Discovering that your WordPress website may have been hacked is unpleasant. Google might suddenly be showing spam pages you never created, visitors could be redirected somewhere they definitely should not be going, or you may discover unfamiliar administrator accounts, files or security warnings.
The important thing is not to panic, but equally not to ignore it. A compromised website needs to be contained and cleaned, but it is just as important to understand how the attacker got in so that the same route cannot immediately be used again.
Start by working out what you are dealing with
Common signs of a compromise include unexpected redirects, unfamiliar pages appearing in search engines, unknown WordPress administrator accounts, files or plugins you did not install, security warnings from your host, suspicious pop-ups or unusual traffic.
Take screenshots and make a note of what you have found before deleting anything. Information about what changed can sometimes help establish how the site was compromised.
You should also assume that important credentials may have been exposed until you know otherwise. Change the passwords for relevant WordPress administrator accounts, hosting, SFTP, domain or DNS services and associated email accounts. Use unique passwords and enable multi-factor authentication wherever it is available.
If you can still access WordPress, look through the Users area for unfamiliar administrator accounts and check the installed plugins and themes. Be a little careful here. An account or plugin you do not recognise is not automatically malicious, as old developers, agencies and legitimate integrations can remain on websites for years.
Cleaning the visible hack is only half the job
Simply deleting the spam page or reinstalling WordPress does not necessarily solve the problem. You also need to understand how the compromise happened.
Vulnerable or abandoned plugins, stolen passwords, old administrator accounts, outdated WordPress installations and insecure server access are all possible routes. If that vulnerability remains in place, the website can simply be infected again after you clean it.
A clean backup can be extremely useful, but check when it was created. If the site had already been compromised at that point, restoring it could simply restore the compromise too. On active WooCommerce, membership or booking websites, restoring an old database could also remove perfectly legitimate recent data.
A proper cleanup should therefore look at the whole WordPress installation rather than only the obvious hacked page. WordPress core files, plugins, themes, uploads, configuration and database content may all need checking. Where possible, legitimate WordPress files and plugin or theme files should be replaced with known clean versions rather than simply assuming they have not been modified.
Once it is clean, make it harder to happen again
After the immediate problem has been dealt with, update WordPress, themes and plugins, remove software you no longer use, replace abandoned plugins, review administrator accounts and change important credentials. It is also worth reviewing your hosting, backups, monitoring, file permissions and multi-factor authentication.
Security is rarely one magic plugin. It is usually a combination of sensible maintenance, controlled access and good housekeeping. If your website stores personal information and you believe that data may have been accessed or exposed, this means that it is likely a different level of incident. Do not treat it solely as a website repair. We recommend that you preserve relevant evidence and consider what legal, regulatory, contractual or customer-notification obligations may apply to your organisation.
If you think your WordPress website has been compromised, send us the website address and tell us what you have noticed. If you are not completely sure whether it has actually been hacked, that is fine too. We can start by taking a look, work out what appears to be happening and explain the sensible next step.
