You have just found out. Maybe Google is showing a warning, maybe the host has disabled the account, maybe the homepage now displays a message from someone you have never heard of. Your pulse is up and the obvious urge is to do something, anything, right now.
The first hour matters, but mostly because of the mistakes people make in it. A rushed delete, a blind restore or a password changed on an infected laptop can turn a fixable problem into a long one. This post is a short checklist for that first hour: what to do, in what order, and what to leave alone. It is not the cleanup itself. When you are ready for that, our full walkthrough for cleaning a hacked WordPress site covers it stage by stage.
First, write down what you know
Before you open the dashboard or the file manager, spend five minutes on notes. It feels like a waste of time. It is not.
- What did you or someone else see, exactly? A redirect, a warning, new pages, a changed homepage, emails bouncing?
- When was it first noticed, and by whom?
- Has anything been changed lately, such as an added plugin, an updated theme, a fresh staff login or a developer wrapping up a job?
- Who has access today: staff, freelancers, an old agency, a plugin vendor’s support team?
Take screenshots of anything visible, including warning emails from the host or Google. Whoever investigates later will ask these questions, and memory gets blurry fast once you start changing things.
Make a full copy before anyone changes anything
This is the step people skip, and it is the one they regret skipping. Download a complete copy of the site in its current state, infected parts included: every file, plus an export of the database. Store it off the server, on your computer or in cloud storage, and label it clearly as the compromised copy.
Why keep a copy of a hacked site? Two reasons. It records the attacker’s route and every change they made. And if a cleanup goes wrong and deletes something important, such as orders, form entries or a page nobody else had a copy of, you have something to recover from. Our guide on backing up a WordPress website properly shows the usual ways to take that copy.
Protect your older backups too
Here is a trap that catches a lot of owners. Many backup plugins and hosting backup systems keep only a fixed number of copies and quietly delete the oldest each time a new one runs. If the site was infected a while ago, each new automatic backup is another infected copy pushing a clean one out of the list.
So check your backup settings now. Pause scheduled backups if you can, download the oldest copies that still exist, and ask your host which restore points they hold and for how long. Do not restore any of them yet. Just stop them disappearing.
Decide whether visitors need protecting right now
Not every hack needs the site taken offline. The question to ask is simple: is the site hurting the people who visit it?
- Take it offline, or show a maintenance page, if visitors are being redirected to scams, if a browser warning says the site carries malware, if a fake payment form may be collecting card details, or if the site is asking visitors to download something.
- It can usually stay up for now if the problem is spam pages added for search engines, hidden links, or a defaced page that only embarrasses you. Those still need fixing quickly, but they do not put a visitor’s device or money at risk.
If you do take it down, use a proper maintenance setup rather than deleting files. Our post on putting WordPress into maintenance mode correctly explains how to do that without harming your search listing.
Change passwords in the right order, from a device you trust
Changing passwords is obvious. The order and the device are not.
Start with the computer you are using. If there is any chance it is infected, for example if the site’s FTP password was saved in an old FTP program on it, use a different device for the next steps. A password typed on a compromised machine can be stolen again within minutes.
Then work from the top down:
- The email account that receives password resets for your hosting, domain and WordPress. Whoever controls that inbox can reset everything else.
- The hosting account and control panel.
- The domain registrar, so nobody can point your domain elsewhere or transfer it.
- WordPress administrator accounts.
- SFTP, FTP and database passwords. Changing the database password means updating it in the site’s configuration file as well, or the site will stop loading. If that is unfamiliar, leave it for whoever does the cleanup and note it on your list.
- Connected services: payment gateway keys, email sending services, and any API keys stored in plugins.
Switch on two-step verification wherever it is offered as you go. If you are not sure whether the problem started with a stolen mailbox rather than the website itself, read our comparison of a compromised mailbox versus a compromised site, because the fix is different.
Tell the people who need to know
A short message to the right people now saves confusion later.
- Your host. Reply to any notice they sent, tell them you are dealing with it, and ask what they found and whether other sites on the same account are affected.
- Staff and anyone with a login. Ask them not to log in until passwords are reset, and to tell you if they clicked anything unusual recently.
- Your developer or agency, if you have one. They may know about a recent change that explains the timing.
- Your payment provider, if you run a store and there is any sign the checkout was tampered with.
Whether and how to tell customers is a separate question that depends on what data was exposed and where you operate. It rarely has to be decided in the first hour, and it is worth getting proper advice on before you send anything.
What not to do in the first hour
Most of the damage done after a hack is done by the owner, with good intentions. Avoid these.
Do not delete everything and reinstall
Wiping the site and starting fresh sounds clean. In practice it destroys the evidence, often loses content that was only in the database, and does nothing about the weakness that let the attacker in. The new site goes up with the same old door open.
Do not restore the latest backup without thinking
Restoring the most recent backup is tempting because it is quick. If that backup was taken after the infection, you have restored the malware along with your content. Even a backup that really is clean puts back the old plugin versions and logins that existed before the break-in, including whichever one let the attacker through. Our post on when a backup restore is enough after a hack goes through how to judge this.
Do not delete the one file a scanner flagged and call it fixed
Scanners find the noisy parts of an infection. The quiet parts, such as a second backdoor or a rogue admin account, are often still there. If the problem comes back a few days later, this is usually why.
Do not stack security plugins
Installing three security plugins at once in a panic tends to cause conflicts, lock you out, or slow the site to a crawl. One well-configured tool, used after the cleanup, does more good.
Do not ask Google for a review yet
If Search Console shows a security issue, the review button will be sitting there. Pressing it before the site is properly clean usually gets the request rejected, and you start again.
Do not hand access to whoever emails you first
Owners of flagged sites sometimes receive unsolicited offers of help, or threats demanding payment. Do not give admin access or money to anyone you did not approach yourself.
Do not move hosts in a hurry
Switching to a new host feels like escaping the problem. Copying infected files to a new server simply moves the infection, and you lose the logs on the old server that might show how it started.
What can wait until tomorrow
Some jobs feel urgent but are better done after the site is clean: choosing a new security plugin, rebuilding your search rankings, redesigning the site, or writing to customers. None of them helps while the attacker may still have a way in. Write them on a list and come back to them.
Then decide who does the cleanup
Once the first hour is done, you have a copy of the site, older backups protected, visitors kept safe, passwords changed and the right people told. Now the real work starts: finding every piece of malicious code, closing the way in, and checking nothing comes back.
If you are technical, the step-by-step guide linked at the top of this post is a sound place to begin. If you mainly need to know how the attacker got in, perhaps because this is not the first time, a proper investigation into how the site was breached answers that before anything is cleaned. For a wider view of the options, including help for owners in India and the USA, see our hacked website repair page.
If you would like someone to take over from here, our emergency support for hacked websites page explains how we handle urgent cases. Message us on WhatsApp and start with the word HACKED. From there we review the site, back it up before anything is changed, and give you a straight answer about what we find and when work can begin.
Next in this series: How Websites Get Hacked: The Common Ways In
