Blog
WordPress Site Hacked? What to Do in the Next Hour (and How to Stop It Happening Again)
Red warning screen, spam pages under your name, or a suspension email from your host? Here's exactly what to do in the next hour, and how to stop it happening again.
A customer messages you a screenshot: a big red screen saying "Deceptive site ahead" where your website should be. Or you Google your own business and find pages for cheap watches and pills under your name. Or your host has emailed to say your site is suspended.
It's a horrible feeling. But take a breath. Hacked WordPress sites are very common, and very fixable. Below is what to do in the next hour and how to get the site clean.
Once it's clean, you have two ways forward: keep WordPress and keep up with it, or move to a platform where there's nothing to patch, which is why we built Mondovo. Deal with the hack first. That choice can wait.
Signs your WordPress site has been hacked
You may have noticed one or more of these:
- A red "Deceptive site ahead" or "This site may be harmful" screen when you or your customers visit.
- "This site may be hacked" under your site's name in Google search results.
- Visitors being sent elsewhere, to spam, gambling, pharmacy or adult sites, sometimes only on phones or only from Google, so you might not see it yourself.
- Strange pages in Google, often in Japanese or full of products you don't sell.
- You can't log in, or there are admin users you don't recognise.
- An email from your host saying your site was suspended, or from Google Search Console about "security issues".
What to do in the next hour
- Call or message your hosting company first. Tell them the site's been hacked. Most can confirm it, take the site offline safely and tell you which backups exist. Ask them: "Do you have a clean backup from before the hack, and can you help restore it?"
- Change every password. Your hosting account, every WordPress admin user, and the email account linked to the site. A different strong password for each. Ask your host to change the database password too.
- Check who has access. In WordPress, go to Users and remove any administrator you don't recognise.
- Don't start deleting things. You can wipe out the clues to how the attacker got in, or break the site further. Let your host or a professional guide you.
- Write down what you've seen and when: screenshots of warnings, odd pages, strange emails.
Getting the site clean
There are two main ways back to a clean site:
- Restore a clean backup. If you or your host have a backup from before the hack, restoring it is usually the fastest fix. Then update everything straight away. If you don't, the same hole lets the attacker straight back in.
- Get a professional cleanup. If there's no clean backup, or you don't know when the hack started, use a malware removal service. Many hosts offer one, and specialist WordPress security companies do this every day. A proper cleanup removes the malware and the hidden "backdoors" attackers leave so they can come back.
Once the site is clean:
- Update WordPress, your theme and every plugin, and ask your host to confirm the server runs a supported version of PHP.
- Delete plugins and themes you don't use.
- Get the Google warning removed. In Google Search Console, open "Security issues" and request a review. Google usually checks within a few days, and the warning goes once the site is confirmed clean.
- Think about your customers. If the site collected personal details or payments, you may need to tell the people affected. Get advice on what applies in your country.
How do you know it's really fixed?
Check the site on your phone and computer, search Google for site:yourdomain.com to look for pages you didn't create, and keep an eye on it for a few weeks. If the problem comes back within days, a backdoor was probably missed, and it's time for a professional cleanup.
How to stop it happening again
Most hacks come from a plugin or theme with a known flaw, a missed update, old server software or a weak password. My guide Is WordPress secure? covers the habits that prevent most of them.
But ask yourself the bigger question too. If this is the first time you've had to think about plugins, backups and server software, it won't be the last. Plenty of owners decide after a hack that they'd rather not carry that job. The realistic options are fully managed WordPress hosting, where the host keeps everything updated; an all-in-one builder, where the platform handles security; or a platform that publishes finished, "static" pages, with no plugin, server code or admin login on your public site to target.
Or skip the job entirely. That last option is how Mondovo works. There are no core, theme, plugin or PHP updates for you to run, no backups to take and no security plugin. Pages are published as static files from a global network, and platform security is our job. To see your own business there first, try Mondovo free: paste your address and it builds three designs from your own pages.
What I'd do instead: start fresh on Mondovo
If I'd just cleaned up a hack, this is the route I'd take. The usual ways in we just went through (a plugin flaw, a missed update, old PHP) mostly don't exist on a Mondovo site. There are no plugins or themes to babysit and no WordPress-style login on your public site for bots to hammer. No website is risk-free, but there's far less for an attacker to find.
Moving a hacked site is safer than it sounds. Paste your current web address and Mondovo reads your public pages, posts and images, not your WordPress installation. The plugin files, themes and server code where malware hides never come across. You see the plan before anything is designed, so you can drop spam pages or links the hack added. Then Mondovo builds three fresh designs with your own content, and you pick one.
Your old links keep working too. Mondovo redirects every old page address, including WordPress-style links, to the closest new page (301), and any that didn't match exactly are flagged for you.
Forms, bookings and payments are set up fresh in Mondovo rather than copied from your old plugins. The WordPress migration page explains exactly what comes across. Building is free, and going live is $20 a month on Pro, hosting and SSL included.
Move my WordPress site to Mondovo → or start building free.
Frequently asked questions
How do I know if my WordPress site has been hacked?
The common signs are a red browser warning, "This site may be hacked" in Google, redirects to spam, strange pages in search results, or admin users you don't recognise. An email from your host or Search Console is another clue.
Should I restore a backup or pay for a cleanup?
A clean backup from before the hack is usually fastest, if you update everything straight after. If you don't know when the hack started, a professional cleanup is safer because it also removes hidden backdoors.
How long does the Google "This site may be hacked" warning last?
Once the site is clean, request a review under "Security issues" in Search Console. Google usually checks within a few days.
Can I move a hacked WordPress site to Mondovo?
Yes. Mondovo reads your public pages and posts, not your WordPress files, so malware hiding in plugins or themes stays behind.
Is there a website platform that doesn't need security updates?
No site is risk-free, but on Mondovo the updates aren't your job: no core, theme, plugin or PHP to update, no backups to manage, static pages from a global network, and platform security handled by us.
