WordPress Site Hacked? What to Do: A Recovery Checklist That Saves Your Rankings

Your WordPress site is hacked. Maybe visitors are hitting a red warning screen, maybe your host suspended the account, or maybe Google is showing spammy pages under your domain that you never created. However you found out, the next few hours decide how much this costs you in traffic and rankings.

The good news: a hacked site is recoverable, and in most cases the rankings come back too. The catch is that the order of operations matters. Clean before you contain and the malware reinstalls itself while you work. Rotate passwords before you remove the backdoor and the attacker simply logs in again.

This checklist walks through the recovery sequence in the right order: confirm the hack, contain the damage, clean files and database, rotate credentials, clear Google’s blacklist warning, and then handle the SEO damage control that most recovery guides skip entirely.

Work through the steps in order, even the ones that feel skippable. 👇

Flowchart of the seven-step WordPress hacked site recovery sequence: confirm, contain, back up, clean, rotate credentials, request Google's review, then repair SEO damage.

Step 1: Confirm it’s actually a hack

Not every scary symptom means malware. Before touching anything, confirm what you’re dealing with. Common indicators of compromise include:

A red “Deceptive site ahead” or “This site may be hacked” warning in browsers or search results 🚩
Your host suspending the account or emailing you about malware
Unknown admin users, or posts and pages you never published
Visitors getting redirected to spam websites
Traffic suddenly flowing to strange URLs you don’t recognize

Three quick checks tell you where you stand. First, run your domain through Google’s Safe Browsing site status tool to see whether Google has flagged it. Second, open Google Search Console and look at the Security Issues report (under Security & Manual Actions), which shows what Google detected. Third, run a full scan with a security plugin like Wordfence, Sucuri, or MalCare.

One nuance: a red browser warning can also come from a broken SSL setup rather than malware. If scans come back clean and the only symptom is the warning, check your SSL certificate and mixed content before assuming the worst.

Step 2: Contain the damage

A compromised site can infect visitors, send spam email, or get used to attack other sites, and that can get your server’s IP address blacklisted along with your domain. Containment limits the blast radius while you work:

Take the site offline or into maintenance mode. Most security and maintenance plugins can flip this switch; many hosts will do it for you.
Contact your hosting provider. On shared hosting the infection may have come from a neighboring account, and good hosts can confirm the hack, quarantine the site, or point you at server logs.
Scan your own computer. Attackers frequently get in through credentials stolen from an infected local machine, so a full antivirus scan on every device you use to manage the site is part of containment, not an optional extra.

💡 PRO TIP: Write down what you noticed and when, plus anything you changed recently (new plugin, theme edit, new user). The official WordPress.org hacked-site guide calls these indicators of compromise, and this incident note saves hours later, especially if you end up hiring help.

Step 3: Back up the infected site (yes, really)

This is the step everyone wants to skip, and the one that hurts most when you skip it. Before deleting or replacing anything, take a full snapshot of the site’s files and database, even though they’re infected.

Two reasons. If the cleanup goes sideways and breaks the site, you still have something to fall back on. And the snapshot doubles as evidence: comparing infected files against clean originals later is often the only way to figure out how the attackers got in, which you need to know before the story can end.

⚠️ WARNING: Label this backup clearly as infected (something like pre-cleanup-INFECTED) and store it separately from your regular backups. It is evidence and a last resort, not a rollback point. Restoring it later brings the malware straight back.

Step 4: Clean the files and the database

Now the actual cleanup. You have two realistic routes, and the honest answer is that most site owners should take the first one.

Route A: let a tool or your host do it. Security plugins like Wordfence, Sucuri, and MalCare scan for known malware signatures and remove them, though the actual cleanup feature sits behind the paid tier for some of them. Many managed WordPress hosts will also clean an infected site for free as part of your plan, so ask before paying anyone. 🧹

Route B: clean manually. If you go hands-on, the essentials are: replace the wp-admin and wp-includes folders with fresh copies of your exact WordPress version, comb through wp-content for files that don’t belong, and inspect the files attackers love most: .htaccess, index.php, header.php, footer.php, and functions.php. Then delete plugins and themes you don’t recognize, check Users → All Users for accounts you didn’t create, and search the database for injected spam posts and links. Manual cleaning works, but it’s slow and easy to get wrong, which is why Route A exists.

👉 Seeing visitors bounced to spam sites? That’s a specific infection with its own playbook. Follow the dedicated guide to fixing the WordPress redirect hack rather than improvising here.

When restoring a backup beats cleaning

If you have a backup from before the infection and the site hasn’t changed much since (no new orders, posts, or user accounts), restoring is often faster and more certain than surgically picking malware out of files. Two catches, though. Confirm the backup actually predates the infection, because attackers sometimes sit inside a site for weeks before doing anything visible. And still find the entry point, since restoring the files also restores the vulnerability that let them in the first time.

Safest path: restore the backup to a WordPress staging site first, verify everything works there, and only then push it live.

Step 5: Rotate every credential

Once the site is clean, assume every password it ever touched is compromised. Change, in no particular order because all of them matter:

WordPress passwords for all users, admins first
Your hosting control panel login
FTP and SFTP accounts
The database password (remember to update wp-config.php to match)
Any API keys for connected services (payment gateways, email services, CDNs)

Then regenerate the security keys in wp-config.php. This one edit kills every active login session, including any the attacker still has open. WordPress.org publishes a key generator for exactly this purpose, and the official hacked-site guide recommends it.

Two details people miss. If you already changed passwords when you first spotted the hack, change them again now: credentials rotated while malware still sat on the server may already be stolen. And turn on two-factor authentication for every admin account so a leaked password alone is never enough again.

Step 6: Request Google’s review to clear the warning

Cleaning the site does not automatically clear the blacklist. Google keeps the red warning up until it recrawls your pages and confirms the malware is gone, and waiting for that to happen on its own can take a while.

Speed it up: in Search Console, go to Security & Manual Actions → Security Issues, then click Request Review. Describe what you found and how you fixed it, and be specific: what was infected, what you removed, and what you changed to stop a repeat. Google typically responds within a few days, and the warning stays up until the review passes.

Only request the review once the site is genuinely clean. If Google recrawls and still finds malware, the rejection costs you more time than the wait would have. For the full walkthrough of the warning itself, including the SSL false alarm, see the guide to removing the “Deceptive site ahead” warning. Google’s own security documentation for site owners covers how it classifies these issues.

Step 7: Do the SEO damage control most guides skip

Here’s the part that decides whether your rankings actually recover. Hackers rarely just deface a site. A common play is injecting hundreds of spam URLs (pharma pages, fake product listings, foreign-language keyword pages) that Google indexes under your domain. Even after the malware is gone, those URLs keep dragging your site’s reputation down until you deal with them. 🧯

Work through this short list:

Find the injected URLs. Search site:yourdomain.com on Google and scroll well past page one, and check Search Console’s Pages report for URLs you don’t recognize.
Remove them properly. Delete the spam content so those URLs return a 404 or 410 status. If legitimate pages were stuffed with spam links or keywords, clean the content itself.
Get real pages recrawled. Use the URL Inspection tool in Search Console and hit Request Indexing for your homepage and most important pages (this is the modern successor to the old Fetch as Google). There’s a daily quota per property, so for a large site update your sitemap’s lastmod dates and resubmit it instead.
Monitor for weeks, not days. Check the Security Issues report and repeat the site: search weekly for a month or two. Rankings typically recover once Google confirms the site is clean, but it’s a gradual climb, not a switch flipping back on.

When to call in a professional

DIY recovery works for a lot of sites, but there are clear signs it’s time to pay for help: the infection keeps coming back after cleaning, you can’t find the entry point, the site handles customer data or payments, or you’re not comfortable poking around the database. A professional cleanup service (or your host’s security team) costs money, but a botched DIY cleanup on a store with customer data costs more. There’s no shame in that call. 🙂

Wrapping up 🏁

A hacked site feels like a disaster, but the recovery is mechanical if you keep the order straight:

Confirm the hack before touching anything
Contain it: maintenance mode, host, local scans
Back up the infected site as evidence and insurance
Clean files and database, or restore a verified clean backup
Rotate every credential and regenerate security keys
Request Google’s review to lift the warning
Hunt down injected spam URLs and monitor until rankings recover

Once you’re back, keep it that way: update everything promptly, use unique passwords with two-factor authentication, keep real backups (and test restoring them occasionally), and run a security plugin with a firewall. Boring habits, excellent results.

Have you dealt with a hacked WordPress site before? What worked for you, and what would you warn others about? Share your experience in the comments below. 👇