Quick answer
Don’t delete anything. Record what you’re seeing, change every password from a clean device, take the site offline if visitors are at risk, and tell your host. Then have the way in found and closed — restoring a backup alone doesn’t fix a hack.
- Don’t delete files at random — it can destroy the evidence of how the attacker got in.
- Change every password from a clean device: hosting, WordPress, FTP, database and the recovery email.
- Take the site offline if it’s harming visitors, and tell your host.
- Restoring a backup isn’t a fix while the way in is still open.
In this article
Maybe Google is showing “This site may be hacked” under your listing. Maybe a customer told you your site sent them somewhere strange. Either way, the first hour matters more than the next week. Here’s the order we’d work in.
1. Don’t start deleting things
The instinct is to log in and rip out anything that looks wrong. Don’t. Deleting files at random can break the site and destroy the evidence of how the attacker got in — which is the one thing you need to know to stop it happening again.
2. Write down what you’re seeing
Take screenshots of the warning, the strange redirect, the pages you didn’t write. Note the time, and whether it happens on a phone, on a computer, or only when you arrive from Google. Many hacks hide from the site owner and only show to visitors, so these details save a lot of time later.
3. Change your passwords — from a clean device
Change the passwords for your hosting account, your WordPress admin users, any FTP or database access, and the email address those accounts reset to. Do it from a device you trust. If a password was stolen from your own computer, changing it on that same computer may not help.
4. Protect your visitors
If the site is redirecting people to scams or serving malware, it’s better offline than live. Ask your host to put up a maintenance page until it’s clean. A few hours down costs less than your customers’ trust.
5. Tell your host
Your hosting company may already know — some suspend accounts when they find malicious files. Ask what they’ve seen. If other sites share your hosting account, they may be infected too.
6. Don’t just restore a backup
Restoring last month’s backup feels like a fix. But if the attacker came in through an outdated plugin or a stolen password, that hole is in the backup too — and so may be the malware. Without closing it, you’re likely to be hacked again.
What a real cleanup involves
A proper cleanup does four things. It finds every piece of malicious code — in the files, the database, the themes, the plugins and the uploads. It removes it. It finds the way in. And it closes it. The third step is the one most cleanups skip, and it’s why so many sites come back infected. After that comes the boring part that keeps it fixed: updates, off-site backups that actually restore, and monitoring.
Questions
What should I do first if my website is hacked?
Don’t delete anything, and write down what you’re seeing. Then change your passwords from a clean device and take the site offline if it’s sending visitors somewhere harmful.
Can I just restore a backup after a hack?
Only once the way in has been found and closed. A backup restores the same outdated plugin or stolen password the attacker used, so the site is likely to be hacked again.
How do I know if my website has been hacked?
Common signs are Google showing “This site may be hacked,” visitors being redirected — often only on mobile or from Google — pages you didn’t write appearing in search, or your host suspending the account.
