Finding out your website has been hacked is stressful, but most hacked sites can be fully recovered. Act quickly and work through these steps.
Signs your site has been compromised
- Pages you didn’t create, often selling medicines or showing adverts, or visitors redirected to other websites.
- Google showing “This site may be hacked” or your browser showing a red warning page.
- Admin users in WordPress you didn’t create.
- A message from us saying malware has been found.
First steps
- Raise a support ticket straight away. Imunify360 on our servers may already have found and quarantined infected files, and we can tell you what was affected.
- Change your passwords: cPanel (via your client area), WordPress admin users, FTP accounts and the database user.
- Update everything: WordPress itself, every plugin and every theme. Outdated software is the most common way in.
- Delete plugins and themes you don’t use, and remove any admin users you don’t recognise.
Clean up
Restoring a backup from before the hack is often the quickest fix, but only once you’ve closed the hole the attacker used, otherwise it happens again. We can restore from a backup and help you work out what went wrong.
Afterwards
If Google flagged your site, request a review in Google Search Console once it’s clean. Then follow our guide to keeping WordPress secure.