WordPress Hacked? 30-Minute Emergency Recovery Guide

WordPress Hacked? What to Do in the First 30 Minutes (Emergency Guide)

You open your website and something is wrong. Visitors are being sent to a strange shopping page. Google shows a warning beside your name in the search results. Or your pages are full of text you never wrote. Your site has been hacked, and what you do next matters.

The first thirty minutes decide how bad the damage gets. The wrong moves, deleting files at random, paying whoever demands money, or leaving the site wide open while you think, let a bad situation grow. The right moves are calmer: close the doors, protect your accounts, and record what you can see.

This guide walks you through that first half hour step by step: containment first, then the cleanup steps you can safely do yourself, the deeper cleanup that follows, and how to stop it happening again. WordPress security help is one of the services we provide at Raozan IT, an eight-member team based in Noapara, Raozan, Chattogram, Bangladesh, building and looking after WordPress websites since 2017, with 800+ projects completed, including websites for 400+ web design clients.

First 5 Minutes: Don’t Do These 3 Things

Your first instinct will be to fix everything quickly. Resist it for five minutes. In a panic, site owners often destroy the evidence of how the attacker got in, or make the problem public before they understand it. Avoid these three mistakes, and everything after becomes easier.

1. Don’t Panic-Delete Files

Deleting files that look strange feels productive, but it rarely removes the infection. Modern malware usually lives in several places at once: files, the database, and sometimes fake user accounts. Delete the wrong file and you can break your site, while the hidden parts rebuild what you removed.

You also destroy information: which files were changed, and when, helps work out how the attacker got in, and without it you may clean the site yet leave the door wide open. Instead, take screenshots, note what looks wrong, and download a full copy of the site, labelled clearly as the infected copy. Never restore it live, but keep it for diagnosis.

2. Don’t Pay Any Ransom or “Cleanup Fee”

Sometimes a hacked site demands payment, or a stranger offers instant cleaning for a fee. Do not pay: paying marks you as someone who pays, and demands often return, larger the second time.

Worse, the person offering the cleanup is frequently connected to the attack itself. Even when payment is made, access is rarely fully handed back: hidden backdoors stay in place, the database infection is untouched, and any blacklist warning remains, because a payment fixes none of those. Money changes hands; the hack stays. Spend your effort on the steps in this guide instead.

3. Don’t Announce It Publicly Yet

Posting “we have been hacked” on your Facebook page in the first few minutes helps nobody. Attackers watch their victims, and a public post tells them you have noticed, which can push them to do more damage quickly. It also worries customers before you know what actually happened; many hacks only inject spam or redirects and never touch customer data.

Secure the site first and understand what was affected; then communicate honestly if you need to. If customer information may have been exposed, telling those customers promptly is right, and the FAQ below covers it. But write that message once you have facts, not rumours.

Minutes 5-10: Contain the Damage Immediately

While your site stays open, it may be sending visitors to scam pages or damaging your search rankings. The next five minutes are about containment: hide the site, lock every account, and keep evidence.

Step 1: Put Your Site in Maintenance Mode (2 minutes)

Take the site out of public view so visitors stop meeting the hacked version. The simplest way is a maintenance mode plugin from the WordPress plugin directory: install it, switch it on, and visitors see a plain “under maintenance” page while you, logged in as admin, can still work.

If you cannot install a plugin, many hosting panels let you password-protect or pause the site. Advanced users can restrict access by IP address in the .htaccess file:

order deny,allow
deny from all
allow from YOUR-IP-HERE

Replace YOUR-IP-HERE with your own IP address (search “what is my IP” in Google to find it). Whichever method you use, also tell your hosting provider what has happened; hosts deal with hacked sites daily and may help with scans or backups.

Step 2: Change Every Password: In This Exact Order (5 minutes)

Attackers often keep copies of your passwords, so the order matters: if the attacker still controls your hosting account, a new WordPress password will not keep them out. Work through this order:

1. Hosting account. Change the password for your hosting control panel first, and for the email address used to reset it.
2. WordPress admin users. Change the password of every administrator account, not just your own.
3. Database. Change the database password in your hosting panel, then update the new password in wp-config.php, or the site cannot connect to its database.
4. FTP and SFTP. Change these passwords, and remove any FTP accounts you do not recognise.
5. Connected accounts. Change passwords for anything linked to the site, such as your domain registrar.

Use long, unique passwords, stored in a password manager, and switch on two-factor authentication where offered. These few minutes close the doors the attacker is most likely to reuse.

Step 3: Take Screenshots for Evidence (3 minutes)

Before changing anything else, record what the hack looks like: screenshot the hacked pages, warnings, strange text or redirects, and your user list, noting the date and time. Save any security warnings from Google Search Console too.

Blacklist review requests go better when you can show what was wrong and what you fixed. If you later hire a professional, the screenshots show them what you saw before anything changed. And if customer data turns out to be involved, an honest record beats guesswork.

Minutes 10-20: Identify What Type of Hack You Have

Not every hack behaves the same way, and the cleanup differs depending on what you have. Use these ten minutes to name the problem, so you do not waste time on the wrong fix.

Free Tool: Sucuri SiteCheck

Start with a free external scan at Sucuri SiteCheck. Enter your address and it checks the public side of your site: blacklist status, visible malware or spam, and badly out-of-date software.

Treat the result as a first opinion, not a full diagnosis: SiteCheck sees only what a visitor sees, not your server files or database, where the deeper parts of an infection hide. A clean result is reassuring but not proof; a bad result tells you where to start.

The 4 Most Common WordPress Hacks

Most infections fall into one of these four patterns. Match your symptoms to the closest one.

1. Redirect Hack

Symptoms: visitors are sent away to scam shops, gambling pages, or fake prize pages, often only when they arrive from search results or on phones. You may see nothing wrong: the redirect is commonly hidden from logged-in admins and the owner’s IP address.

How to spot it: open your site logged out in a private window, arriving from a Google search result, ideally on a phone; ask a friend elsewhere to open it too. First response: containment matters most, because every redirected visitor meets a scam under your name. Keep the site in maintenance mode while you clean.

2. Japanese Keyword Hack

Symptoms: your site looks normal when you browse it, but Google shows Japanese text for your pages, and fake Japanese pages, often advertising fake brand goods, fill your domain.

How to spot it: search Google using site: followed by your domain for pages you never created; Search Console’s page indexing report shows them clearly. First response: do not just delete the fake pages; malicious code and database entries will recreate them until the source is removed.

3. Pharma Hack

Symptoms: adverts and links for medicines you have never sold appear inside your pages or search results. The injected content is often hidden from logged-in users and shown only to search engines and visitors, so owners are usually the last to know.

How to spot it: view your pages logged out and check the page source for links and words you never wrote. First response: note the affected pages, then work through the cleanup steps below; pharma injections usually sit in the database as well as in files.

4. Crypto-Mining / Malware Injection

Symptoms: your site becomes very slow, your hosting shows unusually high resource use, or visitors complain their devices heat up and batteries drain on your pages. A script is using your visitors’ devices, or your server, to mine cryptocurrency for the attacker.

How to spot it: check resource usage in your hosting panel and ask your host about mining activity; a security plugin scan usually flags the scripts. First response: keep the site in maintenance mode so visitors’ devices stop being used, and tell your host, as mining scripts sometimes sit at server level, not inside WordPress alone.

Minutes 20-30: Execute These Quick Cleanup Steps

You have contained the site and identified the hack. The last ten minutes are the first safe cleanup steps: they do not replace a full cleanup, but they remove common entry points and clarify the damage.

Step 1: Restore from a Clean Backup (If Available): 10 minutes

If you have a backup from before the hack, restoring it is the fastest way back to a working site. The date matters: restoring a backup made after the hack simply restores the malware along with your content.

Two warnings. First, choose the most recent backup you are confident is clean. Second, a restore alone is not a fix: the backup holds the same weak plugin, theme, or password setup that let the attacker in, so the attack can succeed again within days. Afterwards, still change every password, update everything, and work through the prevention checklist below.

If you have no backup, or none old enough to trust, skip this step; the full cleanup after the thirty minutes will matter more in your case.

Step 2: Delete Unknown Admin Users: 3 minutes

Attackers often create their own administrator accounts so they can log back in after you change your password. In the Users section of your dashboard, check every account, especially administrators, and delete any you do not recognise, plus old accounts nobody uses.

A fake admin may be hidden from the dashboard list; check the wp_users and wp_usermeta tables in the database, through phpMyAdmin in your hosting panel. Be careful: export a database backup first, and if you are not confident with database tables, skip this check and let a professional do it; deleting the wrong rows can lock you out of your own site.

Step 3: Update Everything, Everything: 5 minutes

Outdated software is the most common way in, so close it now: update WordPress core, every plugin, and every theme. Updates repair the known weaknesses attackers scan for automatically, day and night.

While you are there, delete plugins and themes you no longer use rather than leaving them inactive; inactive code still sits on your server and can still be attacked. Remove abandoned plugins and find maintained alternatives. Take a fresh backup before major updates if you can.

Step 4: Install Wordfence and Run First Scan: 7 minutes

Install Wordfence from the WordPress plugin directory, activate it, and run a full scan. It compares your core files against the official versions, looks for known malware patterns, and flags files that do not belong.

Read results by type: critical issues and modified or malicious files first, then unknown files in upload folders, because uploads should hold media, not code. For modified core files, the safe fix is normally to reinstall WordPress core from the official source, through the Updates screen, rather than deleting core files by hand.

One caution: a scan is a starting point, not the whole cleanup. Scanners can miss clever backdoors and infections living only in the database. If the scan finds a lot, or symptoms continue, treat the site as still infected and move to the deeper cleanup.

What Happens After 30 Minutes: The Real Cleanup Begins

The first thirty minutes stop the bleeding; they rarely finish the job. A full cleanup goes through your files and database systematically, because that is where the rest of the infection waits, and why hacked sites so often get hacked again after a quick fix.

The Hidden Backdoors Hackers Leave Behind

A backdoor is a hidden way back in that does not need your password, planted in the expectation that you will remove only the obvious infection. Common forms include administrator accounts hidden from the dashboard, small malicious files among thousands of legitimate ones, code tucked into theme or plugin files, rogue scheduled tasks, and files disguised as images in upload folders.

This is why password changes alone are not enough, and why a site can look clean for a week before the hack reappears: the visible infection was removed, the backdoor was not, and the attacker walked back in. A proper cleanup hunts for backdoors deliberately, in the places scanners most often miss.

Database Cleaning: Where Most DIY Cleanups Fail

Many owners clean their files and stop there. But WordPress stores content, settings, and users in a database, and malware uses it too: spam links and fake pages in posts and options tables, malicious settings that redirect parts of your site, fake accounts in the user tables. Replacing files touches none of that.

Database work is also where careful people do accidental damage: tables are connected, and deleting the wrong rows can remove real content or break the site. Back up first, work methodically, and check the site after each change. If this side of a cleanup feels beyond you, bring in professional help rather than guess.

Lessons From Real Cleanups: What Works and What Fails

Across cleanup work in general, the same lessons appear again and again, and knowing them in advance makes a real difference when it is your site.

• Delay makes everything worse. The longer spam pages stay live, the more search engines index and the longer they take to disappear afterwards. Acting in the first hour limits how much of the infection the outside world ever sees.
• Sites without backups have the hardest recoveries. A clean backup turns a crisis into a procedure; without one, every malicious entry must be found and removed by hand, slower and less certain.
• Containment comes before cleaning. Owners who hide the site and change passwords first protect their visitors and accounts; owners who start deleting things usually end up doing the cleanup twice.
• Most reinfections are not new attacks. When a hack returns, the cause is usually a missed backdoor from the first infection, not a fresh break-in. The fix is a more thorough cleanup, not more panic.
• The door in is usually boring. Again and again, the entry point is an outdated plugin, a weak password, or a pirated premium plugin or theme carrying malware from the start. Prevention is mostly unglamorous housekeeping.

The Complete Prevention Checklist (Do This After Cleanup)

Once your site is clean, work through this checklist. It turns the lessons above into a routine, and it is what separates a site that stays clean from one hacked again the following month.

Immediate (Do Today):

• Update WordPress core, every plugin, and every theme to the latest version.
• Delete every plugin and theme you do not use. Inactive is not the same as gone.
• Change all passwords again if any were skipped earlier, and turn on two-factor authentication for administrator accounts.
• Disable file editing from the dashboard by adding this line to your wp-config.php file, just before the line that says “That’s all, stop editing!”:

define( 'DISALLOW_FILE_EDIT', true );

• Limit repeated failed login attempts with your security plugin, so password guessing becomes impractical.
• Give every person their own account with the lowest role they need, and remove shared and forgotten accounts.
• Keep a full backup, with at least one copy stored away from the server itself.

Weekly (15 minutes):

• Check for updates and apply them, rather than letting them pile up.
• Glance at the user list for accounts you do not recognise.
• Confirm the latest backup completed successfully.
• Read any alerts or scan results from your security plugin instead of ignoring them.

Monthly (30 minutes):

• Verify a backup actually works, by downloading it or restoring it to a test copy of the site.
• Review all administrator accounts and the services connected to your site.
• Check Google Search Console for security issues and for spam pages appearing under your domain.
• Review your plugin list: remove anything unused, and replace plugins that their developers have abandoned.

If keeping up with this routine alongside running your business is difficult, our WordPress maintenance plans cover exactly that: updates, backups, and regular checks handled on a schedule.

When DIY Is Not Enough: Getting Professional Help

The steps above handle containment and a good share of cleanups. Bring in professional help when the hack keeps coming back, when you find things in the database you do not understand, when your site is blacklisted, when you have no clean backup, or when customer accounts and orders may have been exposed. These are the situations where guessing does damage.

A proper professional cleanup includes:

• A full audit of your files against clean copies, plus an inspection of the database.
• A deliberate hunt for backdoors: hidden accounts, rogue scheduled tasks, modified files, and code hiding in upload folders.
• Removal of blacklist warnings by submitting review requests once the site is genuinely clean.
• Hardening afterwards, so the same entry point cannot be used again.
• A written report of what was found, how the attacker got in, and what was changed.

On cost, be careful with anyone who quotes a fixed figure before looking at your site. Cleanup work depends on how deep the infection goes: a surface infection in a few files is a small job; backdoors spread through a database are not. A trustworthy provider inspects first, explains what they found, then quotes. That is how we work at Raozan IT: our WordPress security services cover this kind of cleanup and hardening, and we will gladly look at a hacked site and tell you honestly what it needs first.

Frequently Asked Questions

How do I know for sure if my WordPress site is hacked?

Look for changes you did not make: redirects, new pages or text you never wrote, unfamiliar admin accounts, warnings in your browser or in Google results, or a notice from your hosting company. Confirm it with an external scan such as Sucuri SiteCheck and a security plugin scan. Some hacks hide from the owner, so check logged out and through a search result, not only from your dashboard.

Can I clean a hacked WordPress site myself without technical skills?

Partly. The containment steps, maintenance mode, password changes, screenshots, and updates, are within most owners’ reach and genuinely help. Full removal is harder: comparing files, reading scan results, and working in the database, where one wrong deletion can break the site. Do the first thirty minutes in this guide; if the infection looks deep or keeps returning, stop there and get help.

How much does professional WordPress malware removal cost?

It varies, because the work varies. A light infection in a few files is a small job; backdoors spread through files and a database take considerably longer, and pricing differs between providers. Treat a flat quote given before inspection as a warning sign: nobody knows the job’s size before looking. Raozan IT inspects first, then quotes; expect the same from any provider.

Will I lose my website content and images during cleanup?

Usually not. Posts, pages, and products live in the database and images in the uploads folder; a proper cleanup removes malicious code, not content. A backup taken before the cleanup protects everything, so anything unexpected can be undone. Loss is mainly a risk when a site is so badly damaged it must be rebuilt, one more reason to act early and keep backups.

How long does Google blacklist removal take after cleaning?

Once the site is genuinely clean, you request a review through Google Search Console and Google checks the site again. It often takes some days, sometimes longer; the timing is Google’s, and no provider can speed it up or promise a date. Submitting before the cleanup is complete usually leads to rejection and a slower path back, so cleaning comes first. Other blacklists have their own processes.

What’s the most common way WordPress sites get hacked?

Through known weaknesses in outdated plugins, themes, or WordPress core itself. Attackers scan automatically for sites running versions with published flaws, so a site that skips updates is easy to find. Weak and reused passwords come next, then pirated copies of premium plugins and themes, which often contain malware from the day they are installed. All three are preventable with the checklist above.

Does changing all passwords guarantee the hacker can’t get back in?

No. Password changes lock the doors you know about, and they are an essential early step. But attackers often leave hidden backdoors: extra admin accounts, modified files, or database code that works without any password at all. If only passwords change, the attacker returns through the hidden entrance and rebuilds the infection. Password changes must be paired with a real check of files, accounts, and database.

Should I tell my customers my site was hacked?

If customer information, such as names, emails, or order details, may have been exposed, yes: telling them promptly is right, and in many places also a legal duty. Explain what happened, what was involved, and what you have done. If the hack was only spam or redirects with no sign data was touched, a quiet cleanup may be enough. Either way, wait until you know the facts.

How often should I backup my WordPress site to prevent this?

Match the schedule to how often your site changes: an active shop, or one publishing daily, should be backed up daily; a quiet business site can manage weekly. Either way, take an extra backup before updates and big changes, and keep one copy away from the server, in cloud storage or on your own computer, because a backup on the same hacked server can be deleted or infected along with the site. Test backups occasionally too.

Can a good security plugin prevent all hacks?

No plugin can prevent every attack, whatever its marketing suggests. A good one earns its place by blocking many common automated attacks, scanning, and alerting you quickly. But it cannot compensate for weak passwords, abandoned plugins, or skipped updates. Real security is layered: updates, strong unique passwords, two-factor authentication, tested backups, and a plugin watching over all of it. No single layer has to be perfect when the others are in place.

If your site is hacked now and you would rather hand the problem to a team, start with our services: Chat on WhatsApp, message us through our contact page, or email [email protected]. Tell us what you are seeing, and we will look first and advise honestly.