My WordPress Website Has Been Hacked: An Emergency Recovery Guide for UK Businesses

If you’ve just discovered your WordPress site has been hacked, these are the eight steps we use to investigate it, clean it up and get it safely back online, including the parts that need technical access you might not currently have.

Our security team regularly recovers hacked WordPress sites for UK SMEs. This is broadly the process we follow.

What to do before you touch anything

Resist the urge to start deleting files or reinstalling WordPress before you know what happened. Overwriting evidence early makes the entry point much harder to find later. Do these four things first:

1. Confirm the site really has been compromised, rather than misbehaving because of a display glitch or a DNS issue.
2. Take a full snapshot of the current state exactly as it is.
3. Write down every symptom you can see: defaced pages, unexpected redirects, admin users you don’t recognise, spam pages appearing in search results.
4. If anyone on your team has admin access, get them to change their WordPress and hosting passwords straight away.

Step 1: Confirm you have actually been hacked

Not every unusual behaviour on a WordPress site is a compromise. Before starting a full recovery, make sure you’re actually dealing with one. The clearest signs are:

• A search for “site:yourdomain.com” on Google returning pages you didn’t create, often pharmaceutical, gambling or spam pages.
• The homepage redirecting to an unfamiliar URL when opened in a private browsing window. Attackers commonly exclude logged-in users from the redirect and only trigger it for anonymous visitors.
• A security notice in Google Search Console.
• An admin user in Users → All Users that nobody in the business created.
• An email from your host reporting malware detected on the account.

None of the above? This is probably a plugin conflict or a caching issue. See our guide to common WordPress errors instead.

Step 2: Take the site offline properly

Take the site offline in a way that preserves your search rankings, once you’ve confirmed the compromise is genuine. Use a maintenance page that returns a 503 status. That’s the correct response for a site that’s temporarily unavailable. Avoid leaving the site returning 500 errors while you work on it, particularly for any length of time, since that starts costing you rankings.

No technical access to configure this cleanly? A temporary maintenance-mode plugin will do the job, and most managed hosting providers can put a coming-soon page in place at server level within a few minutes of being asked. The compromised site shouldn’t stay publicly accessible while you recover; every hour adds reputational damage, and potentially ICO exposure if user data is at risk.

Step 3: Preserve evidence and take a forensic backup

Take a full copy of the site before you clean anything: the WordPress files, the database, and recent server logs. Keep it somewhere separate and don’t overwrite it. You’ll need it later to work out how the attacker got in.

Step 4: Identify the entry point

Check these before anything else:

• Recently modified files. On a Unix host, list them with find ./ -mtime -30 -type f. Unexpected changes inside wp-includes or wp-admin are worth investigating, particularly if they don’t line up with a recent WordPress core update.
• Suspicious PHP files inside wp-content/uploads, a directory where PHP execution should be blocked entirely.
• New admin users, particularly with generic-looking email addresses.
• Access log entries showing POST requests to wp-login.php, xmlrpc.php or wp-admin/admin-ajax.php from a single IP in unusual patterns.
• Any plugin or theme that hasn’t seen an update in a while, especially one with known vulnerabilities listed against it.

Don’t skip this just because everyone wants the site back online. If you remove the malware without finding the weakness that let it in, there’s a good chance you’ll be doing the same job again. Outdated plugins are behind a lot of the cases we deal with, but we’ve also seen reused admin passwords, accounts without MFA and exposed XML-RPC exploited.

Step 5: Clean the malware

Remove what the attacker left behind once you know how they got in. Start with any rogue admin accounts and files you know were added during the compromise. For WordPress core, replace wp-includes and wp-admin with clean copies from a fresh WordPress.org download. Then move on to plugins and themes: reinstall them from the repository rather than updating them. Check the database, wp_options, wp_posts and wp_users for anything odd, and reset the salts in wp-config.php.

Signature scanners will catch most of what’s there, but the rest needs someone to go through every modified file by hand. If you’re not sure everything’s been found, get help before bringing the site back online.

Step 6: Reset every credential

Assume the attacker may have seen any password or secret the site had access to. That means resetting WordPress logins for every user, the database password in wp-config.php and the hosting panel, FTP/SFTP, and the hosting account itself. Rotate any API keys stored in plugins for payment gateways or analytics, and any secrets in a .env file.

MFA should go on every admin account next, everywhere it’s supported. A plugin or host that makes that awkward is worth replacing.

Step 7: Restore, test and harden

Bring the site back online in stages. Restore access to your team first, using either an IP restriction or a maintenance-mode bypass, and use that window to make sure orders can be placed, forms submitted, and people can log in. Remove the maintenance page when the site’s behaving normally, and keep an eye on access logs for the next few days for repeat attempts from the original attacker’s IP range.

Harden whatever let the attack succeed while you’re doing this. If the entry point was an unpatched plugin, subscribe to a vulnerability alerting service and set a written policy for how quickly security updates get applied. See our WordPress security checklist for the seven things every UK business should have in place as a baseline.

Step 8: Notify anyone who needs to know

If the compromised site processed personal data, whether customers have accounts, submit contact forms, or place orders, you may have an ICO notification obligation. Under UK GDPR, a business has 72 hours from becoming aware of a breach to report it if there’s a risk to individuals. If you’re not sure whether that applies, get advice from a data protection specialist.

You may also need to notify Google by submitting the site to Search Console for a security review, your payment processors if card data may have been exposed, and any customers whose data was directly accessed.

Can you clean a hacked WordPress site yourself?

You can do this yourself if you’re comfortable with server access, SFTP or SSH, and can read PHP well enough to spot an obvious backdoor. If that’s not you, and especially if the site takes payments or holds customer data, get someone in instead.

One example from our case work: a UK client’s site had been cleaned three times, but spam pages kept coming back. We eventually traced it to a plugin from 2019 with a known unauthenticated file-upload vulnerability. Once we found it, cleanup and hardening didn’t take long. Full detail in the case study. Related: why unmaintained sites end up like this.

If this is happening to you right now, get in touch. We handle emergency WordPress recovery for UK SMEs end-to-end, including the ICO side if you need it, with a UK-based team usually starting within two hours during business hours. Call 01452 881 471, or reach us through our website maintenance service page.

---