Is it hacked?
How to tell if your WordPress
site has been hacked.
Hacked sites are built to hide from their owners. Most infections show visitors or Google something different from what you see when you're logged in, so check from the outside.
| What you notice | What it usually means | How to check |
|---|---|---|
| Visitors land on spam, casino or scam sites | A conditional redirect: it often fires only on phones, only from Google, or only once per visitor. | Open the site on your phone, logged out, from a Google search result. |
| Pages you never wrote in Google | Injected spam pages, often in Japanese or selling products, served only to search engines. | Search site:yourdomain.com in Google and scroll past the first page. |
| "This site may be hacked" in results | Google has detected spam or changed content on the site. | Search Console → Security issues. |
| A red "Dangerous site" browser screen | Google Safe Browsing has found malware or phishing on the site. | Search Console → Security issues, or Google's Safe Browsing site status page. |
| Admins you didn't create | The attacker has a way back in, even after files are cleaned. | Users → filter by Administrator; check every account. |
| Your password suddenly stops working | An attacker has changed it, or replaced the login code. | Reset it from the hosting control panel or database, not the login page. |
| A suspension email from your host | The host's scanner found malicious files, or the server sent spam. | Ask the host which files and when; request a snapshot. |
| Your emails start landing in spam | The server has been used to send spam, and your domain or IP is on a blocklist. | Check your domain and server IP against the major email blocklists. |
The warnings, decoded
What each hacked-site
warning actually means.
Different warnings come from different places, and each is lifted a different way. Knowing which one you have tells you what the cleanup has to prove.
The first hour
The first hour after you find
your WordPress site hacked.
Whether you fix it yourself or hire someone, these four steps stop the damage spreading and keep what's needed to find the way in.
Don't wipe or restore yet
Deleting files or restoring a backup straight away destroys the evidence of how they got in, and a recent backup may already be infected.
Keep a copy as it is
Download the files and database in their infected state, or ask your host for a snapshot. It's the record the cleanup works from.
Change every password
Hosting control panel, every WordPress admin, the database and SFTP, from a device you trust. Remove admin accounts you don't recognise.
Tell your host
Ask whether other sites on the same account are affected. If you want help, send the site address and what you've seen in one message.
The cleanup
How to fix a hacked
WordPress site, step by step.
This is the order a proper cleanup follows. Each step closes something the previous one can't, which is why "delete what the scanner flags" rarely holds for long.
Before you call it done
How to know a cleaned
WordPress site is really clean.
"The scan says clean" isn't the same as clean. These checks catch what a single scan misses.
A real example: a fake Google CAPTCHA that a manual search missed and an AI-assisted scan found. Read the case study →
Root cause
How hacked WordPress sites
usually get hacked.
WordPress core itself is rarely the way in. It's almost always something around it.
| Way in | Why it works | How to close it |
|---|---|---|
| An outdated plugin or theme | Known vulnerabilities are published, and bots scan for them automatically. | Update promptly, tested on a staging copy first. |
| An abandoned plugin | Nobody fixes its vulnerabilities any more. | Replace it with a maintained alternative. |
| Nulled or pirated software | Often ships with a backdoor already inside. | Remove it and buy or replace the licence. |
| Weak or reused passwords | Leaked passwords are tried against login pages at scale. | Unique passwords and two-factor login for every admin. |
| A leaked hosting or SFTP login | Gives direct access to files, bypassing WordPress entirely. | New credentials, SFTP only, access limited to the people who need it. |
| Another site on the same account | One infected site can reach every other site in the same hosting account. | Clean every site on the account, not just the one you noticed. |
Your call
Clean it yourself,
or get help?
Plenty of owners can clean a hacked WordPress site themselves. The cases that need a specialist are usually obvious once you know what to look for.
Time and cost
How long it takes, and what
it costs to fix a hacked site.
| What to expect | With us | |
|---|---|---|
| Cleanup time | A straightforward infection with a clear way in is usually a same-day job; heavy reinfections take longer. | Started once you approve the fixed quote. |
| Google's review | Typically a few days to a few weeks after you request it. | Requested for you once the site is clean. |
| Price | Published specialist prices run from about $95 for a simple single-site job to over $2,000 for complex or repeat infections. | A fixed fee quoted in writing before any work starts. |
| On a maintenance plan | Many entry plans exclude hack cleanup. | One cleanup a year included on Care + Secure and Store Care for a hack that happens while on the plan, with a 2-hour emergency target in business hours (9am–6pm ET, Mon–Fri) and 4 hours outside them. |
Market prices are from published pricing on specialist WordPress cleanup service pages, checked September and October 2026. Our plan prices are on the pricing page.
After the cleanup
Stop your WordPress site
being hacked again.
Want protection on the site itself? SecureLite Security, our free WordPress plugin, compares every core file with WordPress.org's official copies and fires harmless test attacks to show which protections actually block them. About SecureLite →
Who wrote this
Who cleans hacked
sites here.
You're handing someone the keys to a compromised website. You should know who they are.
Naveen Kumar
Founder & lead engineer · Based in Chennai, India, working 9am–6pm US Eastern with clients across the US, UK, Europe and Australia
I built and ran WordPress, WooCommerce and custom-coded sites for clients directly for years before starting PixelGravitas — writing the code, managing the servers, staying on call when something broke. If your site is hacked, you're talking to the person who cleans it, not a support queue. More about how I work →
Questions, answered
Hacked WordPress site:
common questions.
What should I do first if my WordPress site is hacked?
Don't delete anything. Take a copy of the files and database as they are, change the passwords for your hosting account, WordPress admins, database and SFTP from a device you trust, and tell your host. Then find how the attacker got in before you clean, or it will happen again.
How do I know if my WordPress site has been hacked?
The common signs are redirects to spam or scam sites (often only on phones or from Google), a "This site may be hacked" label in search results, a red browser warning, pages you never wrote showing in Google, admin accounts you didn't create, and a suspension notice from your host.
Can I fix a hacked WordPress site myself?
Sometimes. If a security plugin flagged a single file early and you have a backup from before the infection, you can often clean it yourself. If Google or your host has flagged the site, it keeps coming back, you can't log in, or customer data may be involved, get a specialist.
Should I restore from a backup?
Only from a backup you know was taken before the infection, and only after you know how the attacker got in. Many infections sit quietly for weeks, so a recent backup may already contain the malware, and restoring it leaves the way in open.
How long does it take to clean a hacked WordPress site?
A straightforward infection with a clear entry point is usually a same-day job for a specialist. Heavily reinfected sites or large spam injections take longer. Google's review of a cleaned site typically takes from a few days to a few weeks.
How much does it cost to fix a hacked WordPress site?
Published prices for specialist cleanups run from about $95 for a simple single-site job to over $2,000 for complex or repeat infections. We quote a fixed fee before any work starts. Care + Secure and Store Care include one cleanup a year for a hack that happens while the site is on the plan; a site that is already hacked when it joins is cleaned first at the fixed fee.
How do I remove the "This site may be hacked" warning?
Clean the site completely first, then request a review in Google Search Console under Security issues. If you request a review while anything is left behind, it's refused and the next review takes longer.
Why does my WordPress site keep getting hacked again?
Almost always because the way in was never closed, or a backdoor was left behind. Deleting the files a scanner flags doesn't remove hidden backdoors in other files, the database or scheduled tasks, and it doesn't fix the outdated plugin or leaked password that let them in.
Will my host delete my hacked site?
Usually not straight away. Hosts normally suspend the account or disable the infected folder and ask you to clean it. Reply to them promptly, ask for a snapshot, and tell them when the cleanup is done.
Can a security plugin clean a hacked site?
It can find known malware and remove simple infections. It can't reliably find obfuscated backdoors, tell you how the attacker got in, or request removal of Google and host warnings. Use one to detect, not as the whole fix.
Do you fix hacked sites for people who aren't on a plan?
Yes. Send the site address and what you've seen. You get a fixed quote in writing before any work starts, and a written report at the end.