them correctly, in the right order, on a site that may still have active threats, is where DIY clean-up tends to break down.
None of this means DIY is never appropriate. For a mild spam injection on a site with a clean recent backup and no signs of backdoor activity, a careful restore followed by hardening is a reasonable approach. The difficulty is knowing which situation you’re actually in, and that assessment is itself the hard part. Understanding how these compromises actually happen — the backdoor included — makes that judgement easier.
How to Stop It Happening Again
If you’re in the middle of an active incident, bookmark this post and come back to it once the immediate problem is resolved. Recovery first, hardening second.
For everyone else, the honest version of WordPress security isn’t a long checklist. Most compromises exploit one of a small number of entry points, and closing those entry points doesn’t require specialist knowledge; it requires consistency. (If you’re weighing up whether WordPress is fundamentally trustworthy as a platform, we’ve answered that honestly here — the short version is that it depends entirely on this kind of consistency.)
Keep everything updated
The majority of WordPress hacks exploit known vulnerabilities in outdated plugins, themes or the WordPress core. It’s not obscure vulnerabilities that nobody knew about, but weaknesses that had been publicly patched, sometimes for months, on sites that simply hadn’t updated. Keeping the WordPress core, plugins, and themes current is the single highest-return security measure available to a non-technical owner. If the updates themselves make you nervous, that’s a separate problem worth solving. We’ve covered the safe way to approach them in WordPress Update Failed? Here’s What to Do — and if you’re not yet using a staging site to test updates before they go live, that’s the place to start.
Use strong authentication
Every WordPress admin account should have a unique, strong password and two-factor authentication enabled. Limit admin accounts to people who genuinely need that access level, as editor or author roles are sufficient for most contributors. Login attempt limiting, available via Wordfence or a dedicated plugin like Limit Login Attempts Reloaded, adds a further layer against brute-force attacks.
Run a security plugin, configured properly
Wordfence and Kadence Security (formerly iThemes/Solid Security) are the most widely used options. Either is fine; neither does much good on default settings. At minimum, enable the firewall, turn on login protection, and schedule regular file scans. The configuration takes twenty minutes and most site owners never do it.
Maintain reliable off-site backups
A clean, recent backup doesn’t prevent a hack, but it transforms recovery from a rebuild into a restore. The backup needs to be off-site rather than just on your hosting account, which may be compromised alongside your site, and recent enough to predate any compromise. UpdraftPlus Premium with remote storage to Google Drive or Dropbox is the most practical setup for most WordPress sites.
Consider ongoing monitoring
The measures above are all things you set up once. Ongoing monitoring, including regular scans, uptime checks, and login alerts, is what catches a compromise early rather than weeks in. It’s also the part most site owners deprioritise until something goes wrong. If you’re evaluating a WordPress maintenance provider, it’s worth confirming that security monitoring is included rather than an optional extra.
The same checklist our developers run through when assessing a site’s exposure. One page, no fluff — work through it independently and know exactly where you stand.
Download free checklist →No email gate. No “tell us about your business” form. Click the link, get the file. If it’s useful, great; if it’s not, you’ve lost about three seconds.
Where to Go From Here
Most hacked WordPress sites are recoverable. The ones that aren’t are usually those where the response was either too slow or too hasty, whether that’s sites left serving malware for weeks, or sites wiped and rebuilt without closing the entry point. The diagnostic and the clean-up order matter.
If your site is compromised right now and you need it dealt with, the site-hacked fix page is the fastest route to getting it looked at. If your site is currently fine and you want to keep it that way, the Security & Malware Removal service covers ongoing protection, monitoring, and clean-up if something does get through.
Either way, the right first step is always the same: confirm what you’re actually dealing with before you act.
The most reliable indicators are things you didn’t create: admin users you don’t recognise, posts or pages containing spam content, or files that have been modified without your involvement. External signs include browser security warnings, a “This site may be hacked” notice in Google search results, or a suspension notice from your host. Google Search Console’s Security Issues report is the most authoritative single check. If Google has detected a compromise, it will tell you directly. Sucuri SiteCheck offers a free external scan if you’re not set up in Search Console.
In most cases, yes. The majority of WordPress compromises, including spam injections, redirect malware, and defacements, are recoverable with a thorough clean-up. The important qualification is thorough: visible malware is relatively straightforward to remove, but the backdoors that allow reinfection are harder to find and easier to miss. A site that appears clean but still has an active backdoor will be reinfected, often quickly. Recovery is most reliable when it involves a full file audit, database scan, and hardening pass rather than removing only what’s immediately visible.
Repeat infections almost always mean a backdoor was not fully removed during the initial clean-up, or the vulnerability that allowed the original compromise was not closed. The two most common root causes are outdated plugins or themes with known security flaws, and incomplete malware removal that left re-entry points in place. If your site has been cleaned and reinfected more than once, the clean-up itself needs revisiting rather than repeating.
It depends on the severity and scope of the compromise. A contained spam injection on a site with a clean recent backup can be resolved in a few hours. A moderate compromise involving redirect malware and backdoors typically takes longer, particularly if the infection has spread across multiple files or been running for some time. Severe compromises involving persistent server access or data theft take longer still and may involve additional steps such as Google blacklist removal and security hardening before the site is safe to bring back online.
It depends on what data your site holds and what was compromised. If your site processes payments, stores customer personal data, or handles any information covered by UK GDPR, a compromise that may have exposed that data is likely to trigger notification obligations to affected individuals and potentially to the ICO. If your site is a standard brochure or content site with no stored customer data, the obligations are different. This is legal territory rather than technical territory, and if there’s any doubt about your exposure, it’s worth taking advice specific to your situation.
