The short answer
If you suspect a hack, stay calm, write down what you see and when, and contact your host and our team through the support form. Change your email password first, then site and hosting logins, from a device you trust. Do not delete files in a hurry, and never send passwords to anyone, including us.
Signs a site may be hacked
Not every odd behavior is a hack, and not every hack is visible. WordPress.org lists indicators that are clear signs: the site is blacklisted by Google or Bing, your host has disabled it, it is flagged for distributing malware, readers say their antivirus is flagging it, you are told it is being used to attack other sites, you notice activity you did not authorize such as new users appearing, or you can see the damage when you open it in the browser.
Other common signs, in plain terms:
- Your pages redirect visitors to a different website, often only visitors coming from Google or on a phone.
- Strange pages or links appear that you did not create, such as pills, gambling or foreign-language text, often visible only in search results.
- Your Google search listing shows a warning, or Google tells you in Search Console that you have a security issue.
- New Administrator users you do not recognize.
- Your host suspends the account, or emails you about unusual traffic or spam.
- Your email to customers goes to spam, or you hear that messages came from you that you did not send.
- You are suddenly locked out and your password no longer works.
- The site is much slower than normal, with no change on your side.
Real problem or false alarm?
| What you see | Likely a hack? | What else it could be | First check |
|---|---|---|---|
| Site is down or shows an error | Sometimes | Hosting problem, expired domain, a bad update. See my website is down | Check whether other people see it, and your hosting status |
| Pages look different or odd | Sometimes | Cached old version, a theme update. See clear cache and refresh | Try a private window and another device |
| Browser warning about the site | Sometimes | An expired certificate. See SSL padlock warning | Read the exact wording of the warning |
| Unknown administrator in the user list | Very likely | A colleague or agency you forgot adding | Ask your team, check your access list |
| Strange pages in Google results | Likely | Old pages from a previous site | Look at the page itself and Search Console |
| A spam-looking email from your domain | Unclear | Someone faking your address, which does not need access to your site | Check with your email provider. See email and your domain |
The first hour, in order
- 1Stay calm and do not delete anything. WordPress.org's guide opens with this for a reason: a clear head recovers the site faster.
- 2Document it. Write down what you see, the time and timezone you noticed it, and what changed recently, such as a new plugin or a theme edit. Take screenshots. WordPress.org calls this the baseline of an incident report, and it helps whoever does the cleanup.
- 3Secure your email account first. Use a device you trust and change its password, and turn on two-factor sign-in. Every other password reset goes through email, so a compromised mailbox undoes everything else.
- 4Contact your host and tell them what you see. The hack may affect more than your site, especially on shared hosting, and the host can confirm whether it is a real compromise. Hosts also keep their own backups.
- 5Send us a request through the support form with the details you documented, as a Google Drive or Loom link for screenshots. A person on our team will follow up. We can reset or restore access without ever seeing a password.
- 6Change the passwords for the site, hosting control panel and any FTP or database access, from a clean device. WordPress.org recommends changing all access points and also covering every user with access. Then change them again once the site is clean.
- 7Check the user list for accounts you do not recognize and note them, but do not delete them yet unless you are sure. They are evidence.
- 8Tell your team. Anyone who uses the site should avoid logging in on shared devices until the cleanup is done.
Never email, message or ticket a password to anyone. That includes us, your host and anyone claiming to be support. If someone asks, it is a warning sign.
What not to do
- Do not reinstall or delete everything in a panic. WordPress.org notes it can be tempting to purge everything and start over, but in many cases that is not possible, and you may destroy evidence about how the attacker got in.
- Do not restore an old backup straight over the top without knowing when the problem began. You may restore the hole along with the site.
- Do not log in to your site from a device that may be infected. WordPress.org points out that infections often begin on the owner's own computer, where trojans steal login details. Run a full antivirus scan, and consider a second scanner.
- Do not pay anyone who contacts you out of the blue offering to fix it.
- Do not click links in emails claiming to be from your host or Google about the problem. Go to the real site yourself.
- Do not post login details in a forum or chat to get help.
How a cleanup works, in general
Cleanup has two goals: remove what the attacker left, and close the way they got in. If you only do the first, they come back.
The usual order is as follows. First, take a full copy of the site as it is now, even though it is infected, so there is a reference. Second, scan the files and database with more than one tool, since no single scanner finds everything. Third, replace core files with fresh copies of the same WordPress version, and review the theme and plugin files. Fourth, remove unknown users and any extra files or code. Fifth, update everything and remove plugins and themes that are not used. Sixth, change every password again and refresh the site's secret keys, which logs out anyone who is still signed in.
The seventh step is the one people skip: find the cause. Often it is an outdated plugin, a stolen password or an infected computer. Without that, you are cleaning a house with the door still open.
For Google, if your site was flagged, the Search Console Security issues report lists the problem under categories of hacked content, malware and unwanted software, or social engineering. Google's help says you should fix every issue on all affected pages, test, and then select Request Review, describing the problem, what you did and the result.
Cleanup is a skilled job, and WordPress.org's guide itself acknowledges that how far you can go depends on your technical ability. Where we are responsible for your site, your project manager will explain how this is handled, and what any plan covers is written in your proposal.
Prevention that actually works
- A unique long password for every account, in a password manager. See reset your password.
- Two-factor sign-in on email, website admin, hosting and Google accounts.
- Few administrators, least privilege and prompt removal of leavers. See add or remove a user.
- Updates kept current. The WordPress hardening guide states that older versions of WordPress are not maintained with security updates, and recommends automatic updates and downloading WordPress only from wordpress.org.
- Remove plugins and themes you do not use, and install only from sources you trust.
- Regular backups stored away from the server, and a restore you have tested.
- An ownership audit so you know who holds each account. See who owns your accounts.
- Search Console registered, so Google can tell you about security issues.
Reporting phishing
Many accounts are taken not by breaking into the site, but by tricking a person. This is phishing. CISA's signs are urgent or emotional language, requests for personal or financial information, shortened links, and email addresses or links that are slightly wrong. It adds that clean grammar proves nothing, because AI can write flawless text.
To report it, do not click any links or attachments. Use the report option near the sender's address, or the report spam button in your mail program, and then delete it without replying or clicking, including unsubscribe links. If you think a message pretending to be from us is not genuine, forward it to us through the support form as a screenshot link and we will tell you.
Example: A hack found through a Google search
Omar owns a small accounting firm. A client mentions that when she searched for his firm, one result showed Japanese text and a link to a shop. Omar opens the page himself and sees nothing wrong, because the bad pages only show to people coming from Google. He writes down what the client saw, with the time, and takes a screenshot. He changes his email password and turns on two-factor sign-in. He tells his host and sends our team a support request with the screenshot link. He does not delete anything. The cleanup finds an outdated plugin as the way in. After cleaning, the site is updated, the passwords are changed a second time and a review is requested in Search Console.
When to ask us
Ask us as soon as you see any of the signs above. It is better to ask about something that turns out to be harmless than to wait on something that is not.
Send a request through the support form and include: the site address, what you saw and exactly when, screenshots or a short Loom video shared as a link, anything that changed recently such as a new plugin, user or password reset, and whether you have already contacted your host. Do not send passwords, one-time codes or backup codes. Our team can restore access without seeing any of them. If you receive a message asking for a password in our name, it is not from us.
