WORDPRESS HELP · CHECKED 4 NOVEMBER 2026
WordPress site hacked? Here's what to do now.
It happens to careful owners too, and it's fixable. These are the steps you can take yourself in the first hour, the message to send your host, what Google shows and how to clear it, what cleanup help costs, and how to keep it from happening again, built on WordPress.org's own guidance and Google's help.
Plain steps, sources linked · No sign-up, nothing to download
The short answer
If your WordPress site has been hacked, start with five things you can do without a developer: write down what you're seeing, message your web host, change every password (WordPress, the hosting account, file access and the database), check the WordPress user list for administrators you don't recognize, and make sure a copy of the site is kept before anything is cleaned. Then the site gets cleaned or restored from a backup made before the problem started, everything is updated, and, if Google flagged the site, you ask Google for a review.
WordPress.org's own advice begins with staying calm ("Yes, you will recover from this") and writing down what you're seeing, and it includes checking with your host, changing every password and keeping a copy before cleaning (WordPress.org). The steps below put the jobs an owner can do first, and say plainly which jobs belong to your host or a cleanup service.
Signs your site has been hacked
A slow site or an error page can have other causes, so it's worth being sure. The clearer signs, from WordPress.org's list and Google's help:
- Google or your browser shows a warning beside your site in search results, or a full-page warning when you visit it.
- Your host has disabled the site or emailed you about malware.
- Pages, links or redirects you didn't add.
- A new user you didn't create, especially an administrator.
- Customers tell you their antivirus flagged your site.
If you're not sure, a free remote scan such as Sucuri's SiteCheck checks for known malware and blocklist status from the outside (SiteCheck); its page is clear that it can't see files on the server, so a clean result isn't the final word.
THE FIRST HOUR
How to deal with a hacked WordPress site: the first five steps
Five steps, none of which needs a developer. Do them in this order.
Write down what you're seeing
What made you think it's hacked, when you noticed, and anything that changed recently: a new plugin, a theme change, a new user. WordPress.org calls this the first step; your host or a cleanup service will ask for exactly this.
Message your host
Your host can check the server, keep a copy of the site as it is, and often restore a backup or clean the site. On shared hosting the problem can reach more than your site, so they need to know. The message below says it for you.
Change every password
Your WordPress login, your hosting account, file access (SFTP or FTP) and the database, and ask everyone else with a login to change theirs. Use long, unique passwords and turn on two-step login if you can.
Check the user list
WordPress.org lists a new user you didn't create as a clear sign. In WordPress, go to Users, then All Users, and filter by Administrator; you should recognize every name. If you don't, note it and tell your host before deleting it, so it stays in the record of what happened.
Keep a copy before anything is cleaned
WordPress.org recommends one more snapshot of the site before cleaning, even with the problem in it. Use your host's backup option if it has one, or ask your host to keep a copy. It's the reference if a cleanup goes wrong.
What to send your host
Open a support ticket or chat with your host and paste this, filling in the two gaps:
Hi, I think my WordPress site, [your website address], has been hacked. Here's what I'm seeing: [what you noticed, and when]. Can you check the server and tell me what you find? Please keep a copy of the site's files, database and logs as they are now, before anything is cleaned. Do you have a backup from before this started, and can you restore it, or clean the site for me? Is my site, or any other site on my account, suspended or flagged? Thanks.
If the site is on WordPress.com, its support page lists the same first moves (reset passwords, turn on two-step authentication, reset the file-access password, check the activity log and the malware scan history, update plugins and themes) and then asks you to contact support with as much detail as you have (WordPress.com).
Getting the site clean
Once the first steps are done, there are three ways back to a clean site.
1. Your host restores a backup from before the problem started. This is the quickest route, if the backup really is from before. Ask the host when the problem began; restoring a backup made after it just brings it back. Then update everything straight away (below), because whatever let it in is still there in the old copy.
2. A cleanup service or your host cleans it. Some hosts offer this, and security companies sell it by the site; the prices are in the table below. Give them your notes from the first step.
3. You, or a developer, clean it by hand. WordPress.org lists what this involves: replacing WordPress's own folders with fresh copies of the same version, going through themes and plugins file by file, and checking a handful of files that are often changed (WordPress.org). It calls this "the most daunting part of the entire process", and it's work for someone comfortable with a server. If cost is the worry, WordPress.org points to its support forums' hacked-site tag, where the community often lends a hand.
Whichever route you take, change the passwords again once the site is clean. WordPress.org is specific about that: change them when you find the problem, and again after the cleanup.
WORDPRESS MALWARE REMOVAL
What WordPress malware removal costs
Free scanners tell you whether something's wrong; cleanup is the paid part. These are published prices for one site, as each company's page prints them.
| Service | Price | What its page says it does |
|---|---|---|
| Sucuri SiteCheck | Free | a remote scan for known malware and blocklist status; its page says it "will not detect anything on the server-side" |
| MalCare Free | Free | finds malware; its page says "Free finds malware but doesn't remove it" |
| Sucuri Basic Platform (1 site) | $229 a year | malware cleanup, with a 30-hour response estimate ("resolution time may vary") |
| MalCare Repair (1 site) | $299 a year | "Automated cleanup + report" |
| MalCare Fortify (1 site) | $499 a year | "Cleanup + unlimited manual fixes" |
| GoWP Pro (1 site) | $39 a month | a care plan with "daily security scans and cleanup", updates and daily backups |
| WP Buffs Perform (1 site) | $239 a month | a care plan including "Complete Malware Removal", updates and backups |
Prices in US dollars before tax; MalCare notes that local pricing and offers apply at checkout. Ask your host first: some include a cleanup or a restore in your plan. Care plans also cover updates and backups, which is what keeps a cleaned site clean.
If Google is showing a warning
When Google finds a site has been hacked, it can show a warning label beside it in search results, and browsers can show a warning page before the site opens. In Google Search Console, the Security issues report lists what Google found (Google).
- Fix every issue the report lists, on every page it names.
- Select Request Review in the report. Say what the problem was, what you did to fix it and what the result was.
- Wait for the email. Google says most reviews take several days or weeks, and asks you not to send another request while one is pending.
No Search Console account yet? It's where Google shows what it found and where you ask for the review, so it's worth adding your site to it.
Keeping it from happening again
- Update WordPress, every plugin and your theme. WordPress.com's support page names outdated plugins and themes as the most common way in (WordPress.com). Delete plugins and themes you don't use, rather than leaving them switched off.
- Turn on two-step login for everyone with an administrator account, and keep passwords long and unique.
- Keep a backup you've tested, stored somewhere other than the server. A backup from before a problem is what makes the quickest route possible.
- Keep PHP up to date. PHP is the software your host runs underneath WordPress. To check yours, go to Tools, then Site Health, then the Info tab, and open Server. WordPress.org's Update PHP page says your host decides which versions are available, many hosts let you change it in their control panel, and you should back up and update WordPress, your theme and your plugins first (WordPress.org). If you're not sure, ask your host to do it. The PHP flaw hitting WordPress sites in October 2026 is the reminder that the software underneath WordPress needs looking after too.
- Decide who looks after it. If updates and backups keep slipping, a care plan (the table above) or a host that manages WordPress for you takes that job off your list; weigh its cost against the cleanup prices above.
Hacked WordPress site: your questions
The clear signs are a Google or browser warning on your site, your host disabling it or emailing you about malware, pages or redirects you didn't add, an administrator you didn't create, or customers saying their antivirus flagged it. A free remote scan such as Sucuri's SiteCheck can confirm known malware from the outside, though it can't see files on the server.
If your WordPress site has been hacked, start with five things you can do without a developer: write down what you're seeing, message your web host, change every password (WordPress, the hosting account, file access and the database), check the WordPress user list for administrators you don't recognize, and make sure a copy of the site is kept before anything is cleaned. Then the site gets cleaned or restored from a backup made before the problem started, everything is updated, and, if Google flagged the site, you ask Google for a review.
The first steps, yes: notes, a message to your host, new passwords, a look at the user list and a copy of the site. The cleanup itself is server work: replacing WordPress's folders and checking theme and plugin files one by one. If that isn't you, a host restore from a clean backup or a cleanup service is the safer route.
Scanning can be free (Sucuri SiteCheck, MalCare's free plan). Cleanup for one site is published at $229 a year (Sucuri Basic Platform), $299 a year (MalCare Repair) or $499 a year (MalCare Fortify, with unlimited manual fixes), or comes inside care plans from $39 a month (GoWP Pro) to $239 a month (WP Buffs Perform). Ask your host first; some include a restore or cleanup.
Only one from before the problem started, and only after a copy of the current site is kept. Restoring a backup made after the problem began brings it straight back. After restoring, update WordPress, plugins and theme right away, because whatever let it in is still in the old copy, and change your passwords again.
It can. Google may show a warning label beside a hacked site in search results, and browsers can show a warning page. Once you've fixed everything listed in Search Console's Security issues report, request a review there; Google says most reviews take several days or weeks.
Check your version in Tools, then Site Health, then Info, then Server. Your host decides which PHP versions are available; many hosts let you switch in their control panel, or you can ask them to do it. Back up first, update WordPress, your theme and plugins, and check the site still works afterwards.
Yes, once it's clean and looked after: updates applied, unused plugins removed, two-step login on, a tested backup kept and PHP current. What matters is whether someone does that work every month. If nobody will, a managed host, a care plan or a platform that does the upkeep for you is the simpler route.
Sources
The steps, prices and quotes on this page come from these pages, read on 4 November 2026; the practical advice around them (which route is quickest, keeping unused plugins off the site, storing a backup away from the server) is ours. Prices are in US dollars before tax.
- WordPress.org — FAQ My site was hacked — page dated 26 July 2026, read 4 November 2026
- WordPress.com Support — What to do if your WordPress site is hacked — page dated 20 October 2026, read 4 November 2026
- Google Search Console Help — Security issues report — read 4 November 2026
- WordPress.org — Update PHP — page dated 29 July 2026, read 4 November 2026
- Sucuri — SiteCheck free website scanner — read 4 November 2026
- Sucuri — Website Security Platform plans — read 4 November 2026
- MalCare — Pricing — read 4 November 2026
- WP Buffs — WordPress Care Plans — read 4 November 2026
- GoWP — Pricing — read 4 November 2026
- Hostinger — AI Website Cloner — read 4 November 2026
If you'd rather not keep plugins and PHP up to date
Some problems sit in the software a web host runs underneath a site, like the PHP flaw hitting WordPress sites in October 2026. Published Zarla sites are static pages served from a CDN. There's no PHP, no plugins and nothing for you to patch, so this flaw doesn't reach them. Strong passwords and two-step login still matter on every platform. If you'd rather not be the one keeping plugins and PHP up to date, you can bring your WordPress site across: Hostinger's AI Website Cloner recreates a site from its address as "a close starting point, not a pixel-perfect duplicate" (Hostinger), and Zarla rebuilds your pages, words and photos in a new design in a few minutes, free to see and edit, and you pay when you publish. Zarla keeps your old page addresses where it can and redirects the ones that change, helping you keep the Google standing you've built. Your current site stays live until you point your domain at the new one. Bring your WordPress site across.