Around 13,000 WordPress sites are hacked every day, and 92% of infections enter through an outdated plugin. If yours is one of them today: the damage is containable, recovery is a known process, and most sites we clean are back to normal within days. Work the steps in order.
1. Don’t delete anything yet
The instinct is to start deleting suspicious files immediately. Resist it. You need to identify the entry point before you destroy the evidence, or the attacker walks back in through the same door next week. Cleanup without diagnosis is how sites get reinfected four times.
2. Put the site in maintenance mode and change every credential
WordPress admin passwords (all users), hosting panel, SFTP, and database password. Assume everything is compromised. Use a password manager and generate long random passwords, this is not the moment for a memorable one.
3. Check your other sites on the same hosting
Cross-contamination on shared accounts is standard attacker behavior: infect one site, spread to every site the account can write to. If you host five sites on one account, you may have five incidents, and cleaning one while the others stay infected accomplishes nothing.
4. Take a full backup of the infected site
Counterintuitive but important: back up the compromised state before touching anything. If cleanup goes wrong, you can return to a known state, and the infected copy is your forensic record of what happened.
5. Identify the infection and the entry point
Run a scan (Wordfence or a professional service) and read the results for two things: what’s infected, and how it got in. Check plugin versions against known vulnerabilities, look at file modification timestamps around the infection date, and review access logs for the first malicious request. The entry point is almost always an outdated plugin or theme, or a compromised admin account.
6. Clean or restore
Two valid paths. Restore from a clean backup taken before the infection date, then immediately patch the vulnerability that let the attacker in (or you’re restoring your way back into the same hack). Or clean in place: replace WordPress core files entirely, reinstall every plugin and theme from source, and manually inspect wp-content/uploads and the database for injected code and rogue admin users.
When to call a professional: If the site processes payments, handles patient or client data, keeps getting reinfected, or is your primary revenue channel, hand it to specialists. Cleanup done wrong costs more than cleanup done once. We do same-day emergency cleanup, and 2-hour response during business hours.
7. Remove the Google blacklist warning
If Google flagged the site (‘This site may be hacked’ or a red interstitial), open Search Console, go to Security Issues, and request a review once the site is verifiably clean. Reviews typically clear in 24-72 hours. Traffic doesn’t fully recover until this is done, so don’t skip it.
8. Update everything and remove what you don’t use
WordPress core, every plugin, every theme, current versions, no exceptions. Delete (don’t just deactivate) plugins and themes you’re not using: deactivated code is still attackable code sitting on your server.
9. Harden the site so this doesn’t repeat
- Web application firewall (Cloudflare’s free WAF is a real upgrade from nothing)
- Two-factor authentication on all admin accounts
- Login attempt limiting and a non-default admin username
- File integrity monitoring so changes get flagged in hours, not months
- Automatic backups stored off the server, tested by actually restoring one
10. Put maintenance on a schedule, not a memory
The site got hacked because updates didn’t happen. Willpower doesn’t fix that, systems do: either a documented monthly routine someone owns (here’s the checklist) or a maintenance plan where it’s a professional’s job. One therapy practice came to us mid-crisis, blacklisted, intake stopped, and after cleanup and hardening has run 12+ months without a reinfection.
Hacked right now? We start same-day.
Call +1 (941) 337-9757 and say it’s an emergency, or submit through the malware removal page. We respond within 2 hours during business hours and most cleanups finish within 72 hours.
