Hacked Website: Signs and Recovery

A hacked website rarely looks like it does in films. There is no skull on the screen — there are strange links in Google results, unexplained slowness, and emails you never sent. Here is how to spot it and what to do.

Eight signs your site is compromised

• Google results under your domain show pages about pharmaceuticals, gambling or replica watches
• Chrome displays the red "This site may be dangerous" interstitial
• The site slows down for no reason — the attacker''s code is consuming resources
• There is a WordPress administrator account you did not create
• Mobile visitors get redirected elsewhere while desktop looks fine to you
• Your host notifies you the server is sending spam
• Files appear with names like wp-conflg.php, class-wp-cache.php, or random letter strings
• Search Console sends a "hacked content" notice

The first hour, in order

1. Delete nothing yet. Take a full copy of the current state — files and database. It is evidence and it helps establish how the attacker got in.
2. Put the site into maintenance mode, or take it offline if it is serving malware to visitors.
3. Change every password — hosting panel, FTP/SFTP, database, all WordPress admins. All of them, not a selection.
4. Audit users in WordPress and remove any account you do not recognise.
5. Tell your host. With us you raise a ticket and we can pull access logs, which frequently reveal the entry point straight away.

Cleanup

The fastest and most reliable route is restoring a backup from before the compromise. That is why the daily backup included in all our plans is essentially the one thing that turns this from a catastrophe into an inconvenience.

If no clean backup exists:

• Replace WordPress core with fresh files from wordpress.org — delete wp-admin and wp-includes and copy in the new ones
• Overwrite every plugin and the theme with clean copies from official sources
• Go through wp-content/uploads looking for .php files — they do not belong there and are almost always backdoors
• Inspect wp-config.php and .htaccess for added lines you do not recognise
• Search the database tables wp_posts and wp_options for <script and base64_decode
• Scan with Wordfence or Sucuri, then scan again after cleaning

The key point: the backdoor matters more than the damage you can see. Remove the spam pages but leave one hidden file, and everything returns within a week.

Recovering your standing with Google

Once you are confident the site is clean, request a review under "Security issues" in Search Console. Google usually responds within three to seven days, and the Chrome warning clears automatically afterwards. If spam pages were indexed, submit removal requests and return a 410 status for those paths.

How they got in

In practice the causes are almost always the same:

• An outdated plugin — by far the most common. A vulnerability is published, you did not update, and bots scan the entire internet within a day.
• A weak password — the "admin" username plus something brute-forceable.
• An infected computer — FTP credentials stolen from software on your own machine.
• Nulled themes or plugins — pirated premium extensions almost routinely ship with a built-in backdoor.

Preventing a repeat

• Update WordPress, themes and plugins at least weekly
• Two-factor authentication for every administrator
• Limit login attempts and change the default login URL
• Remove plugins you do not use — a deactivated plugin is still code on the server
• Choose hosting with a WAF that filters known attacks before they reach WordPress
• Verify your backups actually exist and can be restored — an untested backup is not a backup

Our servers include a WAF and DDoS protection in the price, plus daily backups with retained previous versions. Details are on the WordPress hosting page.