How to Recover a Hacked WordPress Site

Stay Calm and Work Through This in Order

A hacked website is stressful, but the recovery process is a known, orderly sequence: contain the damage, confirm the extent of it, restore clean, and close whatever let the attacker in. Working through it out of order, or skipping steps, is how sites get reinfected shortly after being cleaned up.

Step 1: Confirm It's Actually Compromised

Common signs include an unfamiliar admin user account, unexpected redirectsA server instruction that automatically sends a browser from one URL to another. sending visitors to another website, spam content or links appearing on pages you didn't edit, a sudden unexplained traffic or search ranking drop, or your browser or host flagging the site as unsafe. If you're seeing any of these, treat it as a real compromise rather than waiting to see if it resolves on its own.

Step 2: Change Every Password Immediately

Change your WordPress admin password, your hosting account password, and any FTP or database passwords, since any of these could have been exposed. Do this before anything else, so whoever has unauthorized access loses it as quickly as possible.

Step 3: Take the Site Offline or Into Maintenance Mode

Putting the site into maintenance mode, or taking it fully offline temporarily, stops the compromise from actively serving malicious content or spreading further while you work on it.

Step 4: Restore From a Clean Backup, If You Have One

This is the fastest path back to a working site, but only if you're confident the backup predates the compromise. Restoring a backup taken after the site was already infected just brings the same problem back. See How to Back Up and Restore Your Website in cPanel for the restore process itself, and check the backup's date carefully against when you first noticed anything unusual.

Step 5: If There's No Clean Backup, Clean Up Manually

Without a safe backup to restore, cleanup means checking for unfamiliar admin user accounts and removing them, reviewing installed plugins and themes for anything you don't recognize, and scanning the site with a security plugin. See Wordfence and Other WordPress Security Plugins for what a malwareMalicious software planted on a site or server, often to steal data, send spam, or host scam pages. scan actually checks. This is more technical than a backup restore, and it's reasonable to get help at this stage if you're not confident doing it yourself.

Step 6: Update Everything Before Bringing the Site Back

Update WordPress core, your theme, and every plugin to their current versions before the site goes back online. If an outdated, vulnerable plugin was how the attacker got in, restoring or cleaning the site without updating it just leaves the same door open.

Step 7: Figure Out How It Happened

Whenever possible, work out what actually let the attacker in: an outdated plugin with a known vulnerability, a weak or reused password, or a compromised admin account are the most common causes. Fixing the specific weakness matters more than any other single step, since a clean site with the same vulnerability still open is likely to be compromised again.

Prevent the Repeat

Once the site is back and clean, work through WordPress Security Best Practices in full, and if you weren't running a security plugin before, it's worth starting now. If you're not sure where the compromise came from or how to fully clean up, contact support rather than guessing.