Strange pages, redirects or a Google warning on your site? Here is what to do in the first hours after a WordPress hack, and how to stop it from happening again.
If visitors are redirected to another site, odd titles appear under your site in Google results, or the browser warns that "this site may be harmful", your site has most likely been compromised. Acting calmly and in the right order greatly reduces the damage.
Signs Your Site Has Been Hacked
- The site redirects to another address, often ad or gambling sites
- Pages and titles unrelated to your business appear in Google
- Unknown users or plugins in the admin panel
- Warnings from your host about high resource usage or spam sending
- A security warning in the browser or in Google Search Console
What to Do in the First Hours
1. Take a copy of the current state
Before deleting anything, take a copy of the files and the database. You will need it to understand how the attack happened. Store it somewhere other than the live server.
2. Change every password
Change the passwords for WordPress admin accounts, the hosting panel, FTP/SFTP and the database. Delete admin users you do not recognise and, if possible, enable two-factor authentication for admin logins.
3. Remove malicious files and changes
Find and clean injected code in theme and plugin folders, the uploads directory and the database. Reinstalling the WordPress core files from the official source is a safe way to get rid of modified core files.
4. Close the hole
Most attacks come through outdated plugins and themes. Update WordPress, every plugin and the theme, and remove plugins and themes you do not use.
5. Tell Google
Once the cleanup is done, check the Security Issues report in Google Search Console and request a review. This removes the browser warning and the label in search results faster.
6. Assess any personal data breach
If your site stores forms, memberships or customer details, assess whether that data was accessed. Data protection laws such as GDPR and Turkey's KVKK require personal data breaches to be reported to the authority within 72 hours. Work with your legal adviser on this.
If the Site Keeps Getting Hacked
When a cleaned site is compromised again soon after, a hidden backdoor usually remains or the setup itself is flawed. The healthiest fix is then to take the content and rebuild the site on a clean install or a modern static site. Static sites have no database or plugins running on the server, so the attack surface is much smaller.
Lasting Measures
- Keep WordPress, plugins and themes up to date
- Keep only the plugins you really use
- Use strong passwords and two-factor authentication for admin logins
- Host the site behind a firewall
- Take regular backups stored away from the site and test restores
How CloudRUX Can Help
We clean your compromised site, close the vulnerability and, if needed, rebuild it with the same content on secure infrastructure. Your site is hosted on our infrastructure in Turkey behind an enterprise firewall and maintained regularly. See our Business Website and Web Hosting pages for details.