Signs your WordPress site has been hacked
Hacked WordPress sites are common, and small business sites are targeted precisely because they are often not updated. Common signs include:
- Google search results for your site showing pages in Japanese, pharmacy spam or betting links you never created.
- Visitors on mobile being redirected to another website, while the site looks normal to you.
- A "Deceptive site ahead" or "This site may be hacked" warning in Chrome or in search results.
- Your hosting company suspending the account for malware or for sending spam email.
- New administrator users you did not create, or files and folders you do not recognise.
- The site becoming suddenly slow, or your Google Search Console showing a security issue.
If you see any of these, act quickly. The longer an infection stays, the more damage it can do to your search rankings and customers' trust.
What our clean-up includes
- Backup first. We take a full backup of the infected site so nothing is lost, even by accident.
- Scan and investigate. We scan files and the database, compare core files with clean WordPress copies, and look for injected code, backdoors, spam pages and malicious redirects.
- Clean. We remove malicious code and files, replace infected core files, clean the database of injected spam, and remove unknown administrator accounts.
- Close the hole. We look for how the attacker got in: outdated or nulled (pirated) plugins and themes, weak passwords, or old abandoned installations on the same hosting. Fixing the entry point is what stops reinfection.
- Harden. We update WordPress, themes and plugins, remove what is not needed, reset passwords and keys, set safer file permissions and add sensible security settings.
- Clear warnings. We help you request a review in Google Search Console once the site is clean, and remove spam URLs from search where possible.
Why "nulled" plugins are the usual culprit
Many hacked sites we see were running "nulled" premium themes or plugins downloaded free from unofficial sites. These often come with hidden backdoors already built in. Paying for genuine licences, or choosing reputable free alternatives, is one of the cheapest security measures there is.
After the clean-up
A cleaned site still needs care. We recommend automatic backups stored off the server, regular updates, strong unique passwords with two-factor login for administrators, and removing unused plugins and old copies of the site. We can handle this as ongoing maintenance, or rebuild the site on a lighter platform. See website development.
Frequently asked questions
How long does a malware clean-up take?
Most WordPress clean-ups are completed within one to three working days, depending on the size of the site and how deep the infection goes. Google's review of a security warning can take additional time after we submit it.
Will I lose my content?
No. We take a full backup before touching anything and clean the existing site rather than starting over, unless you decide a rebuild makes more sense.
Can you guarantee the site will never be hacked again?
No honest provider can. We remove the infection, close the entry point and harden the site, which greatly reduces the risk. Keeping software updated afterwards is what keeps it low.
My hosting company says the site is infected. What should I do?
Do not delete files at random. Change your hosting and WordPress passwords, make a backup, and contact us with your hosting details so we can investigate.
Do you work on sites that are not WordPress?
Our clean-up service is focused on WordPress. For other platforms, contact us and we will tell you honestly whether we can help.