It usually starts with a message from a customer. "Your website is showing some Japanese text." Or "When I open your site on my phone it goes to a betting page." Or an email from the hosting company saying your account has been suspended for malware. Sometimes you only find out when you search your own business name and see dozens of pages you never created.
A hacked website is stressful, but it is fixable. What you do in the first day makes a real difference to how quickly you recover and how much damage it does to your search rankings and your customers' trust. This guide is for business owners, not developers, and it is in the order you should act.
Step 1: Do not panic, and do not start deleting
The natural reaction is to log in and start removing anything that looks strange. Resist it. Deleting files at random can break the site completely, remove evidence of how the attacker got in, and still leave the real backdoor in place. Many hacked sites get reinfected within days because the visible damage was cleaned and the hidden entry point was not.
Step 2: Confirm what is happening
Spend fifteen minutes collecting facts. They will help whoever fixes it.
- Search Google for `site:yourdomain.com`. Note any pages in foreign languages, pharmacy, betting or adult spam.
- Open the site on a phone using mobile data, not Wi-Fi, and from a private browser window. Some hacks only redirect mobile visitors or first-time visitors, so the site may look normal to you.
- Check Google Search Console if you have it. Look under Security & Manual Actions for a security issue report.
- Check your email for warnings from your hosting company.
- Take screenshots of anything strange.
Step 3: Change passwords
Change, in this order:
- Your hosting control panel password
- WordPress administrator passwords (all admin users)
- FTP/SFTP and database passwords, if you know them or can reset them through hosting
- The email account linked to your hosting and domain
Use long, unique passwords, and turn on two-factor login wherever it is offered. While you are in WordPress, look at the list of users. Any administrator account you do not recognise is a strong sign of compromise; note it down for the person cleaning the site.
Step 4: Take a backup of the hacked site
This sounds odd, but it matters. Before anything is changed, take a full backup of the files and the database as they are now, through your hosting panel or a backup plugin. If the clean-up goes wrong, you can return to this point. It also helps an investigator see what was changed.
If you have an older backup from before the hack, keep it safe too. It may be useful, but restoring it alone usually does not fix the problem, because the hole that let the attacker in is often still there in the old copy.
Step 5: Put up a temporary notice if needed
If the site is redirecting visitors to harmful pages, it is better to take it offline briefly than to send customers somewhere dangerous. Your hosting company can help you put up a simple maintenance page. Put your phone number and WhatsApp on it so customers can still reach you.
Step 6: Get it cleaned properly
A proper clean-up involves more than removing visible spam. Whoever handles it should:
- Scan all files and the database for malicious code, hidden admin users and injected spam
- Replace WordPress core files with clean copies
- Remove or replace infected themes and plugins
- Clean spam content from the database
- Find out how the attacker got in and close that hole
- Update everything, reset security keys, and tighten file permissions
One of the most common entry points is outdated or "nulled" (pirated) themes and plugins. Nulled software is often distributed with backdoors already inside it. If your site uses a premium theme or plugin that was never paid for, assume it is part of the problem.
You can attempt a clean-up yourself if you are technical and patient. For most business owners, it is faster and safer to use a specialist. ArcBig's WordPress malware removal follows exactly these steps.
Step 7: Tell Google the site is clean
If Google flagged your site ("This site may be hacked" or a red "Deceptive site ahead" warning), you need to request a review after cleaning:
- Open Google Search Console and go to the Security Issues report.
- Confirm the issues are fixed.
- Request a review, explaining briefly what you did.
You can also use Search Console's removal tools to speed up removal of spam URLs from search results. Reviews can take a little time; keep monitoring.
Step 8: Watch for a few weeks
After a clean-up, keep an eye on:
- `site:yourdomain.com` searches for new spam pages
- Search Console for new security warnings or a sudden spike in indexed pages
- New administrator users in WordPress
- Unusual traffic or hosting resource warnings
Reinfection in the first few weeks usually means the entry point was not found.
How to stop it happening again
Most hacks on small business sites are not targeted. Automated bots scan millions of websites looking for known weaknesses. Your job is simply not to be an easy target.
- Update WordPress, themes and plugins regularly. Most attacks use weaknesses that already have fixes.
- Delete what you do not use. Old plugins, unused themes and forgotten test copies of the site on the same hosting are common entry points.
- Never use nulled themes or plugins. Buy genuine licences or choose reputable free alternatives.
- Use strong, unique passwords and two-factor login for every administrator.
- Give admin access only to people who need it, and remove access when a developer finishes work.
- Keep automatic backups stored off the server, so you can recover even if the hosting account is affected.
- Use reputable hosting that keeps server software updated.
If keeping WordPress updated is not something you want to think about, either pay for maintenance or consider a lighter platform. Some business sites do not need WordPress at all; a fast static website has very little to attack. See website development and our guide on what a website costs, including maintenance.
A quick checklist to keep
- Do not delete files at random
- Collect evidence: screenshots, Search Console, hosting emails
- Change all passwords and enable two-factor login
- Back up the hacked site before changing anything
- Take the site offline if it harms visitors
- Get a proper clean-up that finds the entry point
- Request a review in Google Search Console
- Monitor for a few weeks
- Update, remove unused plugins and keep off-site backups
Frequently asked questions
How do I know if my WordPress site is hacked?
Common signs are spam pages in Google results for your site, mobile visitors being redirected elsewhere, browser warnings, hosting suspension notices, unknown admin users, or a sudden slowdown.
Will restoring an old backup fix a hacked site?
Sometimes temporarily, but often the weakness that allowed the hack is still in the old backup, so the site is reinfected. Restore only after the entry point has been found and fixed.
How long does it take to clean a hacked WordPress site?
Most clean-ups take one to three working days depending on the size of the site and the depth of the infection. Google's review of a security warning can take additional time.
Will a hack hurt my Google rankings?
It can, especially if Google shows a warning or indexes spam pages on your domain. Cleaning quickly, requesting a review and removing spam URLs limits the damage.
Why was my small business site targeted?
Usually it was not targeted personally. Automated bots scan huge numbers of sites for outdated software and weak passwords. Keeping everything updated makes your site a much harder target.