A hacked WordPress site is stressful, but it is rarely fatal. Over the years I have cleaned dozens of them for clients through Fiverr and directly, and the process is almost always the same. Here is the checklist I use, in order. Follow it calmly and you will keep your content, your rankings and your sanity.

Signs your site is compromised

  • Visitors get redirected to gambling, pharmacy or adult sites (often only on mobile, or only from Google)
  • Google shows "This site may be hacked" or "Deceptive site ahead"
  • New administrator users you did not create
  • Files with random names in wp-content or the root, or modified index.php and .htaccess
  • Sudden spam pages in your Search Console coverage report
  • Hosting provider suspends the account for outgoing spam

Step 1: Contain

Put the site into maintenance mode or block public access at the server level. Change every password immediately: WordPress admins, hosting control panel, FTP, database, and the email account tied to the site. If you have SSH access, revoke unknown keys. This stops the attacker from re-entering while you work.

Step 2: Take a forensic copy

Before cleaning anything, download a full copy of files and the database. It feels counter-intuitive to save infected files, but you will need them to understand how the attacker got in. Store the copy away from the live server.

Step 3: Find the entry point

Read the logs. Apache or Nginx access logs show POST requests to unusual PHP files, which is how most backdoors are used. Check the modification times of files — malware is usually newer than the last legitimate update. Common entry points are outdated plugins, nulled themes bought outside the official repository, weak passwords, and abandoned staging sites on the same account.

Step 4: Clean, or rebuild from clean sources

Rather than hunting each infected file, I prefer to rebuild: fresh WordPress core files, fresh copies of every plugin and theme from official sources, then bring the uploads folder across after scanning it for PHP files hiding inside image directories. The database gets checked for injected scripts in posts, options and user tables. This method is faster and more reliable than hand-cleaning.

Step 5: Harden

  • Update everything and delete unused plugins and themes
  • Correct file permissions (directories 755, files 644, wp-config.php 600)
  • Disable file editing from the dashboard and block PHP execution in the uploads folder
  • Add two-factor authentication and limit login attempts
  • Use a web application firewall — Cloudflare works well for Sri Lankan sites too
  • Set up automated off-site backups and test a restore

Step 6: Recover your reputation

Request a review in Google Search Console under Security Issues once the site is clean. Check that Google Safe Browsing no longer flags the domain and that your email is not blacklisted. Rankings usually recover within days once the warning is lifted.

When to call for help

If the site is your business and you are not comfortable reading server logs, get an experienced administrator to do steps 3 to 5. I offer this as a fixed-price emergency website fix, usually starting within hours — and I never publish or discuss client incidents.