In short: if your website has been hacked, the first thing is don’t delete anything. Change the WordPress, hosting and FTP passwords, save a copy of the site as it is now and tell whoever manages it. Then you need to work out how the attack got in: removing the malware without closing the hole is the surest way to get hacked again a few days later.
We’re writing this as people who look after more than 200 sites. The examples are from WordPress, but the reasoning applies to any site.
How can I tell if my website has been hacked?
A hacked site doesn’t always show it on the home page. Attackers usually want to use it without being noticed: to send visitors elsewhere, publish spam pages or send emails. The most common signs:
- strange redirects: people coming from Google end up on betting, pharmacy or fake prize sites, while you, typing the address in yourself, see the normal site;
- pages in languages you don’t have in Google’s results (search “site:yourdomain.com” and see what comes up);
- the browser warning “Deceptive site ahead” or “The site ahead contains malware”;
- an email from Google Search Console reporting security issues;
- your hosting suspending the site or blocking outgoing email because of suspicious traffic;
- admin users you don’t recognise, plugins you didn’t install, files with odd names in the site’s folder.
One of these signs is enough to treat the site as compromised until proven otherwise.
What to do in the first few hours
The first moves decide how easy the clean-up will be. In this order:
- Change the passwords: WordPress admins, hosting control panel, FTP or SFTP, the database if you can. If you use the same password anywhere else, change that too.
- Save a copy of the site as it is now, files and database, even though it’s infected. It’s for working out what happened, not for putting back online.
- Check your backups: how many you have, how old they are, where they’re stored. A backup kept on the same server may be infected too.
- Tell your hosting provider: they’ve often already seen something in the logs and can tell you whether other sites on the same account are affected.
- Open Google Search Console and look at the Security issues report: it shows what Google has found and on which pages.
If the site sells online, consider putting it into maintenance mode while the work is done: better a day offline than customers sent to a scam site.
What not to do
|
Avoid |
Why |
|---|---|
|
Deleting files at random |
You lose the traces that show how the attack got in |
|
Just reinstalling WordPress |
The malicious code often sits in the database and the uploads folder, and the hole stays open |
|
Restoring the latest backup without checking it |
If the attack is old, the backup may be infected too |
|
Installing five security plugins at once |
It slows the site down and complicates the diagnosis, without removing anything |
|
Asking Google for a review straight away |
If the clean-up isn’t complete the request is rejected, and you start again |
How to remove malware from a WordPress site
A proper clean-up has four steps, and the first is the most important.
1. Analysis
It starts from the copy of the site: a scan of the files and the database, a comparison of the WordPress core, themes and plugins with the original versions, a check of the users and the server logs. The goal is to find the way in: usually an old plugin with a known vulnerability, a weak or stolen password, or another hacked site on the same hosting.
2. Clean-up
We remove the files added by the attack, the code injected into existing files and the code hidden in the database (in options, posts, users). Core, theme and plugins are put back from the original sources rather than patched by hand. If there’s a clean backup from before the attack, we consider starting again from there and recovering the content and orders that came in afterwards separately.
3. Closing the hole
The vulnerable plugin is updated or replaced, passwords and WordPress security keys are changed again, unnecessary accounts are removed, file permissions and the PHP version are put right. Without this step the clean-up doesn’t last.
4. Google and the hosting provider
Once the site is clean, you ask Google to review it from Search Console with the Request review button, explaining what was found and what was done. Google itself says the review can take from a few days to a few weeks; once it passes, the “dangerous site” warning disappears. Spam pages left in the results are removed separately. If the hosting provider had suspended the site or its email, you show them the problem is solved.
It isn’t always possible to recover everything. A badly compromised site, with no backups and a theme edited by hand over the years, is sometimes better rebuilt from its content. You find that out after the analysis, not before.
How to stop it happening again
Most of the sites we see hacked twice have the same problem: they were cleaned, but nobody looked after them afterwards. The things that really matter are few:
- regular updates to WordPress, themes and plugins, tested first on a copy of the site (staging);
- fewer plugins, and only maintained ones: an abandoned plugin is a door left open;
- unique passwords and two-factor authentication for everyone who runs the site;
- a system that blocks intrusion attempts before they reach WordPress;
- automatic backups stored off the server, with tested restores: they’re what lets you go back to before the attack;
- monitoring with alerts if the site changes or goes down.
It’s the work we describe in the note on WordPress support and that we do with WordPress maintenance.
What to ask whoever cleans up your site
- Will you tell me how the attack got in, or just what you removed?
- Have you closed the hole, or only cleaned the files?
- Have you also checked the database and the other sites on the same hosting?
- Who requests the review from Google, and who follows up on the answer?
- Will you tell me the price before you start, after looking at the site?
With us it works like this: first an analysis, then we tell you what we found and what the clean-up costs, before we begin. If we already look after the site under a maintenance plan, malware that’s easy to spot is removed as part of the plan; complex cases, or sites we don’t look after, are quoted separately. The details are on the page about the hacked WordPress site.
Ortica is two people, Riccardo and Davide, working on the web since 2016: the person who answers is the person doing the work, with no middlemen.
