Hacked WordPress site: what to do right now

The signs

A hacked site usually gives itself away with something odd: Google shows pages in Japanese or about pharmacy products under your domain, the browser warns that the site is dangerous, the host suspends the account, your emails start landing in spam. Sometimes there's an administrator account nobody created.

What to do right now

1. Don't delete anything and don't reinstall WordPress on top: the files as they are now show what happened.
2. From a clean computer, change the password of your hosting control panel and of your email. I change the WordPress, FTP and database passwords during the cleanup, because they all need changing together.
3. Take screenshots of the warnings and keep the emails from your host.
4. Call me, or write to me with the form below.

If the site is sending spam or infecting visitors, I take it offline while I clean it.

How I clean it up

I have cleaned up hacked sites before, and the work goes like this:

1. I save a full copy of the site as it is.
2. I compare the files with the original ones from WordPress, the theme and the plugins, and remove what was added.
3. I search the database for administrators and code that shouldn't be there.
4. I find out how they got in: usually an outdated plugin or a stolen password.
5. I change passwords and keys, update everything and ask Google to remove the warning, if there is one.

The same work applies to Joomla sites.

Keeping it from happening again

On WordPress, almost every published hole is in a plugin, and the update comes out before the attack. With maintenance I update WordPress, the theme and the plugins every week, and SitePing, the monitoring service I wrote, reports changed files, administrator logins and versions that no longer get security fixes.

If the site relies on a plugin abandoned years ago, I tell you and suggest what to replace it with.

Frequently asked questions

Can't I just restore a backup?

Usually not. A backup brings the site back as it was, including the hole they used to get in, and often the hidden code too, if the attack is older than the backup. First we find out how they got in.

Have I lost my content?

Almost never. Whoever breaks into a site usually adds pages or code and leaves your text where it is, because what they want is your domain.

How long does it take to remove the Google warning?

After the cleanup I ask Google for a review through Search Console. Google sets the timing: usually a few days.

Can you help at night or on Sunday?

Clients with 24/7 cover can call me at any hour. Everyone else can reach me Monday to Saturday, 9am to 7pm, Italian time.

Read more

• The service: Hacked sites and security
• Work of this kind: SitePing
• More pages like this: Websites with a problem