WordPress malware and hacks

How to tell if your WordPress site has been hacked

A compromised WordPress site does not always look obviously broken. Some attacks are designed to remain hidden from the site owner while showing spam, redirects or malicious content to search engines and selected visitors.

Warning signs include unfamiliar pages appearing in Google, unexpected administrator accounts, unexplained changes to plugins or themes, browser security warnings, visitors being redirected elsewhere, unusual JavaScript in page source, changed files and sudden additions to the database. Your hosting company may also suspend the site or report malicious files.

Google recommends checking the Security Issues report in Search Console and periodically using a Google site: search to identify pages you do not recognise. Search Console's Pages report can also expose large numbers of URLs that should not exist.

Do not assume that deleting one suspicious file has solved the problem. WordPress compromises can involve several components, including modified PHP files, malicious database entries, hidden administrator accounts, scheduled tasks or backdoors intended to restore the infection after visible malware is removed.

If you are investigating a suspected compromise, our website security information explains some of the wider controls used to protect websites.

What to do in the first hour after a WordPress hack

Avoid immediately deleting files or reinstalling WordPress. Evidence that helps identify the entry point can disappear, and a rushed restore can overwrite the only useful copy of the compromised site.

1. Take a full backup first. Preserve both the website files and database and keep a separate copy of the infected site for investigation.
2. Contact the hosting provider. Ask whether it has detected malicious activity, account access, unusual processes or other affected sites on the same hosting account.
3. Secure every credential. Change passwords for WordPress users, hosting, the database and FTP or SFTP accounts. Replace the WordPress security salts in wp-config.php and revoke access that is no longer required.
4. Check Google Search Console. Review Security Issues, Pages, messages and ownership. Investigate any unfamiliar verified owner rather than simply concentrating on the visible website.
5. Record what you find. Note affected URLs, files, dates, warnings and redirects before cleanup begins.

If visitors are being put at risk, your host may be able to restrict public access while the investigation takes place.

How WordPress malware cleanup works

Effective WordPress malware removal is more than scanning for a recognisable malicious filename. The site needs to be compared with known clean software, suspicious files and database content investigated, unauthorised users removed and compromised code replaced or cleaned.

The important part is identifying how the attacker gained access. That may involve a vulnerable or abandoned plugin, an exposed account, stolen credentials, insecure hosting configuration or another site sharing the same hosting environment. Cleaning the payload without closing the entry point leaves the site open to reinfection.

After cleanup, WordPress core, themes and plugins should be brought up to date, unnecessary software removed and access permissions reviewed. Search Console should then be checked again. Where Google has applied a security warning, follow Google's review process only after the whole site has been cleaned.

Our Hacked Site Rescue is £349 fixed price and covers malware removal, a clean restore and help clearing browser and Google warnings. For ongoing protection, care plans start from £59 a month and include weekly updates, daily off-server backups, 24/7 uptime monitoring and security scanning.