Spotting a Hacked WordPress Before Google Does
In most cases, owners find out about an infection from someone else. These signals help you spot it sooner.
The Tell-Tale Symptoms
A hack rarely shows up as a defaced homepage. Modern attacks aim for discretion: the longer the infection stays invisible, the more profitable it is. Therefore, the signs to watch for are indirect. Your site’s Google results show titles in Japanese, Russian, or words like “casino,” “viagra,” or “crypto,” even though your pages haven’t changed. Visitors report being redirected to betting or dating sites, sometimes only from a phone and never from your computer. Search Console sends a “Security issues detected” message. Your host cuts off email sending because the server is blasting spam. An antivirus blocks your page. In wp-admin, an administrator you never created appears in the user list, or an unknown plugin installed itself. The site becomes slow for no reason, or the disk quota explodes due to thousands of HTML files generated in a subfolder. Each of these signs, taken alone, might have another explanation; two of them together are enough to consider the site a hacked WordPress and move to verification without delay. The worst-case scenario is when no one is looking: the infection lives for months, Google de-indexes the site page by page, and the problem is discovered only after revenue has already dropped.
Hacked WordPress or False Positive: Verify in Ten Minutes
Before touching anything, confirm the diagnosis from the outside. Type site:votredomaine.fr into Google and browse the results: pages you never wrote indicate an SEO injection. Open your site from a phone in incognito mode, coming from a Google result rather than typing the address, as many redirects only trigger in this case. Check Search Console, under the Security & Manual Actions tab. Run the address through an external scanner like Sucuri SiteCheck or VirusTotal. On the server side, look at the file modification dates: a wp-config.php, a index.php, or a .htaccess recently modified without your intervention is almost certainly compromised. List the admin users and active plugins, and compare them with what you know. Note everything in a document: dates, files, symptoms, screenshots. This record will serve three purposes: proving the incident to the host, requesting a review from Google after cleaning, and understanding the entry point to close it. At this stage, do not delete anything, do not run updates, and do not change themes: you risk erasing traces useful for the cleanup.
The Six Steps to Repair a Hacked WordPress
Order matters. Cleaning before blocking access means cleaning twice.
Steps 1 and 2: Isolate, Then Back Up the Infected State
The first action is to cut off access for attackers while you work. Activate a maintenance mode at the server level, not via a WordPress plugin that could itself be compromised. Immediately change all passwords: WordPress admin accounts, FTP or SFTP, database, hosting panel, and the email address linked to the admin account. If the host offers a temporary account lock, use it. Second action, counter-intuitively: back up the site as it is, infected. Files and database, in a dated archive, kept off the server. This copy is not meant to be restored; it allows you to go back if the cleaning breaks something and to compare files before and after. Then retrieve previous backups: those from the host, those from your backup plugin, and identify the last version you are sure was clean. Be careful, on a hacked WordPress that has been compromised for several weeks, most automatic backups already contain the infection. A clean three-month-old backup is better than a contaminated one from yesterday, provided you can re-inject the content published in the meantime.
Step 3: Clean Files and the Database
The most reliable cleaning isn’t hunting for suspicious files; it’s replacement. Download a fresh version of WordPress from wordpress.org and completely replace the wp-admin and wp-includes folders, as well as all files in the root except wp-config.php and .htaccess, which you should review line by line. Do the same for every plugin and every theme: delete the folder, reinstall from the official source. Anything that doesn’t have an official source, or that you no longer use, goes away. That leaves wp-content/uploads, which should contain no PHP files: search for them and delete them, first checking that it’s not a legitimate cache file from a plugin. The following table summarizes the locations where infections most often hide.
| Location | What is found there | Action |
|---|---|---|
wp-content/uploads/*.php |
Backdoors dropped via an upload vulnerability | Delete, then disable PHP in this folder |
wp-content/mu-plugins |
Must-use plugins, invisible in the standard list | Check every file, keep only what is known |
.htaccess and index.php |
Conditional redirects to spam sites | Replace with the original version |
Table wp_options |
Scripts injected into theme options or widgets | Search for <script, eval(, base64 |
Table wp_posts |
Thousands of spam posts, iframes in content | Bulk delete by date and author |
Table wp_users |
Administrators created by the attacker | Delete, reassign content |
Steps 4 to 6: Close the Door, Verify, Request Review
A hacked WordPress cleaned without fixing the cause will be re-infected within 48 hours because the bot that found it will return. Identify the entry point using server access logs around the date of the first suspicious file: a POST request to a plugin file just before the backdoor appeared points to the culprit. Update WordPress, all plugins, and the theme. Delete unknown accounts. Regenerate security keys in wp-config.php to invalidate all open sessions. Then, verify: run the external scanner again, check the site:, test the redirection from a phone, and monitor modified files for a week. If Google flagged the site, request a review through Search Console, describing what was done; the removal of the warning takes anywhere from a few hours to a few days. If the host suspended the account, send them the cleanup report. Finally, notify your visitors if personal data might have been leaked: in Europe, a notification to the CNIL may be mandatory within 72 hours. This final checklist prevents the most common oversight—passwords reused elsewhere.
- All passwords changed, including the database
- Security keys regenerated, sessions invalidated
- External scanner clean, Google results without unknown pages
- Review requested, host informed
- File monitoring active for the next 30 days
Why sites get hacked and how to avoid it
Understanding the cause is the only way to avoid reliving the same week in six months.
Hacked WordPress: The real causes, backed by data
No one is targeting your site specifically. Attacks are carried out by programs that scan millions of addresses, spot a vulnerable plugin version, exploit the flaw in seconds, and then sell the access. Annual reports from cleanup companies converge: more than half of infections happen through an outdated plugin or theme, about a fifth through a weak or stolen password from a data leak, a tenth through shared hosting where an abandoned site contaminates its neighbors, and the rest through paid themes downloaded from pirate sites, delivered with a built-in backdoor. Vulnerabilities in the WordPress core itself are rare and fixed within hours. In other words, a hacked WordPress is almost always a site that hadn’t been updated for months, or where an account used the same password as a service hacked elsewhere. The good news is that these two causes can be fixed without technical skills: a weekly update and a password manager take the site off the list of easy targets. Bots don’t persist; they move on to the next one.
The Routine That Truly Protects
Good protection comes from a few regular habits rather than a heavy security plugin. Here is the minimum routine for a business site.
- Weekly updates: core, plugins, theme. Enable automatic updates for everything non-critical, and test the others on a staging copy.
- Remove the unnecessary: every deactivated plugin still present is a potential door.
- Clean accounts: one administrator per person, unique passwords, two-factor authentication, no “admin” account.
- Basic hardening: file editing disabled in wp-admin, PHP forbidden in
uploads, XML-RPC disabled if not used. - Tested backups: daily, kept off-site, and restored once a quarter to verify they work.
- Monitoring: alerts for any new or modified PHP file, any new administrator, any change to
wp-config.php.
The last point makes all the difference between a hacked WordPress discovered in an hour and an infection discovered by Google three months later. It’s also the one that almost no one implements because it requires a tool that looks at the site every day.
Hacked WordPress: When to Call for Help
The cleanup described above is within reach of someone comfortable with an FTP client and phpMyAdmin for a simple site. It stops being so in several situations: a WooCommerce store with orders to preserve, a multilingual site with hundreds of pages, an infection that returns after every cleanup, or hosting where you don’t have access to logs. In these cases, the cost of professional intervention, generally between 150 and 600 euros depending on the site size, is less than the cost of a week of trial and error and a site being offline. Before signing, ask what is included: identification of the cause, file and database cleanup, fixing the vulnerability, Google review request, and a guarantee in case of re-infection within the month. Beware of offers that just run a scanner and delete what it flags; a scanner doesn’t see added admin accounts or modified options. If you manage multiple sites, the real gain isn’t in one-off interventions but in continuous monitoring: a tool that compares files daily to a known fingerprint, lists unexpected administrators, and pushes updates across the entire fleet transforms an emergency into a routine notification.
Frequently Asked Questions
Should I restore a backup or clean the site? Restoring is faster if you have a definitely clean backup and little content published since. Otherwise, cleaning by replacing files remains the most reliable method, and the cause must be fixed in both cases.
Would a security plugin have prevented the hack? It probably would have blocked login attempts, but not the exploitation of an obsolete plugin. Updates protect more than a firewall.
How long does a full cleanup take? From two hours for a brochure site to two days for a store with a contaminated database, excluding Google’s review time.
Will Google penalize the site long-term? No, if the cleanup is thorough and a review is requested. Rankings generally return within a few weeks.
