Stay calm. A hacked WordPress site is recoverable — but the steps you take in the first hour matter enormously. Here's exactly what to do.
🚨 Need immediate help?
If your site is actively infected, contact our emergency team now. We recover WordPress sites in under 24 hours.
Step 1: Don't Panic — But Act Fast
Every minute your site is infected, Google is indexing the malware, visitors are being warned away, and the infection may be spreading. Speed matters. But panicking and clicking everything leads to mistakes — like accidentally deleting clean files or alerting the attacker.
Step 2: Put Your Site in Maintenance Mode
If your site is serving malware to visitors, take it offline immediately. Most hosting panels let you quickly enable maintenance mode or an "under construction" page. This stops visitors from being infected while you work on the problem.
Step 3: Change All Passwords
Change every credential associated with your site immediately:
- WordPress admin account passwords (all of them).
- Hosting panel password (cPanel, Plesk, etc.).
- FTP/SFTP credentials.
- Database password.
- Email accounts associated with the domain.
Step 4: Notify Your Hosting Provider
Most hosts have a security team and can provide useful information — like access logs showing when and how the attacker got in. They can also quarantine the account if needed to prevent spread to other sites on shared hosting.
Step 5: Do NOT Just Reinstall WordPress
This is the #1 mistake people make. A reinstall clears core files but does nothing about:
- Backdoors planted in plugin or theme directories.
- Infected database tables.
- Modified .htaccess or wp-config.php files.
- The original vulnerability that let the attacker in.
A reinstall without full malware removal means you'll be hacked again within days.
Step 6: Get Professional Help
Thorough malware removal requires comparing every file against clean WordPress core files, scanning database tables for injected code, finding and closing backdoors, and identifying the original entry point to prevent recurrence. This is technical, time-consuming work that requires expertise to do correctly.
Our team does this every day. Learn about our emergency recovery service →