My WordPress Website Has Been Hacked. Now What?

Has your WordPress website been hacked, infected with malware or started redirecting visitors to suspicious websites? Here’s what you need to do, how to clean an infected WordPress website and when to get professional help.

Discovering that your website has been hacked can be stressful, especially when your business relies on it for enquiries, sales or customer communication.

You might have received a security warning from Google, noticed suspicious activity in your WordPress dashboard or discovered that visitors are being redirected to websites you’ve never heard of.

In some cases, your hosting provider may have suspended your website entirely.

Whatever the situation, the important thing is to act quickly and avoid making changes that could make the problem worse.

The good news is that many hacked WordPress websites can be cleaned and recovered without needing to rebuild the entire website.

But successful recovery involves more than simply removing suspicious files. You also need to identify how the attackers gained access and address the underlying security weakness.

Let’s look at what to do.

How do I know if my WordPress website has been hacked?

Not every WordPress security issue is immediately obvious.

Some attackers make visible changes to a website. Others deliberately hide their activity so they can maintain access for longer.

Common warning signs include:

• Suspicious redirects: Your website sends visitors to gambling, pharmaceutical, cryptocurrency or other unrelated websites.
• Google security warnings: Visitors see a warning that your website may contain malware or deceptive content.
• Unknown administrators: New WordPress administrator accounts appear that nobody in your team created.
• Unexpected website changes: Pages, links, advertisements or unfamiliar content appear without authorisation.
• Spam in Google: Search results display strange pages or descriptions associated with your website.
• Hosting warnings: Your hosting provider identifies malicious files, unusual activity or suspicious outgoing emails.
• Login problems: You can no longer access your WordPress dashboard, or your administrator credentials have changed.

It’s also possible for a compromised website to appear completely normal.

That’s why proper investigation is important, particularly when your hosting provider or security software has identified suspicious activity.

What should I do immediately if my WordPress website is hacked?

If you believe your website has been compromised, these are the first steps to take.

1. Contact your website developer or hosting provider

Your first priority should be understanding the extent of the problem.

Contact your website maintenance provider, developer or hosting company and explain what you’ve noticed.

Provide any relevant information, such as security alerts, unfamiliar URLs, screenshots or the approximate time the problem started.

If malware is actively redirecting customers, distributing harmful content or affecting payment functionality, your hosting provider may need to temporarily restrict access while the incident is investigated.

Avoid randomly deleting files, reinstalling WordPress or making extensive changes before the issue has been assessed.

These actions can destroy useful evidence or make recovery more difficult.

2. Preserve a backup of the affected website

Even if your website is infected, it’s important to preserve a copy of its current state before attempting a clean-up.

A full backup should include both the website files and database.

This allows your developer to investigate suspicious changes and gives you a recovery point if something goes wrong during the process.

Ideally, the backup should be stored securely and kept separate from your live hosting environment.

Remember that an infected backup is not safe to restore directly to a production website without inspection.

3. Secure your accounts

If an attacker has obtained administrator credentials, they may be able to regain access even after malicious files have been removed.

Use a trusted device to secure relevant accounts, including WordPress, hosting, SFTP or SSH, and associated services.

Unknown administrator accounts should be investigated and removed where appropriate.

Your developer may also need to invalidate existing login sessions and rotate security credentials.

Once the website has been cleaned, credentials should be reviewed and rotated again as necessary.

4. Avoid installing multiple security plugins

It’s understandable to want an immediate solution, but installing several security plugins won’t necessarily remove an existing infection.

Tools such as Wordfence can help identify suspicious files and known malware.

However, an infection may also involve compromised database entries, hidden backdoors, malicious scheduled tasks or unauthorised server changes.

A security scan is a useful diagnostic step, not a guarantee that the entire website is clean.

How to clean a hacked WordPress website

The appropriate approach depends on the type of infection and how extensively the website has been compromised.

A proper WordPress malware clean-up typically involves the following stages.

Step 1: Scan the website for malware

The first step is to identify suspicious activity and determine which parts of the website may have been affected.

Security tools such as Wordfence can help identify modified WordPress files, known malicious code and suspicious plugins.

External website scanners can also provide useful information about malicious content visible to visitors.

However, external scanners cannot necessarily identify malware hidden within the server.

For a more complete investigation, your developer may need to examine the website files, database, hosting environment and relevant server logs.

Step 2: Identify and remove infected files

WordPress websites contain thousands of files associated with the core platform, plugins, themes and uploaded content.

Attackers may modify existing files or create new ones that contain malicious code.

The clean-up process can involve comparing files with trusted original versions, replacing compromised WordPress components and removing confirmed malicious files.

Custom themes and plugins require particular care because removing or replacing the wrong files could break the website.

It’s important not to delete unfamiliar PHP files simply because they look suspicious.

Some legitimate plugins and custom functionality contain complex code that can be mistaken for malware.

Step 3: Inspect the WordPress database

Not all malware is stored in website files.

Attackers can also insert malicious content into the WordPress database.

This might include hidden spam links, modified website settings, malicious scripts or unauthorised administrator accounts.

If the database is infected, replacing WordPress files alone may not resolve the problem.

The affected records need to be identified, reviewed and cleaned without damaging legitimate website content or customer information.

Step 4: Remove hidden backdoors

A backdoor is a method attackers use to regain access to a website after the initial compromise.

This is one of the reasons some websites become infected repeatedly.

A website may appear to be working normally after a malware scan, only for malicious code to reappear days later.

A thorough clean-up should investigate possible persistence mechanisms, including suspicious files, scheduled tasks, compromised accounts and abandoned WordPress installations.

The objective is to remove the infection and prevent the same access method from being used again.

Step 5: Update and secure the website

Once the infection has been addressed, the underlying cause needs attention.

This may involve:

• Updating WordPress core, plugins and themes.
• Applying appropriate PHP and server security patches.
• Removing unused or abandoned plugins.
• Securing administrator accounts with multi-factor authentication.
• Reviewing hosting and file permissions.
• Rotating compromised passwords and credentials.
• Configuring suitable security monitoring and firewall protection.

An effective recovery should address the weaknesses that made the compromise possible.

Step 6: Test the website thoroughly

Before returning the website to normal operation, the developer should test its important functionality.

For a company website, this could include contact forms, page layouts, login functionality and third-party integrations.

For a WooCommerce website, additional testing may be needed for checkout processes, customer accounts, payment integrations and order management.

Further malware scans and monitoring should be performed to check for remaining indicators of compromise.

Can I restore a backup instead of cleaning the malware?

Possibly, but restoring a backup isn’t always enough.

If you have a verified clean backup from before the compromise, restoring it may be a suitable recovery option.

However, there are several considerations.

First, you need to establish whether the backup was created before the infection occurred.

Second, restoring an older backup could result in the loss of recent website changes, orders or customer information.

Third, the original security weakness may still exist.

If an outdated plugin allowed an attacker into the website, restoring a backup containing the same vulnerable plugin could leave the website exposed again.

A safe recovery involves checking the backup, addressing the cause of the compromise and ensuring important business information is preserved.

My website is redirecting to spam websites. Can this be fixed?

Yes, malicious redirects are a common symptom of WordPress compromises, and they can often be removed.

Depending on the infection, attackers may have inserted redirect instructions into website files, the database or server configuration.

Some redirects only appear for visitors arriving from Google, using mobile devices or accessing the website from particular locations.

This can make the issue difficult to reproduce.

A developer needs to identify where the redirect originates, remove the malicious instructions and investigate how they were introduced.

Simply changing the website’s URL or clearing a browser cache won’t resolve a server-side malware infection.

Google says my website is dangerous. What should I do?

If Google identifies malware, hacked content or deceptive pages, it may display security warnings to visitors.

This can have a serious impact on customer confidence and website traffic.

Start by reviewing the Security Issues report in Google Search Console.

The report can provide information about suspicious URLs or security problems Google has detected.

After the website has been cleaned and the reported issues have been resolved, you can request a security review through Search Console.

Google will then reassess the affected website. Reviews can take several days or, in some cases, several weeks.

If attackers created spam pages that became indexed, additional SEO clean-up may be required.

Removing the malware is the priority, but restoring normal search visibility can involve further work.

Could a hacked WordPress website expose customer information?

Yes, depending on the nature and extent of the compromise.

A hacked website could potentially expose information stored or processed by the website, including customer contact details, account information or other personal data.

This is particularly important for e-commerce websites and businesses that process personal information.

South African businesses also need to consider their obligations under the Protection of Personal Information Act (POPIA).

Where a security compromise involves personal information and triggers notification obligations, the responsible party must notify the Information Regulator and affected data subjects in accordance with POPIA.

The Information Regulator confirms that reportable security compromises must be notified even when the assessed risk is low.

A WordPress infection does not automatically mean customer information was accessed, but the possibility should be investigated promptly.

For potentially serious data exposure, obtain appropriate technical and legal guidance.

How much does it cost to fix a hacked WordPress website in South Africa?

The cost depends on the complexity of the website and the nature of the infection.

For example, removing a limited infection from a relatively simple website may require considerably less work than recovering a large WooCommerce store with compromised customer accounts, database changes and multiple integrations.

Factors affecting the cost include:

• The number of infected files and database records.
• Whether the website is still accessible.
• The availability of clean backups.
• The complexity of the website and its integrations.
• Whether the hosting environment has also been compromised.
• The work required to investigate and address the original security weakness.

For this reason, a technical assessment is usually needed before an accurate quotation can be provided.

How can I prevent my WordPress website from being hacked again?

While no website can be guaranteed to be completely secure, good maintenance and security practices can significantly reduce the risk of compromise.

We recommend keeping your WordPress installation and plugins updated, regularly reviewing administrator access and maintaining reliable website backups.

It’s also worth implementing additional protection, such as Cloudflare, appropriate firewall rules, multi-factor authentication and ongoing malware monitoring.

Importantly, your hosting environment should be maintained alongside WordPress itself.

Outdated PHP installations, insecure server configurations and abandoned software can create risks even when your WordPress dashboard appears up to date.

Website security requires ongoing attention rather than a once-off clean-up.

Frequently asked questions

Can a hacked WordPress website be repaired?

In many cases, yes. A compromised website can often be cleaned and recovered by identifying malicious files, inspecting the database, securing accounts and resolving the underlying security weakness. The recovery options depend on the extent of the compromise.

Does Wordfence automatically remove all malware?

No. Wordfence can identify and help remove many common infections, but certain issues may require manual investigation and remediation. Hidden backdoors, database infections and server-level compromises can require additional work.

Will reinstalling WordPress remove the hack?

Not necessarily. Reinstalling WordPress may replace some compromised core files, but malicious code can remain in themes, plugins, uploads, the database or elsewhere on the server.

Can a hacked WordPress website affect SEO?

Yes. Attackers may create spam pages, insert unwanted links or redirect visitors. Google can also display warnings for unsafe websites. Cleaning the infection and resolving search-related security issues are important steps towards recovery.

How long does WordPress malware removal take?

It depends on the severity of the infection, the website’s complexity and the access available to the developer. An investigation is normally required before the scope and likely recovery time can be established.

Should I rebuild my hacked WordPress website?

Not always. Many infections can be resolved without a complete rebuild. In more serious cases, particularly where the original installation can no longer be trusted, rebuilding from verified clean components may be the safer option.

WordPress website hacked? Digital Fold can help.

If your WordPress website has been compromised, you don’t have to work through the recovery process alone.

At Digital Fold, we’re a Cape Town-based web development agency working with WordPress websites, website maintenance and technical support.

We can assist with investigating suspicious website activity, identifying malware and security vulnerabilities, coordinating recovery work with your hosting provider and implementing appropriate security improvements.

Depending on the issue, this may include:

• WordPress malware investigation and removal.
• Infected website file and database clean-up.
• Recovery from suspicious redirects and unwanted website changes.
• WordPress, plugin and PHP security updates.
• Cloudflare and website security configuration.
• Google Search Console security issue investigation.
• Ongoing website maintenance and monitoring.

Our focus is not simply on getting your website working again. It’s on understanding what went wrong and helping reduce the likelihood of the same problem happening again.