What to do if your site is hacked

Contain it, clean it, then close the door that was left open.

Work in order. Cleaning before containment means re-infection within hours.

Contain

1. Open an urgent ticket

   We can take the site offline behind a maintenance page in seconds, which stops visitors being harmed and stops search engines recording the defacement.

2. Change every password

   WordPress administrators, SFTP, database, the dashboard itself. Reset sessions so existing logins are cut.

3. Audit the users

   Look for administrator accounts nobody created. Attackers often add one and hide it from the user list with a plugin.

Clean

1. Restore from a backup taken before the infection

   Fastest and most reliable. Compare the file integrity report to find when it started.

2. If that is not possible, replace the code

   Reinstall core, then every plugin and theme from source. Keep only uploads, and scan that folder for PHP files, which never belong there.

3. Clean the database

   Injected scripts in wp_options, spam users, and scheduled tasks that reinstall the payload.

Close the door

• Update everything, and remove plugins that are abandoned or no longer maintained.
• Enforce two-factor for administrators.
• Request a re-scan from Google Search Console if the site was flagged.