{
    "title": "WordPress site hacked: how to respond and fix it",
    "seo_title": "WordPress site hacked: what to do and how to fix it",
    "h1": "WordPress site hacked: how to respond and fix it",
    "description": "WordPress site hacked: contain the attack, copy the hacked state, regain access, repair, get off blocklists and notify your regulator within 72 hours.",
    "lead": "The response plan after a WordPress hack: the first ten minutes, the severity grid, the credentials to change, what to reinstall, the Google review, GDPR breach notification and the following thirty days.",
    "language": "en",
    "locale": "en-US",
    "type": "article",
    "url": "https://www.wp-masquerade.com/wordpress-site-hacked-what-to-do/",
    "canonical": "https://www.wp-masquerade.com/wordpress-site-hacked-what-to-do/",
    "markdown": "https://www.wp-masquerade.com/wordpress-site-hacked-what-to-do/index.md",
    "json": "https://www.wp-masquerade.com/wordpress-site-hacked-what-to-do/index.json",
    "published": "2026-07-13T06:00:00+00:00",
    "modified": "2026-11-05T20:53:47+00:00",
    "site": {
        "name": "WP Masquerade",
        "url": "https://www.wp-masquerade.com/"
    },
    "translations": [
        {
            "language": "en",
            "hreflang": "en-US",
            "title": "WordPress site hacked: how to respond and fix it",
            "url": "https://www.wp-masquerade.com/wordpress-site-hacked-what-to-do/",
            "markdown": "https://www.wp-masquerade.com/wordpress-site-hacked-what-to-do/index.md",
            "json": "https://www.wp-masquerade.com/wordpress-site-hacked-what-to-do/index.json"
        },
        {
            "language": "fr",
            "hreflang": "fr-FR",
            "title": "Site WordPress piraté : comment réagir et le réparer",
            "url": "https://www.wp-masquerade.com/fr/site-wordpress-pirate-que-faire/",
            "markdown": "https://www.wp-masquerade.com/fr/site-wordpress-pirate-que-faire/index.md",
            "json": "https://www.wp-masquerade.com/fr/site-wordpress-pirate-que-faire/index.json"
        },
        {
            "language": "es",
            "hreflang": "es-ES",
            "title": "Web WordPress hackeada: cómo reaccionar y repararla",
            "url": "https://www.wp-masquerade.com/es/web-wordpress-hackeada-que-hacer/",
            "markdown": "https://www.wp-masquerade.com/es/web-wordpress-hackeada-que-hacer/index.md",
            "json": "https://www.wp-masquerade.com/es/web-wordpress-hackeada-que-hacer/index.json"
        },
        {
            "language": "de",
            "hreflang": "de-DE",
            "title": "WordPress gehackt: richtig reagieren und die Website reparieren",
            "url": "https://www.wp-masquerade.com/de/wordpress-gehackt-was-tun/",
            "markdown": "https://www.wp-masquerade.com/de/wordpress-gehackt-was-tun/index.md",
            "json": "https://www.wp-masquerade.com/de/wordpress-gehackt-was-tun/index.json"
        },
        {
            "language": "it",
            "hreflang": "it-IT",
            "title": "Sito WordPress hackerato: come reagire e ripararlo",
            "url": "https://www.wp-masquerade.com/it/sito-wordpress-hackerato-cosa-fare/",
            "markdown": "https://www.wp-masquerade.com/it/sito-wordpress-hackerato-cosa-fare/index.md",
            "json": "https://www.wp-masquerade.com/it/sito-wordpress-hackerato-cosa-fare/index.json"
        },
        {
            "language": "pt",
            "hreflang": "pt-BR",
            "title": "Site WordPress hackeado: como reagir e consertar",
            "url": "https://www.wp-masquerade.com/pt/site-wordpress-hackeado-o-que-fazer/",
            "markdown": "https://www.wp-masquerade.com/pt/site-wordpress-hackeado-o-que-fazer/index.md",
            "json": "https://www.wp-masquerade.com/pt/site-wordpress-hackeado-o-que-fazer/index.json"
        },
        {
            "language": "nl",
            "hreflang": "nl-NL",
            "title": "WordPress-site gehackt: zo reageer je en herstel je hem",
            "url": "https://www.wp-masquerade.com/nl/wordpress-gehackt-wat-te-doen/",
            "markdown": "https://www.wp-masquerade.com/nl/wordpress-gehackt-wat-te-doen/index.md",
            "json": "https://www.wp-masquerade.com/nl/wordpress-gehackt-wat-te-doen/index.json"
        }
    ],
    "headings": [
        {
            "level": 1,
            "text": "WordPress site hacked: how to respond and fix it"
        },
        {
            "level": 2,
            "text": "The first ten minutes: contain without erasing"
        },
        {
            "level": 2,
            "text": "Assess the severity to set the right pace"
        },
        {
            "level": 2,
            "text": "Keep a copy of the hacked state"
        },
        {
            "level": 2,
            "text": "Regain access, from the widest to the narrowest"
        },
        {
            "level": 2,
            "text": "Repair: what to replace, what to inspect"
        },
        {
            "level": 2,
            "text": "The response plan, step by step"
        },
        {
            "level": 2,
            "text": "Getting off blocklists and clearing the Google warning"
        },
        {
            "level": 2,
            "text": "Notify: regulator, affected people, police"
        },
        {
            "level": 2,
            "text": "The next thirty days: not getting hacked again"
        },
        {
            "level": 2,
            "text": "What WP Masquerade can do, and what it does not do"
        },
        {
            "level": 3,
            "text": "After the cleanup, lock the doors"
        },
        {
            "level": 2,
            "text": "Frequently asked questions",
            "id": "faq"
        },
        {
            "level": 3,
            "text": "Key takeaways"
        },
        {
            "level": 2,
            "text": "Sources"
        },
        {
            "level": 2,
            "text": "WordPress security, without the noise",
            "id": "wpm-nl-box-title"
        }
    ],
    "body": "Your WordPress site redirects to a casino, shows a hacker’s calling card, or Google flags it as dangerous? The most urgent thing is not to delete files at random. It is to contain the attack, keep a copy of the hacked state, then take back control of your accounts before you repair anything. This guide sets out the order of decisions from the first hours to the following thirty days, the commands worth knowing, and the obligations you must not miss (including the 72-hour GDPR deadline).\n\nNot sure yet that you have been hacked? Start with [the checks that tell you whether your WordPress site is hacked](https://www.wp-masquerade.com/detect-hacked-wordpress-site/). Looking for the technical detail of the cleanup, file by file? It is in [our step-by-step procedure for cleaning a hacked WordPress site](https://www.wp-masquerade.com/clean-hacked-wordpress-site/). This article is your response plan: who does what, in which order, and how to avoid reinfection.\n\n## The first ten minutes: contain without erasing\n\nAs long as the malicious code is running, it can steal data, send spam or infect your visitors. But wiping everything straight away destroys the traces that will help you find the way in. The right compromise:\n\n1. **Take the site offline for visitors**: a maintenance page at server level (an `.htaccess` rule that serves a static page with a 503 status, or your host’s option), not a WordPress plugin that depends on the compromised code.\n2. **Alert your host** with a support ticket: they may already have detected the infection, can block outgoing email and have logs you cannot see.\n3. **Start an incident log** kept off the server: time, finding, action, who. It will be useful for your insurer, a contractor, a police report or the data protection authority.\n4. **Do not restore a backup yet**: you do not know how long the site has been compromised, nor whether the backup is clean.\n\n## Assess the severity to set the right pace\n\nNot every hack calls for the same urgency. The table below helps you decide who to involve and what comes first.\n\n| What you see | Main risk | Priority | Who to involve |\n| --- | --- | --- | --- |\n| Redirects to shady sites, Google warning | Infected visitors, deindexing | Offline immediately | Host, you or a contractor |\n| Indexed spam pages (pharmacy, casino) | Search rankings, reputation | Same day | You, then Search Console |\n| Defaced home page | Brand image | Offline immediately | Host, contractor |\n| Customer accounts, forms or orders exposed | Personal data breach | Immediate, GDPR clock running | Data protection officer, supervisory authority, contractor |\n| Payment form tampered with (shop) | Card theft | Immediate | Payment provider, bank, contractor |\n| Ransom demand or encrypted files | Data loss | Immediate, do not pay | Host, police, national cyber security centre |\n\n*Triage grid: the more third-party data is at stake, the faster you need to act and document.*\n\n## Keep a copy of the hacked state\n\nBefore any repair, download a full copy: files (over SFTP or as an archive created by your host), the database (SQL export) and, if possible, the server access logs for the last 30 days. Store it off the server, separate from your clean backups, and label it clearly “infected” so you never restore it by mistake. This copy is what lets you date the intrusion, and therefore pick a backup from before it.\n\nTo date the intrusion, look in this copy for recently modified PHP files and the creation date of unknown accounts. This is where the [3-2-1 backup rule](https://www.wp-masquerade.com/wordpress-backups-3-2-1-strategy/) makes all the difference: without an older off-site copy, cleanup is the only option left.\n\n## Regain access, from the widest to the narrowest\n\nChange passwords from a clean computer, starting with whatever grants the most power: an attacker who keeps access to your mailbox or your hosting account can start all over again.\n\n1. The mailbox that receives password resets, then your hosting account and domain registrar (turn on two-factor authentication).\n2. SFTP and SSH accounts, the control panel (cPanel, Plesk) and the database user, then update `wp-config.php`.\n3. WordPress keys and salts, which logs out every open session, including the attacker’s.\n4. Every administrator account, then application passwords and plugin API keys (payments, email delivery, remote backup).\n\nWith [WP-CLI](https://www.wp-masquerade.com/glossary/wp-cli/), the basic checks take just a few commands:\n\n```\n# New keys and salts: every session is closed\nwp config shuffle-salts\n\n# Administrator accounts: spot the ones you do not recognise\nwp user list --role=administrator --fields=ID,user_login,user_email,user_registered\n\n# Scheduled tasks: an unknown task can reinfect the site\nwp cron event list --fields=hook,next_run_relative,recurrence\n\n# Site addresses: a redirect can hide here\nwp option get siteurl\nwp option get home\n```\n\n## Repair: what to replace, what to inspect\n\nThe principle: anything that can be reinstalled from an official source gets replaced, not cleaned line by line. Only what is yours (content, media, settings, custom theme) is inspected by hand.\n\n| Item | Action | Command or method |\n| --- | --- | --- |\n| WordPress core | Reinstall as is | `wp core verify-checksums` then `wp core download --force --skip-content` |\n| Plugins and themes | Delete, then reinstall from wordpress.org or the vendor | `wp plugin verify-checksums --all`, never a “nulled” version |\n| Uploads folder | No PHP file should be there | `find wp-content/uploads -name \"*.php\"` |\n| mu-plugins and drop-ins | Check every file | `wp-content/mu-plugins`, `object-cache.php`, `advanced-cache.php` |\n| .htaccess and wp-config.php | Compare with a clean version | Redirects, `auto_prepend_file`, unknown includes |\n| Database | Look for injected scripts | `wp_options` and `wp_posts` tables: `<script>` tags, `eval`, `base64` |\n| Users | Delete unknown accounts | Reassign their content, check for changed roles |\n\n*Replace rather than clean: a file reinstalled from the source is clean, a file cleaned by hand only might be.*\n\nThe classic hiding places for a [backdoor](https://www.wp-masquerade.com/glossary/backdoor/) are precisely where nobody looks: an innocuous-looking file in uploads, a mu-plugin that does not appear in the plugin list, a [cron](https://www.wp-masquerade.com/glossary/cron-wp-cron/) task that recreates the deleted file. If you cannot find how the attacker got in (vulnerable plugin, reused password, stolen FTP credentials), the site will be hacked again within days: that is the time to call in a professional.\n\n## The response plan, step by step\n\n*The seven stages of the response: the first two limit the damage, the rest prevent reinfection.*\n\n## Getting off blocklists and clearing the Google warning\n\nOnce the site is clean, and only then, bring it back online and get the warnings lifted:\n\n- **Google Search Console**: the “Security issues” report lists what Google found. Fix everything, on every page, then click “Request review” and describe the problem, what you did and the result. Google says a review for malware or hacked content takes from a few days to a few weeks: do not send another request while the first one is pending. More detail in [our guide to the “dangerous site” warning](https://www.wp-masquerade.com/google-dangerous-site-warning/).\n- **Indexed spam pages**: let them return 404 or 410 and use the temporary removals tool for the most visible ones. The full method is in [our article on SEO spam and deindexing](https://www.wp-masquerade.com/hacked-wordpress-site-seo-spam-deindexing/).\n- **Other lists**: check the domain with scanning services such as VirusTotal or Sucuri SiteCheck, and the IP address your email is sent from on anti-spam blocklists if your messages land in spam folders. Each list has its own delisting procedure.\n\n*A repair filmed from start to finish, from the first diagnosis to hardening, by Taz Tech Media (December 2025): useful to see the screens before you get started.*\n\n## Notify: regulator, affected people, police\n\nIf the attacker could access personal data (customer accounts, contact forms, orders, a subscriber list), this is a personal data breach under the GDPR. Article 33 requires you to notify your supervisory authority (the ICO in the UK) within 72 hours of becoming aware of it, unless the breach is unlikely to result in a risk to people. Where the risk is high (passwords, bank details, sensitive data), Article 34 also requires you to inform the people concerned. In every case, record the breach in your internal register. Our article on GDPR, logs and WordPress security explains what to keep.\n\n- **Incomplete notification**: you can notify within 72 hours with what you know, then add to it. A partial notification on time is better than a perfect one that is late.\n- **Online shop**: alert your payment provider if the checkout may have been tampered with. They will tell you what to do about the cards.\n- **Help and reporting**: your national cyber security centre (the NCSC in the UK) publishes guidance and can point you to the right service, and a police report is often required by your insurer.\n\n## The next thirty days: not getting hacked again\n\nA site cleaned without fixing the cause is often reinfected. During the following month:\n\n- Update everything that is left, delete unused plugins and replace abandoned plugins.\n- Turn on [two-factor authentication](https://www.wp-masquerade.com/wordpress-two-factor-authentication/) for every account that can publish or administer.\n- Run integrity checks again every week and watch for new administrators.\n- Test a backup restore, for real, on a staging site.\n- Write a short post-incident review: cause, duration, cost, what was missing.\n\n## What WP Masquerade can do, and what it does not do\n\nLet us be clear: WP Masquerade is not a cleanup tool. It does not scan for malware, does not filter traffic like a firewall and does not back up your site. For the repair, use a scanner (Wordfence, MalCare, Sucuri) or a professional, and the backup tool of your choice.\n\nIt comes in afterwards, to reduce the chances of another incident and warn you earlier. The free version moves the login page, blocks XML-RPC and removes the traces that reveal WordPress to bots. WP Masquerade Pro adds [mandatory two-factor authentication by role](https://www.wp-masquerade.com/features/two-factor-authentication/), login limiting, [core integrity checks](https://www.wp-masquerade.com/features/wordpress-integrity-check/), the administrator activity log and [vulnerable plugin alerts](https://www.wp-masquerade.com/features/vulnerable-plugin-alerts/), which would often have let you patch the flaw before the attack.\n\n### After the cleanup, lock the doors\n\nStart with the free version, then move to Pro for two-factor authentication, core integrity and vulnerability alerts: from €59 excl. VAT per year for one site, €149 excl. VAT for 10 sites.\n\n[See Pro pricing](https://www.wp-masquerade.com/pricing/)\n\n[Download the free version](https://www.wp-masquerade.com/download/)\n\n## Frequently asked questions\n\n**Should I restore a backup or clean the site?**\n\nRestore if you have a backup from before the intrusion and you know when the intrusion happened. Otherwise, clean or rebuild. Either way, fix the entry point and change every credential, or the attacker will come back.\n\n**How long does Google take to remove the warning?**\n\nAfter a review request in Search Console, Google quotes a few days to a few weeks for malware and hacked content. The delay depends on how thorough the cleanup is: any remaining issue makes the review fail.\n\n**Do I need to notify the regulator for simple SEO spam?**\n\nNot if no personal data could be viewed or copied. But an attacker who was able to add pages has often had access to the database: check what it contains (accounts, orders, form entries) before concluding, and record your assessment in your breach register.\n\n**Is changing the WordPress keys and salts enough?**\n\nNo. It closes open sessions, but an attacker who knows a password, has a hidden administrator account or a backdoor gets straight back in. Salts are one part of a whole: passwords, accounts, files and scheduled tasks.\n\n**When should I call in a professional?**\n\nWhen you cannot find the entry point, when the site gets reinfected after cleanup, when customer or payment data are at stake, or when the site generates your revenue. Ask for a written report: cause, affected files, actions taken.\n\n### Key takeaways\n\n- Contain first (site offline at server level), erase later.\n- Keep a copy of the hacked state, off the server, to date the intrusion.\n- Change credentials from the widest (mailbox, host) to the narrowest (WordPress accounts), then the salts.\n- Reinstall core, plugins and themes from the source; inspect uploads, mu-plugins, cron, .htaccess and the database.\n- Personal data affected: notify your supervisory authority within 72 hours.\n- Without fixing the cause, reinfection is likely.\n\n## Sources\n\n- WordPress.org: FAQ My site was hacked (https://wordpress.org/documentation/article/faq-my-site-was-hacked/)\n- Google: Security issues report (https://support.google.com/webmasters/answer/9044101?hl=en)\n- GDPR Article 33: notification of a personal data breach to the supervisory authority (https://gdpr-info.eu/art-33-gdpr/)\n- WP-CLI: wp config shuffle-salts (https://developer.wordpress.org/cli/commands/config/shuffle-salts/)\n\n## WordPress security, without the noise\n\nOne e-mail when something matters: new attacks seen in the wild, plugin updates and practical guides. No spam, unsubscribe in one click.",
    "categories": [
        "Monitoring and response"
    ],
    "format": "application/json"
}