Hacked WordPress Site — What to Do Right Now

A hacked site isn't always obvious. It may look normal while sending spam or redirecting mobile visitors.

Warning signs

• Google shows a "This site may be hacked" warning
• Redirects to unknown sites, especially on mobile
• Unknown admin users
• Spam pages appearing in Google
• Hosting suspension or sudden slowdown

First steps

1. Don't wipe everything — you may lose clues about how they got in
2. Change every password — WordPress, hosting, FTP, database, email
3. Take a backup of the current state
4. Contact your host

Clean-up

Malicious code must be removed and the entry point closed. Restoring an old backup alone often fails — if the hole remains, they come back.

Prevention

Regular updates, no nulled plugins, strong passwords with two-factor login, offsite backups, Cloudflare and monitoring.