My WordPress site has been hacked. What should I do first?

Do not start deleting files in a panic. First take a full copy of the site and database as they are, because you may need it to work out what happened. Then change every password connected to the site: WordPress admin accounts, hosting, database, FTP or file manager, and the email address used for password resets. Check the list of WordPress users for accounts you do not recognise and remove them. If you have a backup from before the problem started, and you are confident it is clean, restoring it is often the fastest route.

If there is no clean backup, the infection must be removed by hand. That means comparing WordPress core files against fresh copies, reinstalling plugins and themes from official sources, searching for injected code in files and the database, and removing anything suspicious. Pirated or nulled themes and plugins, which are common on cheaply built sites, often contain hidden backdoors and should be replaced entirely. Scanner plugins help but are not proof of a clean site; attackers frequently leave several ways back in.

After cleanup, find and fix the original entry point, or the site will be hacked again. Update everything, delete unused plugins and themes, turn on two-factor login, and set up off-site backups. If Google shows a warning in search results or Chrome, request a review in Search Console once the site is clean. If customer data might have been exposed, consider what you owe those customers. Our maintenance service handles hacked-site recovery for existing sites after an assessment, and sites under the Business bundle are backed up off-site and monitored as standard.