WordPress is a powerful platform, but it’s also a common target for hackers. A hacked site can cause loss of traffic, revenue, and credibility. If your WordPress site gets hacked, acting quickly is crucial.
This guide explains how to recover a hacked WordPress site step by step, so you can restore it safely and prevent future attacks.
Contents
- 1 1. Stay Calm and Assess the Situation
- 2 2. Put Your Site in Maintenance Mode
- 3 3. Change Your Passwords
- 4 4. Backup Your Hacked Site
- 5 5. Scan and Remove Malware
- 6 6. Restore from a Clean Backup
- 7 7. Update WordPress, Themes, and Plugins
- 8 8. Harden Your WordPress Security
- 9 9. Check Google and Search Engines
- 10 10. Consider Professional Help
- 11 FAQ
1. Stay Calm and Assess the Situation
-
Determine the type of hack: malware, defacement, spam injections, or admin takeover.
-
Don’t panic—immediate, careful action prevents further damage.
-
Take screenshots or notes of the issues for reference.
2. Put Your Site in Maintenance Mode
-
Prevent visitors from accessing your hacked site while you fix it.
-
Use a plugin like WP Maintenance Mode or SeedProd.
-
This prevents spreading malware or spam to users.
3. Change Your Passwords
-
Update passwords for all accounts: WordPress admin, hosting, FTP, and database.
-
Use strong, unique passwords.
-
Enable two-factor authentication (2FA) for extra security.
4. Backup Your Hacked Site
-
Even a compromised site should be backed up before changes.
-
Use a plugin like UpdraftPlus or BlogVault.
-
This allows you to revert if recovery steps go wrong.
5. Scan and Remove Malware
-
Use security plugins to detect malicious code:
-
Wordfence Security – Scan files, themes, plugins.
-
Sucuri Security – Detect malware and blacklist issues.
-
-
Remove suspicious files or replace them with clean copies.
-
Check the
wp-config.phpand.htaccessfiles for unauthorized modifications.
6. Restore from a Clean Backup
-
If you have a backup from before the hack, restore your site.
-
Make sure the backup is malware-free.
-
Test the restored site on a staging environment if possible.
7. Update WordPress, Themes, and Plugins
-
Update your WordPress core to the latest version.
-
Update all plugins and themes to patch vulnerabilities.
-
Delete unused plugins and themes—they can be exploited.
8. Harden Your WordPress Security
After recovery, secure your site to prevent future attacks:
-
Install a security plugin (Wordfence, iThemes Security, or Sucuri).
-
Limit login attempts and use a custom login URL.
-
Enable SSL (HTTPS) to encrypt data.
-
Regularly backup your site.
9. Check Google and Search Engines
-
Submit your site to Google Search Console to check for blacklisting.
-
Request a review if your site was flagged for malware.
-
Monitor rankings and traffic to ensure recovery is complete.
10. Consider Professional Help
-
If your site is heavily compromised, consider hiring experts like Sucuri or Wordfence remediation services.
-
Professional cleanup ensures all malware and backdoors are removed safely.
FAQ
Q: How long does it take to recover a hacked site?
It depends on the severity of the hack—anywhere from a few hours to a couple of days.
Q: Can I recover my site without a backup?
Yes, using security plugins and manual cleanup, but having a backup is faster and safer.
Q: Will my site ranking be affected after a hack?
If malware was detected by Google, your site may be temporarily flagged. Proper cleanup and submitting for review can restore rankings.
Q: How can I prevent future hacks?
Keep WordPress, themes, and plugins updated, use strong passwords, install security plugins, and enable backups.
Q: Is it safe to continue using the same hosting after a hack?
Yes, if the host has strong security measures. In severe cases, migrating to a secure hosting provider may be safer.
👉 Recovering a hacked WordPress site requires patience and careful action, but with the right steps, you can restore your website, secure it, and prevent future attacks.