My WordPress site got hacked. Now what?

It's stressful, but it's usually fixable. Here's what to do first, and the choices you have for getting back online.

How to tell your site has been hacked

• Visitors are sent to strange websites, or see pop-ups and ads you didn't add
• Google shows a warning such as “This site may be hacked”, or your web browser warns people not to visit
• Your search results show pages in another language or for products you don't sell
• Your hosting company has suspended the account or emailed you about malware
• You can't log in, or there's a new administrator user you don't recognise

What to do first

1. Stay calm and don't delete everything. You may need the files later to find out what happened and to recover your content.
2. Change your passwords, using a different one for each: your hosting account, WordPress, and the email address tied to them. Do this from a computer you trust.
3. Tell your hosting provider. They can often see how the attacker got in, and may be able to restore a clean copy from before the problem.
4. Take a copy of the site as it is now (files and database), so nothing is lost while you decide what to do.
5. Check Google Search Console if you have it set up. It has a Security issues report that shows what Google has found.

Why it keeps happening

WordPress itself is widely used, which makes it a big target. Most break-ins come through outdated plugins and themes, abandoned add-ons nobody updates, or weak and reused passwords. A site that was fine two years ago can become a problem simply because nobody has been keeping it up to date.

Your options

Clean it and carry on. If you have a clean backup from before the hack, restoring it and updating everything can work. It only lasts if the weak spot is closed, and a site that's been broken into once is a likely target again.

Rebuild it as a simple website. For most small business sites that don't take online orders, a plain HTML site does the same job. There's no login page for attackers to try, no database to break into and no plugins to fall out of date, so there's far less to attack. It's also fast. No website or hosting account is ever completely risk-free, but this removes the most common ways in.

Can you keep your Google rankings?

Usually, yes. When a site is rebuilt, each old page address can be pointed to its new one so search engines and customers don't hit dead links. We do this as part of a rebuild.

Want us to look at it?

We recover what's worth keeping, rebuild the site so it looks the same or better, and move it onto Bright1 hosting. Tell us what happened and you'll hear back from the person who'd do the work. You can also see how our rescue and rebuild service works.