Hacked WordPress site: symptoms and first steps

In 2025, 11,334 new WordPress vulnerabilities were recorded, 42% more than a year earlier. 91% were in plugins, 9% in themes and only 6 in WordPress core.¹ 46% had no fix when they were disclosed.¹ The other common route is a stolen password: Wordfence's 2024 report names compromised hosting credentials as a frequent entry point.² A forgotten, outdated plugin or a reused password is enough.

1. A red warning in Chrome. Chrome shows a "Dangerous site" page before loading yours.³
2. A warning in Google results. Google shows "This site may be hacked" when it believes someone changed existing pages or added spam pages. The label stays until the site is clean and you request a review in Search Console.⁴
3. Redirects you can't see. Many infections redirect only on mobile, or only visitors arriving from Google or Facebook.⁵⁶ Your customers see it and you don't.
4. Pages in Google you never made. Search site:yourdomain.com. Japanese text or ads for branded goods mean the "Japanese keyword hack". Often an unknown person is also listed as an owner in Search Console.⁷
5. An admin user you don't recognise. Some malware creates fake admin accounts, sometimes using your own domain so they blend in.⁶
6. An odd checkout form or a "Connect Wallet" prompt. In 2024 Sucuri found card skimmers on 18,622 sites and Web3 crypto drainers in 23,372 detections.⁸
7. A suspended host account or ads. Hosts suspend sites for malware, spam or unusual load.

Based on WordPress.org's own guidance, in this order:⁹

1. Stay calm. Write down what you saw, when (with the time zone), and any recent changes.
2. Take a backup of the infected site before deleting anything. It shows later what changed.
3. Scan your own computer too, because an infection can start there.
4. Contact your host, especially on shared hosting.
5. Change every password: WordPress admin, FTP/SFTP, the hosting panel and the database. Turn on two-step login.
6. Force a password reset for all users and change the secret keys in wp-config.php so everyone is logged out.
7. Check the Security Issues report in Google Search Console.

1. Deleting before backing up. You lose the evidence of how they got in.
2. Cleaning files only. Attackers increasingly store code in the database, so a file-only cleanup misses it.⁶ On one site we cleaned, the malware rewrote itself from the database within minutes of being deleted.
3. Restoring an old backup and stopping there. The backup brings back the vulnerable plugin too. The hole stays open.
4. Requesting a Google review too early. Google lifts the warning only when the whole site is clean; a partial fix earns no partial return. Don't resubmit while a request is pending.¹⁰
5. Trusting a 404. Attackers sometimes make a spam page look gone when it isn't.⁷

If personal data may have leaked, for example through a webshop card form, GDPR Article 33 requires the controller to notify the supervisory authority (in Hungary, NAIH) within 72 hours of becoming aware, unless the breach is unlikely to put people at risk.¹¹ This is not legal advice; ask your lawyer if in doubt.

If the malware comes back, if the site is a shop, if Google shows a warning, or if you don't know how they got in. In each case the hidden backdoor is the real risk.