My WordPress site has been hacked: what to do
What to do in the first hour, how WordPress sites usually get in, whether to clean the site or rebuild it, and how to stop it happening again.
By Gary Blake · Bath IT, Radstock
Guides
WordPress
If your WordPress site has been hacked, don't delete anything yet. Change your passwords, take a copy of the site as it is, and tell your host. Then find out how they got in, because cleaning a site without closing the way in usually means it happens again. Many hacked sites can be cleaned. Some are better rebuilt.
Signs your site has been hacked
Some hacks are obvious. Others are built to stay hidden, because a hacked site is more useful to an attacker if nobody notices. Look out for:
Pages, posts or links you didn't add, often selling pills, loans or fake goods.
Visitors on phones being sent to another site, while it looks fine on your computer.
Strange titles or foreign-language text for your pages in Google, or a warning that the site may be hacked.
Admin users you don't recognise, or your own login no longer working.
Your host suspending the site, or emailing about spam being sent from it.
The phone redirect catches people out. Many hacks only show to visitors who arrive from Google, or who aren't logged in, so the owner sees a normal site. If a customer says something looks wrong, believe them, and check on a phone that has never logged in.
What to do right now
Work through these in order. None of them needs technical knowledge, and together they stop things getting worse while you decide what to do.
Change your passwords: WordPress, the hosting control panel, FTP, and the email account the site uses.
Don't panic-delete. Deleting files destroys the evidence of how they got in, and often your only copy of your content.
Back up what's there, hacked or not: the files and the database, labelled as hacked.
Tell your host. They can often see where it started, and some will scan or help.
Note down any admin users you didn't create, then remove them.
If the site takes payments or holds customer details, tell whoever helps you. That changes what needs checking, and you may need to tell your customers or the ICO.
How WordPress sites usually get in
WordPress itself is well looked after. The trouble is nearly always what's been added to it, or how people log in.
Old plugins and themes. Each one is code written by someone else. When a hole is found in a popular plugin, a fix comes out, but a site that isn't updated keeps the hole, and attackers scan for sites still running the old version. Abandoned plugins are worse: nobody is going to fix them at all.
Weak or reused logins. An admin password used elsewhere, a username of "admin", or old accounts for people who left long ago. Bots try logins on WordPress sites all day.
Nulled themes and plugins. These are paid themes passed round free on download sites, and they often come with something hidden inside. A site built with one may have been compromised from the day it went live.
Old PHP and old hosting. PHP is the language WordPress runs on. A server stuck on an old version no longer gets security fixes.
Clean it or rebuild it?
Cleaning means finding and removing everything the attacker added, closing the way in, and checking nothing is left behind. It's the right answer when the site is otherwise sound: a current theme, plugins that are still maintained, and someone to keep it updated afterwards.
Rebuilding makes more sense when the hack is a symptom of years of neglect. If the theme is abandoned, half the plugins haven't been updated in a long time and nobody understands the page builder any more, you can pay to clean it and still be left with the thing that got hacked.
Be wary of anyone who promises a clean in ten minutes without asking how it happened. A scan that removes the obvious files can leave a back door in place. Our guide to whether to move off WordPress goes through that choice in more detail.
Stopping it happening again
Keep WordPress, plugins and themes updated, and check the site afterwards.
Delete plugins and themes you don't use, rather than just switching them off.
Replace anything abandoned or nulled with something maintained.
Give everyone their own login with a strong password, and turn on two-step login for admins.
Keep backups off the server, and test that one actually restores.
Make sure the server runs a supported version of PHP.
Getting help
Bath IT cleans and secures hacked WordPress sites, and tells you honestly whether cleaning or moving is better value. Start with our free security check, then we quote in writing, at £75 an hour, before any work starts. See WordPress help for how it works.
Quick answers
Rather start again on something simpler?
If your WordPress site is more trouble than it's worth, we'll build a free mockup of a new homepage, so you can see the alternative before you decide.