Your WordPress site is hacked. Here is exactly what to do, in order.

Finding your site redirecting to a pharmacy shop, or a red Google warning where your homepage used to be, is a bad hour. The instinct is to start deleting things. Resist that for ten minutes and work through this in order — the sequence matters more than the speed.

First, confirm it is actually a hack

Not every broken site is a compromised one. A failed plugin update produces a white screen; a hack usually produces something extra. You are probably looking at a real compromise if any of these are true:

• Visitors get redirected to a site you do not own
• Google shows a warning before your page loads
• Pages you never wrote appear in search results, often in another language
• Your host has suspended the account, citing malicious files
• There are administrator accounts you do not recognise
• Your homepage source contains scripts pointing at unfamiliar domains

If it is a white screen with no redirect and no warning, start with a broken site rather than a hack — the fix is different.

Do these three things before anything else

1. Take a backup of the infected site. This sounds wrong. It is not. You need the infected copy as evidence of how the attacker got in, and as a fallback if a cleanup goes badly. Back up files and database, download them, and set them aside.

2. Put the site into maintenance mode. Every hour it stays live, Google crawls more injected pages and the damage to your rankings deepens. If it is redirecting visitors to spam, take it offline.

3. Change your hosting password, not your WordPress one. Not yet. Changing the WordPress admin password first tells the attacker you have noticed while they still have file access, and they will simply re-add their account. Lock the outer door first.

Find out how they got in

Cleaning without finding the entry point means you will be doing this again next week. In practice it is nearly always one of four things:

1. An outdated plugin with a published vulnerability. By far the most common. Check what was installed and how long it had been out of date.
2. A weak or reused admin password. Look at whether logins came from an unusual country.
3. A compromised hosting account. If other sites on the same account are also infected, the server is the problem, not WordPress.
4. A nulled theme or plugin. Pirated premium software very often ships with a backdoor. If you installed one, assume that is the cause.

Your host can usually give you access logs. Look for POST requests to unfamiliar PHP files around the time things changed.

Clean it properly

The order here is deliberate.

Replace, do not repair. Delete WordPress core entirely and reinstall it from wordpress.org. Do the same for every plugin and theme, taking fresh copies rather than trying to clean the ones on the server. Hand-editing infected files always misses something.

Then look in the places replacement does not reach:

• The wp-content/uploads folder, which should contain no PHP files at all
• wp-config.php and .htaccess, both frequently modified
• The wp_users table, for accounts you did not create
• The wp_options table, where injected scripts hide in things like siteurl and widget content
• Scheduled tasks, which are how a cleaned site reinfects itself two days later
• Any PHP file sitting above the WordPress folder, outside where you would think to look

Rotate everything. Database password, hosting password, SFTP credentials, every administrator password, and the security keys in wp-config.php. Rotating the salts logs every existing session out, including the attacker's.

Get the warnings lifted

A clean site that Google still flags is still losing you customers.

1. In Google Search Console, open Security & Manual Actions and request a review once you are certain the site is clean
2. Check your domain against Google Safe Browsing, Sucuri SiteCheck and VirusTotal
3. If your host suspended you, reply with what you found and what you changed

Reviews usually take one to three days. Requesting one before the site is actually clean restarts the clock, so be sure.

Stop it happening again

The cleanup is the easy part. Staying clean is a habit:

• Update weekly, not when you remember. Most compromises exploit a flaw that was patched months earlier.
• Delete what you do not use. An inactive plugin is still code on your server and can still be exploited.
• Take off-site backups daily. A backup stored on the same server disappears with the server.
• Turn off the file editor by adding define( 'DISALLOW_FILE_EDIT', true ); to wp-config.php, so a stolen password cannot become a permanent backdoor.
• Use two-factor authentication on every administrator account.
• Watch for disclosed vulnerabilities in the plugins you run, and update within days rather than months.

When to get help

Do it yourself if you are comfortable with SFTP and phpMyAdmin, the site is small, and you found a clear entry point. Get help if the site earns you money and is still down, if it reinfects after you clean it, if your host has suspended you, or if you cannot find how they got in.

If that is where you are, our malware cleanup is a flat $249, done within 24 hours, with a 30-day re-infection guarantee. And if you would rather this never happened in the first place, a care plan is the version where someone else does the weekly updating that prevents it.