Website DevelopmentSEO & Google AdsOngoing SupportAI AgentsCase StudiesPartnersAboutVersion françaiseGet in Touch
Ongoing Support

WordPress Site Hacked? What to Do Right Now (and How to Stop It Happening Again)

Your site redirects to strange pages or Google shows a warning? Don't panic: here are the steps, in the right order.

The Web Dimensions teamPublished 3 min read

WordPress Site Hacked? What to Do Right Now (and How to Stop It Happening Again)

WordPress powers a large share of websites, which makes it a frequent target. In most cases, a hack comes from an outdated plugin or theme, a weak password or poorly configured hosting. If your site is hit, what matters is acting fast and in the right order.

Signs of a hack

  • The site redirects to gambling, pharmacy or shady pages, sometimes only on mobile or from Google.
  • Unknown pages or admin users appear.
  • Google shows "This site may be hacked" or Search Console reports a security issue.
  • Your host suspends the account or flags mass emails.
  • The site gets unusually slow or shows errors.

Emergency steps

  1. Don't delete things in a hurry. First take a full copy (files and database) of the current state for analysis.
  2. Change every password: WordPress admins, hosting, FTP/SFTP, database, email.
  3. Remove unknown admin accounts.
  4. Tell your host: they can provide logs and backups.
  5. Consider maintenance mode to protect visitors during cleanup.

The cleanup

  • Replace WordPress core, themes and plugins with clean official copies.
  • Search the remaining files (uploads, configuration) and the database for malicious code.
  • Remove abandoned or unused plugins.
  • Restore a clean backup if one exists from before the infection, then update immediately.
  • Request a review from Google in Search Console once the site is clean.

Stop it happening again

  1. Update WordPress, themes and plugins regularly, with a safe process.
  2. Use strong passwords and two-factor authentication for admins.
  3. Keep admins and plugins to a minimum.
  4. Add a web application firewall and file monitoring.
  5. Choose serious hosting with site isolation and backups.

Need help now?

We clean, secure and monitor WordPress sites as part of our managed services. Message us on WhatsApp or through the contact page.

Frequently asked questions

Why was my WordPress site hacked?

Most often an outdated vulnerable plugin or theme, a weak password, a pirated ("nulled") plugin or poorly isolated hosting.

Does a hacked site lose its rankings?

It can if Google detects malware or spam and shows a warning. Fast cleanup followed by a review request usually limits the damage.

Do we need a new site after a hack?

Not necessarily. A full cleanup and hardening is often enough. A rebuild makes sense if the site depends on abandoned themes or plugins.

Keep reading