My Website Was Hacked: What to Do Right Now

Your website is showing content you didn't put there. Or it's redirecting visitors to a casino site. Or Google is showing a "this site may be hacked" warning. Or your hosting provider emailed you to say they found malware. You're not sure what happened, how bad it is, or whether customer data has been touched. That's a panic moment, so take a breath first. I've recovered hacked WordPress sites and cleaned malware infections before, including an education site that faced security threats and needed both cleanup and hardening (the project is linked further down). Here's what to do, step by step.

Step 1: Confirm You Have Actually Been Hacked

Before you tear everything down, confirm what you are seeing.

Signs your site has been hacked:

• Pages you did not create, especially pharmaceutical or gambling content
• Redirects to unknown sites (sometimes only on mobile or only from Google search results)
• Google Search Console warnings about spam, malware, or phishing
• Your hosting provider flagged malware in your files
• New admin users you did not create
• Modified files (index.php, wp-config.php, .htaccess have been changed)
• Spam emails being sent from your server
• Sudden drop in search traffic with no other explanation

Signs that look like hacking but are not:

• A plugin update broke your site (this is a crash, not a hack)
• Your domain expired and the registrar is showing a parking page
• Your hosting was suspended for non-payment
• A caching issue is showing old or wrong content

If you have confirmed signs of a hack, continue.

Step 2: Do Not Panic-Delete Everything

The worst thing you can do right now is delete files randomly, reinstall WordPress, or restore an old backup without understanding the breach. Why?

If you do not find how they got in, they will get back in. A restored backup with the same vulnerability will be hacked again, often within days.

If you delete evidence, you cannot determine whether customer data was accessed. This matters legally (POPIA requires you to report breaches involving personal data).

Step 3: Take the Site Offline (Carefully)

If your site is actively redirecting visitors or serving malware, you need to stop it from harming your visitors and your reputation. But do it in a way that preserves evidence.

Option A: Maintenance mode. Put up a maintenance page that prevents visitors from seeing the compromised content. This preserves all files and database for investigation.

Option B: Password protect the site. Use .htaccess to password-protect the entire site. Only you can access it.

Do not: Delete the site. Wipe the database. Reinstall everything. Not yet.

Step 4: Change All Passwords

Right now. Every single one.

• WordPress admin passwords (all admin users)
• Hosting control panel (cPanel, Plesk, etc.)
• FTP/SFTP credentials
• Database passwords (in cPanel and in wp-config.php)
• Email passwords (if email runs through the same hosting)
• Any third-party service credentials stored in the site (payment gateways, API keys)

If the attacker has your passwords, changing them is the first line of defense.

Step 5: Scan and Identify the Infection

Check recently modified files using your hosting file manager or FTP, sorted by modification date; files modified at unusual times are suspicious. Check for unknown files, especially PHP files in directories that should only contain images (wp-content/uploads/ is a common hiding place) or files with random-character names. Check .htaccess for RewriteRule lines pointing to external domains. Check wp-config.php for require, include, or eval statements referencing unfamiliar files. Check the wp_users table for admin accounts you did not create, and wp_options for suspicious siteurl or home values. Use a malware scanner: Wordfence (free plugin) for WordPress files, Sucuri SiteCheck (free online scanner) from the outside.

Step 6: Clean the Infection

Replace WordPress core files with a fresh copy from wordpress.org (everything except wp-content/ and wp-config.php). Remove unknown files, being careful not to delete legitimate plugin or theme files. Clean modified files by comparing them against the original versions and removing injected code. Remove unauthorized users. Review and clean the database of any injected content from posts, pages, or options.

Step 7: Find the Entry Point

This is the most important step and the one most people skip. If you clean the hack but do not close the vulnerability, you will be hacked again. Common entry points: outdated plugins or themes (the cause of most WordPress hacks, check every version against the WPScan Vulnerability Database), weak passwords (brute-force attacks against wp-login.php), compromised hosting (a hosting-level problem if another site on shared hosting was hacked), and nulled themes or plugins (a "free" version of a premium theme from an unofficial source likely has a backdoor built in).

Step 8: Harden the Site

Update every plugin, theme, and WordPress core to the latest version. Delete (don't just deactivate) unused plugins and themes. Enforce strong passwords for all users. Install a security plugin (Wordfence or Sucuri) with file integrity monitoring. Limit login attempts. Disable file editing from the WordPress admin (add define('DISALLOW_FILE_EDIT', true); to wp-config.php). Set correct file permissions (directories at 755, files at 644).

Step 9: Check Your Legal Obligations

If your website stores personal data (customer names, email addresses, physical addresses, payment information), you may have a legal obligation to report the breach.

Under POPIA (Protection of Personal Information Act), if there are reasonable grounds to believe personal information has been accessed by an unauthorized person, you must notify the Information Regulator and the affected data subjects. This is not optional.

If you are unsure whether personal data was accessed, err on the side of transparency. "We detected a security incident and are taking precautions" is better than silence followed by a larger breach becoming public.

When to Call a Professional

Call a professional when:

• You cannot find the entry point
• The infection keeps coming back after cleaning
• Your site was hacked through the server (not through WordPress)
• Customer data may have been compromised and you need a proper forensic assessment
• The hack involved your payment processing
• You do not have the technical skills to do the cleanup yourself (there is no shame in this; it is specialist work)

I recovered and secured a WordPress site for iLearn after it faced security threats that required both malware cleanup and hardening. You can see the project at /projects/ilearn-wordpress-site-recovery-security.

If You Only Do Three Things

Confirm it's actually a hack. Change every password. Then get an honest read on the entry point before you rebuild, or call someone who can.

The most common cause is outdated plugins with known vulnerabilities. The most common mistake is cleaning the hack without finding how they got in.

If your site has been hacked and you need someone who has done this recovery work before, tell me the problem.