It usually starts one of three ways. Your homepage suddenly advertises a casino. Google shows pharmacy spam under your business name. Or your hosting company emails you the words nobody wants to read: "malware detected on your account."
Take a breath. A hacked WordPress site is fixable — I clean them for a living — but the first 24 hours genuinely matter. In that window, Google decides whether to flag your site with a "This site may be hacked" warning, your host decides whether to suspend your account, and the infection decides whether to spread to every corner of your site. Here's the exact order of operations, including the mistakes that make everything worse.
Don't start deleting random files you don't recognize. Don't install five security plugins at once. Don't restore the oldest backup you can find (it may contain the same infection, minus your recent content). And above all, don't ignore it and hope — injected spam multiplies daily, and every day of delay makes the Google cleanup slower.
01Confirm it's really a hack
Sometimes a "hack" is just a broken update. Before panicking, check for the real signs:
- Your homepage or other pages show content you never wrote — gambling, pharma, crypto, or text in another language
- Visitors from Google or phones get redirected somewhere else, while the site looks fine to you
- Searching Google for site:yourwebsite.com reveals pages you never created
- There are admin users in your WordPress dashboard you don't recognize
- Your host or Google Search Console has sent a security warning
Two or more of those? It's a hack. Move to step two now, not tomorrow.
02Back up everything — even the infected version
This feels backwards, but it's essential: take a full backup of the site exactly as it is — files and database — before changing anything. If a cleanup step goes wrong, this copy is your way back. Use your host's backup tool or download the files and export the database, and store the copy somewhere that isn't the same server.
03Change every password
Attackers often keep a copy of your credentials. From a device and browser you trust, change: every WordPress admin password, your hosting/cPanel password, FTP/SFTP passwords, the database password, and the password of any email account that shares the same one. Yes, all of them. A cleanup that skips this step is a cleanup you'll be repeating.
04Take the site offline (briefly)
Put up a simple maintenance page or take the site down temporarily. This protects your visitors from redirects and malware, stops the spam from spreading further, and removes the attacker's audience. A short, controlled outage beats weeks of Google warnings — customers forgive "back soon," they don't forgive being sent to a casino.
05Find the infection
Run a full scan with a reputable security plugin (Wordfence or GOTMLS are the usual tools). Then check the places scanners point to — and a few they don't:
- Recently modified files — especially inside wp-admin, wp-includes, and your theme folder
- The uploads folder — it should hold images, not .php files; PHP in uploads is a classic hiding spot
- Unknown content — posts, pages, and drafts you never wrote, often stuffed with spam links
- wp-config.php and .htaccess — look for added code, strange redirect rules, or unfamiliar database settings
- Scheduled tasks (cron) — infections often schedule themselves to re-generate
06Remove it — including the backdoor
Here's the part most DIY cleanups get wrong: the visible spam is not the infection, it's the symptom. Almost every hack leaves a hidden backdoor — a small, innocent-looking file that lets the attacker walk back in and re-infect everything. This is why so many sites are "cleaned" on Monday and defaced again by Friday.
The reliable approach: delete and replace all WordPress core files with a fresh copy, replace every plugin and theme with clean downloads from their original sources, delete any plugin or theme you aren't actively using (abandoned ones are the #1 entry point), remove the fake admin users, and clear out the injected content. When in doubt about a file, it goes.
If you finish a cleanup and can't answer the question "how did they get in?" — the job isn't done. The hole and the backdoor have to be found, or you're on a timer.
07Patch the hole
Update WordPress core, every plugin, and your theme to the latest versions. Then close the door the attacker used: it is almost always an outdated plugin or theme, a weak or reused password, or an abandoned second installation of WordPress forgotten on the same hosting account. Check for that last one — it's embarrassingly common.
08Get Google (and your host) to trust you again
Only once the site is verifiably clean: open Google Search Console → Security & Manual Actions → Security Issues and request a review, describing what you found and removed. Also request removal of the injected spam URLs if they're still indexed. If your host suspended the account, send them the same summary — hosts reinstate quickly when they see a real cleanup report. Google's warning typically lifts within a few days of an approved review.
Then harden it, so this never happens again
- Two-factor authentication on every admin account
- Automatic updates for plugins and themes — or a weekly update routine
- Off-site backups you control — not only your host's copies
- Delete unused plugins, themes, and user accounts — every one is a door
- A security plugin with a firewall, and login-attempt limits switched on
When to stop DIY-ing and call a professional
Plenty of owners clean a simple infection themselves, and this guide will get you through one. But call for help if any of these are true:
- You're locked out of your own admin panel
- The infection comes back after you've cleaned it once
- Your site takes payments or holds customer data — the liability is real
- Your host has suspended the account, or Google has flagged the site
- There's no clean backup, and every day down is lost revenue
In those cases, the cost of experimenting usually exceeds the cost of a fixed-quote cleanup — and speed matters more than savings.