What To Do If Your Website Has Been Hacked
Most hacks aren't obvious. Here's how to actually confirm it, clean it up properly, and close the door that let it happen.
Written by Tom George · How we research hosts
The Signs Are Rarely This Obvious
A defaced homepage is the hack you notice. A casino spam link buried in a footer widget, a redirect that only fires for visitors coming from Google, or a plugin quietly emailing your customer list somewhere — those are the hacks that sit undetected for weeks, because nothing on the surface looks wrong.
Most compromised WordPress sites today aren't broken into through some dramatic exploit. They're found by automated scanners that work through thousands of sites an hour, looking for one outdated plugin or one weak password. Once in, the goal usually isn't to vandalize the site — it's to use it quietly, for spam, malware distribution, or SEO manipulation, for as long as possible without being noticed.
This guide covers how to actually confirm a hack (not just guess), how to clean one up properly, and — the part that matters more — how to stop it from happening again.
Sucuri is the pick if your site is already compromised and you need it cleaned fast: unlimited malware removal on every plan, a guaranteed cleanup SLA, and ongoing monitoring afterward so it stays clean.
Kinsta or Rocket.net are the picks for prevention: both run web-application firewalls and malware scanning at the infrastructure level, so most of what Sucuri cleans up never reaches your site in the first place. (See our full breakdown in WordPress Hosting With AI Security.)
These solve different problems — cleanup versus prevention — and most site owners eventually need both at different points, not one instead of the other.
How Sites Actually Get Hacked
For the average WordPress or CMS site, four things drive most compromises today. None of them are especially exotic.
Outdated Plugins and Themes
This is still, by a wide margin, the most common entry point for WordPress sites specifically. A plugin with a known, unpatched vulnerability is a public target — once a flaw is disclosed, automated scanners start probing every site running that plugin within hours, not days.
Keeping plugins and themes updated, and removing ones you no longer use, closes more doors than any other single habit.
Weak or Reused Passwords
Credential stuffing — trying passwords leaked from other, unrelated data breaches against your login — is fully automated and cheap for attackers to run at scale. A weak or reused admin password is often the whole story behind a hack that otherwise looks sophisticated.
SQL Injection
Still relevant, especially on sites with custom forms or older code. An attacker enters malicious code into a form field or URL parameter to manipulate your database directly — potentially extracting customer data or planting malicious content.
Modern web application firewalls catch most of these attempts before they reach your database, which is the main reason WAF-level protection matters more than plugin-level protection.
Malicious Redirects and SEO Spam Injection
Increasingly common because it's profitable and quiet. Rather than defacing your site, attackers inject hidden links or scripts that redirect a fraction of your traffic (often just visitors coming from search engines) to spam or scam pages, while your site looks completely normal to you.
This is exactly the kind of hack that sits undetected until Google flags it in Search Console or a visitor complains.
How to Confirm You've Actually Been Hacked
Don't guess — check these four places before assuming the worst, or before assuming you're fine.
1. Check Google Search Console's Security Issues Report
This is the fastest, most authoritative check, and it's free if you already have Search Console set up. Open the Security Issues report — if Google's own crawlers have flagged anything on your site, it'll show here under one of three categories: hacked content, malware/unwanted software, or social engineering.
A clean report doesn't guarantee you're safe (Google doesn't catch everything instantly), but a flagged report is a definitive yes.
2. Run a Free Scan With Sucuri SiteCheck
Sucuri's free scanner checks your site from the outside — the same way an attacker or a search engine would see it — for malware, blocklist status, and known infection signatures, without needing access to your hosting account. It's a good first pass before you go digging through files manually.
3. Look for What Doesn't Belong
- New admin user accounts you didn't create
- Files modified recently that you didn't touch — especially in
wp-content,.htaccess, or core WordPress files - Unfamiliar scheduled tasks (cron jobs) in your hosting control panel
- A sudden spike in outbound traffic or server resource usage with no matching increase in real visitors
- Old content suddenly ranking for or redirecting to unrelated topics (a classic sign of SEO spam injection)
4. Ask What Your Visitors Are Seeing, Not Just What You See
Some hacks are conditional — they only trigger for visitors coming from Google, or only on mobile, or only for users in certain countries — specifically so the site owner doesn't notice.
If a customer or visitor reports something odd that you can't reproduce, don't dismiss it; check from an incognito browser, a different device, or a tool like Sucuri SiteCheck that crawls from the outside.
How to Clean a Hacked Site
Work through these five steps in order. Skipping one — usually the password reset or the cron-job check — is what puts most sites back here within a week.
Restore From a Clean Backup, If You Have One
The fastest, most reliable fix is reverting to the last backup taken before the infection. This only works if you're taking regular backups in the first place — if you're not, set that up today, hack or no hack.
Clean Infected Files Manually, If You Don't
Download your site files via FTP/SFTP, identify and remove the injected or modified code, then re-upload the clean versions. Re-scan afterward to confirm nothing was missed — a partial cleanup that leaves one backdoor file behind means you'll be back here in a week.
Change Every Password, Not Just WordPress
Admin and user passwords, FTP/SFTP, SSH, your hosting account, your database — all of them. If an attacker had access once, assume they captured whatever credentials were reachable.
Check for Scheduled Tasks (Cron Jobs)
Some malware installs its own scheduled task to quietly reinfect the site after cleanup. Check your hosting control panel's cron job list for anything you don't recognize and remove it — otherwise you'll clean the site and watch it get reinfected within days.
Request a Review Once You're Actually Clean
If Google flagged your site in the Security Issues report, fix everything first, then submit a reconsideration request through Search Console. Don't submit it while anything is still unresolved — a rejected review takes longer than doing it right the first time.
How to Prevent It From Happening Again
Two layers, both real and complementary — not a choice between one or the other.
Harden WordPress Itself
A plugin like Solid Security (formerly iThemes Security) handles the basics: enforcing strong passwords, limiting login attempts, two-factor authentication, and file-change monitoring that alerts you if something's been modified. This is the plugin-level layer — useful, but it only acts after a request has already reached WordPress.
Handle It at the Host or Firewall Level
This is the layer that stops most of it before it reaches your site at all. A web application firewall filters malicious requests — including SQL injection attempts and known exploit patterns — before they ever touch your database or your files.
Hosts like Kinsta and Rocket.net build this in at the infrastructure level rather than leaving it entirely to plugins; see our full breakdown of what to actually look for in AI-driven WordPress hosting security if you're evaluating hosts on this specifically.
The practical takeaway: plugin-level hardening and host-level filtering aren't a choice between one or the other — they cover different points in the request path, and a well-protected site typically has both.
The Basics That Still Matter Most
- Keep every plugin and theme updated — remove any you're not actively using
- Use strong, unique passwords, especially for admin accounts, and enable 2FA wherever it's offered
- Take regular, automated backups stored somewhere separate from your hosting account
- Only install plugins and themes from reputable sources — abandoned or pirated ("nulled") plugins are a common infection vector
Sucuri vs. Host-Level Security — Which Do You Need?
These do different jobs. One cleans up an active infection; the other tries to stop the infection reaching your site at all.
| Option | Best for | What it actually does | Price |
|---|---|---|---|
| Sucuri | You're already hacked, or want dedicated ongoing malware monitoring | Unlimited malware/hack cleanup with an SLA (30hrs on the entry plan), blocklist monitoring and removal, a cloud WAF | From $199.99/yr |
| Kinsta / Rocket.net | Prevention — stopping the hack before it starts | Infrastructure-level WAF, malware scanning, and DDoS protection bundled into hosting itself | Kinsta from $35/mo, Rocket.net from $30/mo |
If you're cleaning up an active infection, Sucuri's unlimited-cleanup guarantee is the direct fix. If you're choosing a host for a new or rebuilt site, prevention at the infrastructure level does more long-term work than any plugin can.
Frequently Asked Questions
Can a hacked website be fixed, or do I need to start over?
Almost always fixable without starting over. A clean backup makes this fast; without one, manual file cleaning plus a full password reset works for the large majority of cases. Starting over is rarely necessary unless the hosting account itself was compromised at the account level.
Will Google penalize my site for being hacked?
Google doesn't penalize a site for being a hacking victim, but it will flag it in the Security Issues report and may show warnings to visitors or de-rank affected pages in search results until it's fixed and a reconsideration request is submitted. The distinction matters: it's a protective flag for users, not a punishment — but it still costs you traffic until it's resolved.
How long does cleaning a hacked site take?
With a clean backup, often under an hour. Manual cleanup without a backup typically takes a few hours to a full day depending on how deeply the infection spread. Sucuri's paid plans carry an SLA for their own cleanup work (30 hours on the entry plan, faster on higher tiers).
Can my hosting provider prevent hacks from happening?
Partially, and increasingly so. Hosts with infrastructure-level firewalls and malware scanning stop a large share of attacks before they reach your site — but no host can protect against a weak admin password or a plugin vulnerability you haven't patched. Prevention is shared between the host and the site owner, not owned entirely by either.
Do I need both a security plugin and Sucuri?
Not necessarily both, but understand what each does. A hardening plugin like Solid Security tightens WordPress itself; Sucuri (or host-level WAF protection) filters malicious traffic before it reaches WordPress at all. If your host already includes strong WAF/malware scanning, a lightweight hardening plugin may be all you need on top of it.
The Bottom Line
If your site's compromised right now: confirm it properly (Search Console's Security Issues report + a Sucuri SiteCheck scan), restore from backup if you have one, and change every credential if you don't.
If it's not compromised: the highest-leverage thing you can do today is confirm your plugins are current and your admin password isn't reused anywhere else. Everything else — the firewall, the monitoring, the hosting choice — matters, but those two habits alone prevent the majority of the hacks this article covers.