You don’t need a giant red warning screen to have a hacked website.
Sometimes it’s weirder than that. Your homepage suddenly loads slower. A customer says your site redirected them to a betting page. You spot a new admin user you definitely didn’t create. Or your hosting company sends that lovely little email nobody wants: suspicious activity detected.
If your gut says something’s off, don’t shrug it away and “check later.” That’s how a small problem turns into a long messy weekend. The first hour matters alot.
First, don’t start clicking around like crazy
I get it. The instinct is to log in, update 12 plugins, delete random files, maybe install three security plugins and hope one of them saves the day. Big mistake.
If the site is compromised, every change you make can muddy the trail. You can break evidence, spread the damage, or make cleanup harder. And if your site handles leads, bookings, or orders, chaos is the last thing you need.
So. Pause for a second.
Your job right now is simple: contain the problem, gather a few facts, and stop it getting worse.
Step 1: Confirm the signs without trusting the site too much
Don’t rely only on what you see while logged in. Attackers often hide things from admins. Sneaky, but common.
Check a few basics:
- Open your site in an incognito window
- Test it on your phone using mobile data, not your office Wi-Fi
- Google your domain name and see if strange page titles or spam results appear
- Try a few key pages – homepage, contact page, checkout if you have one
- Look for odd redirects, popups, broken layouts, or new users in WordPress
If you can still access the dashboard, review recent activity. This article on reading your WordPress activity log: normal vs suspicious gives a good plain-English idea of what to look for.
And yes, weird signs count even if the site still “mostly works.” Malware doesn’t always kick the front door down. Sometimes it slips in through a side window and sits there quietly.
Step 2: Change passwords. Right away.
Do this before you start cleanup.
Change the password for:
- Your main WordPress admin account
- Any other admin users
- Your hosting account
- FTP or SFTP accounts
- Your database user if your host allows it
Use fresh passwords, not “OldPassword2024!” with one extra symbol slapped on. If more than one person has admin access, tell them what’s happening and make sure they update theirs too.
If you don’t already have 2FA turned on, this is a very good time to fix that with two-factor authentication.
I’ve seen hacked sites where the owner cleaned everything up, felt relieved, then got reinfected two days later because the attacker still had the login. Brutal.
Step 3: Take the site offline if customers could be at risk
This part depends on what the site does.
If it’s a simple brochure site for a local accountant, and the compromise seems limited to spam pages, you might not need to pull the whole thing down instantly. But if it’s an online shop, membership site, booking system, or anything that collects user details, be more aggressive.
Ask yourself one question: could visitors be harmed if they keep using the site right now?
If yes, put it into maintenance mode or temporarily disable public access through hosting. Not fun. But better than exposing customers to phishing pages, stolen form data, or fake checkout screens.
For e-commerce sites, this gets serious fast. A hacked WooCommerce store isn’t just a website issue. It’s a trust issue, maybe even a legal one.
Step 4: Make a backup copy before touching files
This sounds backwards, I know. Why back up a hacked site?
Because you may need the current state for investigation, recovery, or comparing clean files against infected ones later. Grab a copy of the files and database before you start deleting stuff. If your host has snapshot backups, note the dates and keep them safe.
Don’t assume your latest backup is clean, though. That’s another trap. If malware has been sitting around for three weeks and your backup is from last Tuesday, congrats, you backed up the infection too.
Still useful. Just don’t blindly restore and call it solved.
Step 5: Check the obvious weak spots
You don’t need to be a forensic analyst to spot a few common entry points.
Look at:
- Recently installed or abandoned plugins
- Admin accounts you don’t recognize
- The active theme, especially if it was custom-built years ago and never touched again
- Modified core WordPress files
- Suspicious scheduled tasks, hidden pages, or weird PHP files in uploads
If you want a fast reality check, run a proper malware scanner and compare the results with what you’re seeing manually. Honestly, most people don’t need ten security tools. They need one decent scanner and the patience to actually read the output.
Also check your plugins against known bad actors. Old slider plugins, nulled themes, random “SEO booster” junk – these are repeat offenders. Every year the same nonsense.
This is where a lot of owners discover the real problem wasn’t some movie-style hacker. It was an old plugin nobody updated because “the site seemed fine.”
Step 6: Tell the right people
Not everyone. Just the people who need to know.
If you have a developer, maintenance provider, or host with security support, contact them now with specifics. Not “the site is broken pls help.” Send what you saw, when it started, and what you’ve already changed.
If customer data may have been exposed, get proper advice fast. Depending on where your business operates, you may have reporting obligations. This part isn’t glamorous, and it’s easy to avoid because it feels scary. Don’t avoid it.
If you don’t have technical backup and need cleanup help, a dedicated site cleaning service is a much better move than poking at infected files until 1:30 a.m.
Step 7: Don’t just “remove the weird file” and move on
This is where people get burned.
You delete one suspicious file. The site looks normal again. You breathe out. Done, right?
Nope.
A proper compromise often includes more than the visible payload. Attackers may add a hidden admin account, a backdoor in wp-content/uploads, altered core files, spam pages, database injections, or cron jobs that reinfect the site later. If you only remove the symptom, you’re leaving the door unlocked.
For a clearer idea of how ugly the first day can get, read what happens in the first 24 hours after a WordPress hack. It lays out the chain reaction pretty well.
After cleanup: fix the reason it happened
This part matters just as much as the cleanup itself. Maybe more.
Because if the site got in through an outdated plugin, weak admin password, reused hosting login, or old custom code from 2021, it’ll happen again unless that hole gets closed. I’ve seen businesses clean the same site three seperate times. Same plugin. Same story.
Once the site is stable again, do a proper post-mortem:
- Update WordPress core, plugins, and themes
- Delete anything unused
- Remove old admin users and tighten permissions
- Enable 2FA and login protection
- Review backups and make sure they’re actually usable
- Set up monitoring so you’re not finding out from a customer next time
And if nobody in your business wants to babysit WordPress every month, that’s normal. Most small business owners have better things to do. A proper WordPress maintenance setup exists for exactly this reason – updates, monitoring, backups, and someone noticing trouble before your client does.
The short version
If you think your site is compromised, don’t panic. But don’t wait either.
Change access. Check the damage. Protect visitors. Save a copy. Investigate the weak spot. Get help if you’re out of your depth. Then fix the underlying cause, not just the ugly symptom sitting on the homepage.
That’s the real job.
Because a hacked website isn’t just a tech annoyance. For a small business, it’s missed enquiries, embarrassed emails, weird search results, and customers quietly deciding they don’t trust you anymore. And that part is harder to repair than the code.